Get started with Åpenhetsloven - Try Ignite free for 14 days!

Åpenhetsloven came into force on July 1, 2023, to promote businesses' respect for human rights and decent working conditions in connection with the production of goods and the delivery of services, as well as ensure the public has access to information on how to handle the requirements of the Act. Here's the link to the law: https://lovdata.no/dokument/NL/lov/2021-06-18-99)

The Act consists of 3 central duties:

• Carry out due diligence assessments in line with the OECD guidelines for multinational companies (link: http://mneguidelines.oecd.org/OECD-Due-Diligence-Guidance-for-Responsible-Business-Conduct.pdf).
• Publish an annual report on the work with the due diligence assessments, including organization, guidelines, routines, actual findings of a negative impact, and what measures have been taken to stop the impact.
• Inform everyone who sends a request about how the company handles actual and potential negative consequences toward human rights and decent working conditions.

The Åpenhetsloven applies to all major Norwegian businesses and foreign businesses that offer goods and services in Norway and are liable to tax according to Norwegian legislation. A major Norwegian business is defined by two of the following three criteria occurring:
- Sales revenue: NOK 70 million

- Balance sheet: NOK 35 million

- The average number of employees in the financial year: 50 full-time employees

The law requires one to carry out the three duties described above, where the core of being able to achieve the law's purpose is due diligence assessments. This must be carried out regularly and in relation to the size and context of the business. In addition, priority must be given to areas where the degree of severity and the probability of negative consequences are believed to be the highest, and to have an active relationship with how these assessments are made.

As per the OECD guidelines, the due diligence assessments to be carried out have six steps:

1. Anchor accountability in guidelines and management systems
2. Map and assess negative impact/damage based on your own business, supply chain and business relationships
3. Take measures to stop, prevent or reduce negative impact/damage
4. Monitor implementation and results of the measures
5. Communicate with affected stakeholders about how the impact has been addressed
6. Ensure, or co-operate with, recovery and compensation where required

For the duty to give an account of the due diligence assessments, one must publish a report once a year, before June 30, 2022, which must contain:

• Description of how one has worked and prioritized around the due diligence assessments
• Inform about actual negative consequences and significant risks of negative consequences that have been uncovered
• Summarize the results or expected results of implemented measures, as well as inform about planned measures to stop/limit the risk of negative consequences

Finally, the law requires that anyone who asks for information about how a business handles negative consequences (generally or for a specific product/service) has the right to this within three weeks (here, there are also various exceptions). Also, it will pay off with good internal routines for handling requests and answering honestly to the best of your ability. Start with what you have and improve your due diligence ratings over time.

Fundamental human rights are internationally recognized human rights that follow from, among other things, The UN Convention on Economic, Social and Cultural Rights from 1966, the UN Convention on Civil and Political Rights from 1966 and the ILO core conventions on fundamental rights and principles in working life. Other human rights conventions such as the ECHR, the Convention on the Rights of the Child and ILO 169 on the rights of indigenous peoples are also relevant.

Examples of human rights covered by the definition are prohibition of slavery, prohibition of child labour, freedom of association, prohibition of forced labour, right to work, as well as fair and good working conditions, non-discrimination and equal treatment for equal work.

Decent working conditions means work that safeguards basic human rights, as well as health, environment and safety in the workplace, and that provides a living wage. The concept of decent working conditions is closely linked to the concept of basic human rights.

The Åpenhetsloven is something your company has to deal with year after year; you must continuously respond to information requests and report the work with due diligence assessments annually.

We believe that with a system like Ignite, it becomes easier to both work with the process, but also to document what you have done. Ignite can help you to:

1. Get a good starting point with an overview of the entire supplier base
2. Give you an overview of existing data that you can use for risk assessment
3. Collect relevant data for due diligence assessments where there are deficiencies, directly from suppliers
4. Use data to create automatic classifications around risk (e.g. country risk, category risk or other relevant to your due diligence assessments)
5. Work continuously to improve the risk picture from year to year, with all supplier information in one place
6. Collaborate with colleagues in the same system, no restrictions on users

With Ignite, it is easy to enter supplier data, whether this is from your ERP/invoice system, an existing supplier master, or if you want to add suppliers directly to the solution.

Furthermore, we offer a framework on how to get started with addressing the risk associated with due diligence assessments and help with templates for questionnaires if you want to obtain information from suppliers. What we offer is a starting point, but it is easy to adapt to your own needs and assessments.

We give you more than a "one-off"; this is a system that helps you streamline and repeat the process year after year, just as the law requires.

Our responsibility to protect the data of our customers is a heavy one, and we take it seriously. When you entrust your spend data to Ignite, you can be assured of our commitment to safeguarding your information and meeting the highest levels of security.

Ignite is GDPR compliant, and our server and data permissions are managed through IAM solutions. Our data in databases are encrypted using the 256-bit Advanced Encryption Standard (AES-256). These data keys are themselves encrypted using a key stored in a secure keystore, and changed regularly.

Ignite also has a host and network-based Intrusion Detection System (IDS) that scans for viruses, malware, vulnerabilities etc on all our static assets (generated and uploaded) on several levels and provides threat detection for intrusions, and malware, spyware, and command-and-control attacks on our network.

In addition, Ignite secures and ensures the reliability of our external-facing resources including websites, APIs, and applications. Our CDN service provides DDoS protection, rate limiting, API protection and Web Application Firewall (WAF) to protect and secure Internet properties against denial-of service attacks, customer data breaches, and abusive bots.