The identification of ‘conflict-affected and high-risk areas’ (CAHRAs) is a critical step in the due diligence framework defined by the OECD for responsible mineral supply chains, and therefore in the compliance requirements of industry schemes based on the OECD Guidance.

However, at Kumi our experience has shown that many companies struggle to develop appropriate and robust mechanisms to identify CAHRAs. Indeed, we often see this issue raised as a non-compliance during industry scheme audits. Common mistakes include:

  • Not considering risks on a global scale (e.g. focusing on the Democratic Republic of Congo – as required by the US Conflict Minerals Rule – but not considering the global scope required by industry schemes or EU regulation)
  • The omission of key risk categories (e.g. focusing on conflict and/or corruption risks but neglecting human rights risks)
  • Not having a reasonable – and defensible – rationale for determining why a location is or isn’t a CAHRA.
  • Inaccurate or incomplete data collation and analysis.

We observed that when companies develop their own system and approach it can be very time-consuming and resource intensive for the company to maintain. Many companies struggle with developing an effective methodology and then keeping their information up to date.

We created CAHRA Map to solve these problems for companies and create an authoritative, user friendly digital tool to support due diligence and audit compliance.

The CAHRA Map is uniquely designed as a practical and credible tool to support companies’ due diligence:

  • The tool clearly states whether a country can be considered to be a CAHRA and explains the rationale for this rating. Whilst companies have sole responsibility for their own decisions and can choose to accept or disregard our rationale, this makes it easy for companies who are otherwise left guessing as to whether a particular rating means a country is or isn’t a CAHRA.
  • The CAHRA Map uses a ‘trigger system’ to identify CAHRAs based on whether information from any of the risk indices raises a red flag. In our view this is more methodologically sound than applying a weighted methodology as some organisations do and is aligned to the approach set out in the OECD Guidance. See ‘risk thresholds’ below for more.
  • CAHRA Map provides a stronger coverage of human rights risks than resources developed by other organisations. The tool includes a number of carefully selected, highly credible global indices that address relevant human rights risks, including child labour and slavery. This is particularly important given the increasing focus on human rights due diligence expectations on companies.
  • CAHRA Map is applicable to all minerals and does not limit its scope to countries that produce so called ‘conflict minerals’.
  • CAHRA Map has been designed with users’ needs in mind, both in terms of how information about risks is presented to inform any subsequent due diligence activities and in the functionality of the tool to enable users to generate a clear audit trail of the CAHRA assessments undertaken that they can combine with other due diligence records that need to be provided to industry scheme auditors.

The OECD defines a CAHRA as follows:

“Conflict-affected and high-risk areas are identified by the presence of armed conflict, widespread violence or other risks of harm to people. Armed conflict may take a variety of forms, such as a conflict of international or non-international character, which may involve two or more states, or may consist of wars of liberation, or insurgencies, civil wars, etc.

High-risk areas may include areas of political instability or repression, institutional weakness, insecurity, collapse of civil infrastructure and widespread violence. Such areas are often characterised by widespread human rights abuses and violations of national or international law.”

This is the definition we use in our approach.

No ‘official’ designated list of CAHRAs meeting this definition exists or is likely to exist given the political fallout that would occur. Industry schemes and regulations such as the EU Conflict Minerals Regulation make it explicitly clear that companies are responsible for determining CAHRAs. Companies need to be able to demonstrate to their auditors that they have used a credible and reasonable methodology to determine CAHRAs: CAHRA Map provides this service for companies.

No. As set out in the OECD Guidance, CAHRA identification is the lead-in to enhanced due diligence. The purpose of undertaking a CAHRA analysis is to determine whether more due diligence is needed, or not. If a sourcing location is a CAHRA, it doesn’t necessarily mean that the source itself is high risk, but it does mean that the circumstances of the source’s location increase that possibility. Therefore, further due diligence investigation is needed.

CAHRA Map clearly sets out what indices have raised a red flag that caused a country to be identified as a CAHRA, so that users can determine what next steps might be required.

No. CAHRAs are identified at a country-level, rather than at a regional level. Whilst of course there are some countries where certain regions may represent a high risk and other regions may not, there are several important reasons for not attempting to make this distinction in the CAHRA Map:

  • A majority of the risks under the four CAHRA risk categories will not vary significantly within different regions of the same country. For example, governance and corruption risks tend to be linked to mechanisms of the nation state; individual regions within a country seldom (if ever) have the autonomy to provide ‘good governance’ if there are risks at a national level. Countries where there are increased risks of human rights abuses usually represent that increased risk because of weaknesses in national-level controls, such as the rule of law.
  • Publicly available data sources available to companies to support CAHRA risk determination are usually limited to country-level data. Simply put, there is just not enough sub-regional data available in the public domain to provide a consistent and credible global methodology for analysing CAHRA risks.
  • Focusing on CAHRA risks at a regional level risks providing false confidence and undermining the whole purpose of CAHRA risk analysis within the due diligence framework. This is because the purpose of CAHRA analysis is to determine whether further due diligence is needed – focusing only on regional level risks (e.g. is the location where minerals are sourced affected by conflict) could mean that more systematic risk factors are missed (e.g. likelihood of human rights abuses).

If a company determines that it is sourcing from a CAHRA then further due diligence is used to understand the true nature of risks. That is why the CAHRA Map clearly specifies what risk category(ies) and data source has triggered the definition of a CAHRA, enabling the company’s due diligence to be targeted and efficient. As all data sources are publicly available, users can refer to the source data if needed to obtain specific information about a particular index rating.

CAHRA Map utilises the four key CAHRA risk categories that are set out in the European Commission’s guidelines that accompany the EU Conflict Minerals Regulation:

  • Human rights
  • Conflict
  • Governance
  • Mineral flows

The risk determination process involves:

  1. Identification of globally recognised indices, data points and publicly available research per risk category.
  2. Analysis of identified data in order to develop robust CAHRA thresholds per risk category.
  3. Testing of each country against each threshold, to determine if any CAHRA categories are triggered.

The thresholds for triggering determination of a CAHRA have been determined by Kumi based on our professional judgement. It is important to note there is no ‘correct’ or ‘official’ threshold for determining a CAHRA; the thresholds used in CAHRA Map have been set on what Kumi considers to be a reasonable and pragmatic basis, utilising the definitions provided by the various indices used.

We have used a binary yes / no trigger system to identify whether a country is a CAHRA. We have purposely avoided introducing a weighting system. With four different risk categories to consider, a weighting system can have the effect of ‘hiding’ risk factors, meaning that companies may miss risks in their supply chain that should have been investigated.

For each index used, the CAHRA definition is applied to countries determined by that index to be high risk. Below, we present an example of a CAHRA trigger for one of the indices used for Human Rights.

HUMAN RIGHTS ITUC Global Rights Index 2019 Countries with a score of 5 or 5+ as ranked by ITUC

5 - No guarantee of rights
5+ - No guarantee of rights due to breakdown in the law

Data used in the CAHRA Map is gathered from a series of indices and data providers, including (but not limited to); British Geological Survey, Transparency International, Heidelberg Conflict Barometer, Global Slavery Index, US Department of Labor, ITUC and the EU.

Our full methodology is available to subscribers. If you are interested in learning more about the methodology prior to becoming a user, please contact us.

We update the data once per month, or whenever a data index is updated.

Next steps if you are sourcing minerals from a supplier in a CAHRA can be found on this page. Please do get in touch for bespoke support and advice: CAHRAmap@kumi.consulting

Please contact us at CAHRAmap@kumi.consulting for subscription details.

With a standard subscription, subscribers can nominate two users (from within the same organisation). There are no limits on the number of searches or downloads within the subscription period.

Non-standard access packages are available, including individual country reports, integration of CAHRA Map analysis into broader due diligence support from Kumi, and access for organisations other than those directly producing or purchasing minerals. If you are interested in discussing a non-standard package, please contact us: CAHRAmap@kumi.consulting

Data protection is a top priority. CAHRA Map is hosted on a secure, enterprise grade cloud computing platform and is GDPR compliant. Users of CAHRA Map have their own unique account profile and data such as searches performed by an individual is visible only to the account holder. For further details see our privacy policy.