I. Introduction
The key purpose of this article is to critically assess the extent to which auditing and certification to quality assurance and risk management standards containing human rights-related requirements are an adequate and effective means of ensuring that private security companies (PSCs) internalize their responsibility to respect human rights.
It is well known that PSCs have been involved in human rights abuses in numerous contexts around the world.Footnote 3 As a result, soft law initiatives have developed via multi-stakeholder processes in response to those abuses, in particular:
(1) the International Code of Conduct for Private Security Service Providers (ICoC);
(2) the International Code of Conduct Association (ICoCA), which is the organization tasked with monitoring and oversight of the ICoC; and
(3) auditable management system standards ANSI/ASIS PSC.1-2012: Management System for Quality of Private Security Company Operations – Requirements with Guidance (ANSI/ASIS PSC.1) and ISO 18788-2015: Management System for Private Security Operations – Requirements with Guidance for Use (ISO 18788).
This article concludes that there are substantial problems with ensuring that the implementation of these soft law initiatives and auditable standards fits within the larger international consensus on the corporate responsibility to respect human rights as laid out in the UN Guiding Principles on Business and Human Rights (UNGPs).Footnote 4
The corporate responsibility to respect human rights as conceptualized in the UNGPs expects companies to integrate their responsibility to respect human rights into their core corporate policies and processes with the ultimate goal being to create a shift in corporate culture through what constructivists refer to as norm internalization. This is to be achieved through the creation of (1) a corporate human rights policy; (2) a human rights due diligence process; and (3) an internal grievance mechanism. Norm internalization has long been held as the route to a human rights-respecting corporate culture and is implicitly embedded in the UNGPs. A risk management approach to the corporate responsibility to respect human rights is explicitly anticipated by the UNGPsFootnote 5 and is regarded by many security industry stakeholders as a practical way to achieve norm internalization because: (1) the concept of risk management resonates with and is familiar to PSCs; (2) it builds on the so-called ‘business case’ for respecting human rights; and (3) it can be integrated into existing management systems within a company.
ANSI/ASIS PSC.1 and ISO 18788 for private security providers are significant because they are the first third-party auditable management system standards with human rights at their core. Furthermore, they centre adverse human rights impacts as ‘risks’ that require active management by a PSC. On the face of it, this approach seems to be a feasible way to ensure that human rights are adequately and effectively integrated into the fabric of a PSC. But is that really the case? Can auditing and certification change corporate cultures in PSCs in relation to human rights? How effectively can the multi-stakeholder ICoCA oversee the privatized audit and certification mechanisms and processes utilized by the security industry?
This article explains how this complex process of supposed norm internalization, as described in the constructivist literature discussed below, via an interlocking web of soft law initiatives, is envisaged to work for PSCs and concludes that in practice flaws and weaknesses are rife.
To that end, it will firstly explain how the ICoC, ICoCA, ANSI/ASIS PSC.1 and ISO 18788 were developed with stakeholder input from states, industry, civil society and observers (the last of which includes the authors). It will consider whether the human rights requirements of these standards conform to the UNGPs.
Secondly, it describes how National Accreditation Bodies (NABs) with responsibility for accrediting certification bodies (CBs) developed accreditation rules and/or guidance, and how those CBs are accredited to certify PSCs to management standards. Questions arise as to whether NABs and CBs and their auditors have the necessary human rights competencies. It makes recommendations on how to address some of these concerns.
Thirdly, it sets out how PSCs are audited and certified and, by using qualitative data gathered by the authors as well as publicly available data, determines that even the most highly appraised PSCs are not adhering to many of the human rights requirements of the auditable standards, or the UNGPs, adequately and effectively. In particular it demonstrates that there are shortcomings inherent in using certification of risk management systems to ensure the corporate responsibility to respect human rights when they are based on audits that reflect a contractual relationship between two private parties. Using certification to ensure corporate responsibility to respect human rights is not inherently problematic but there are certainly measures that can be adopted to improve the independence and accountability of the certification process to ensure greater human rights adherence.
Finally, the article explains and assesses the role of the ICoCA, as a multi-stakeholder initiative (MSI), which is intended to provide an added layer of human rights oversight. It is shown that the ICoCA’s marriage of certification to commercial risk management systems with a multi-stakeholder approach to corporate governance and human rights is currently of limited effectiveness in ensuring that PSCs meet their corporate responsibility to respect human rights, precisely because it is an MSI whose core procedures reflect negotiated compromises. Nevertheless, the article offers suggestions as to how the ICoCA could strengthen its monitoring and oversight of its member PSCs and foster their human rights norm compliance.
The paper concludes that while it can be demonstrated that there have been some positive improvements in PSC understanding and implementation of processes to respect human rights, there are numerous and serious concerns about the credibility and effectiveness of auditing and certification as human rights norm internalization tools. The ICoCA needs to use its influence and leverage to ensure better certification as certification to standards is increasingly becoming embedded in states’ procurement requirements or policies and is therefore unlikely to go away soon. Moreover, if states rely in part on the ICoCA to meet their obligation to ensure that PSCs respect human rights, then they must also make certain that the ICoCA is in fact empowered to perform effective oversight. The ICoCA needs to return to its fundamental mission of serving as a governance and oversight mechanism assessing the human rights performance of PSCs against human rights norms.
II. The Promise of a Management System Approach to the Business Responsibility to Respect
As constructivism plays an increasingly important role in International Relations theory,Footnote 6 and in other fields such as Law,Footnote 7 growing attention is being paid to the regulative and constitutive effects of norms on State behaviour. Until recently, however, the effects of norms on the behaviour of transnational business actors was relatively neglected in the constructivist literature, in part because business actors were narrowly viewed as instrumental actors driven by a logic of consequences to fulfil a singular motive of profit maximization.Footnote 8 Efforts to engage in what would appear to be normatively driven business practices, such as corporate social responsibility and philanthropic initiatives, were explained as merely a matter of corporate cost–benefit calculations of whether doing good was also financially beneficial.
Now a subset of this literature is addressing non-state actors,Footnote 9 in particular business actors. Studies have specifically examined the role of corporations as norm entrepreneursFootnote 10 and as norm implementers, with the latter focused on exploring processes of norm internalization as companies move from norm commitment to norm compliance.Footnote 11 Others have sought to open up the ‘black box’ of the corporation by elaborating on the socially constructed nature of corporate identity and interests, viewing corporations as socially situated actors responding to the norms and other institutions in which they are embedded while simultaneously engaging in creative acts to interpret and fit norms to their practices.Footnote 12
Whether applying, adapting or critiquing the constructivist literature, these authors are all indebted to two seminal models of norm diffusion: Finnemore and Sikkink’s ‘norm life cycle’Footnote 13 and Risse and Sikkink’s ‘spiral model.’Footnote 14 Both models describe various steps in the development and spread of norms from their creation to full uptake and adherence by the relevant actors, in this case PSCs. This article focuses on the final stage of those models, i.e., what Finnemore and Sikkink call ‘norm internalization,’ a situation where norms are no longer disputed and are taken for granted by the relevant actors, and what Risse and Sikkink term ‘norm institutionalization and habituation,’ the point where norm consistent behaviour is considered the normal course of action.
As stated in the Introduction to this paper, this final stage of norm internalization is of scientific interest in helping to identify whether certification to the ICoC and ANSI/ASIS PSC.1 and/or ISO 18788 standards can ensure that a PSC demonstrates norm compliance through rule consistent behaviour. In other words, do certified PSCs fully adhere to the norm of the corporate responsibility to respect human rights? This approach does not seek to explain the process by which a PSC gets to that final stage of the norm diffusion process, rather it examines those PSCs that have already committed to the corporate responsibility to respect human rights and claim to act in accordance with it. This enables two determinations to be made: (1) whether certification enables a sufficient assessment of norm internalization; and (2) whether the risk management process at the heart of the standards is likely to result in full norm internalization. As discussed below, international business and human rights frameworks, such as the UNGPs, propose that the corporate responsibility to respect human rights can be attained by amending corporate enterprise risk management procedures to consider human rights risks and impacts. This position is mirrored in the academic literature which differentiates between ‘commitment’, as reflected in public acceptance of human rights responsibilities in codes and statements, and ‘compliance’, as evidenced by the integration of norms into management systems and risk management strategies.Footnote 15 The private security management system standards, ANSI/ASIS PSC.1 and ISO 18788, are essentially quality assurance and risk management standards building on the ISO 31000 risk management guidance. They are portrayed as operationalizing into business practice standards the human rights and humanitarian law principles at the heart of the ICoC, which itself builds on the ‘Protect, Respect and Remedy’ framework at the core of the UNGPs. Thus, this approach not only examines the efficacy of certification as a measurement of successful norm internalization, but also of a risk management pathway to embedding the corporate responsibility to respect in PSCs’ corporate culture.
Unfortunately, the literature on these private security industry global governance initiatives does not offer much assistance as only a smattering of studies examine norm internalization by PSCs. MacLeod, however, recognizes that the internalization of human rights norms into corporate culture may be fostered by third-party assessment of PSCs’ conformance to human rights risk and impact assessment (HRRIA) requirements contained in management system standards, but examining this process is not the focus of her article; rather it focuses on the question of whether States are shedding human rights responsibilities by supporting the development of self-regulation standards for PSCs.Footnote 16
In another analysis, Acheson outlines five stages of the norm socialization process in relation to PSCs, applying norms of corporate social responsibility (CSR), from pre- and basic CSR, through strategic and integrated CSR, and culminating in internalized CSR.Footnote 17 She provides indicators to assess where PSCs fall along these stages, related to internal factors (such as principles and policies, and vetting, selection and training procedures to foster responsible staff conduct) and external factors (practices related to improving accountability, oversight, transparency, and stakeholder engagement.) According to Acheson, movement through these stages indicates that during the socialization process, PSCs are increasingly driven by a logic of appropriateness rather than a logic of consequences. However, Acheson’s article reflects shortcomings found in some of the empirical scholarships investigating the application of models of norm internalization. Three issues are worth noting on this point. Firstly, CSR is best conceptualized as a bundle of norms, rather than a singular norm. This suggests, secondly, that one cannot assume that all PSCs have a shared understanding of the norm and what its application looks like in practice, as indicated by empirical evidence.Footnote 18 Finally, the logic of consequences and logic of appropriateness are distinguished from each other and it is implied that both cannot drive behaviour simultaneously and, furthermore, the researcher is assumed to be able to identify which one motivates behaviour at a given point in time. This is problematic because even in later stages of norm internalization evidence suggests that companies deploy rhetoric justifying their actions anchored in both logics.Footnote 19 Thus, evidence of a logic of appropriateness is not in itself indicative of norm internalization.
Others examine the motivation behind PSC participation in global governance initiatives resembling the ones studied here.Footnote 20 Yet ultimately the motivating factors (e.g., avoidance of government regulation, responding to civil society pressure, reputational maintenance, and gaining competitive advantage) can be reduced to the instrumental logic of the profit motive, i.e., a logic of consequences.Footnote 21 A more poignant example of this is Rosemann’s use of Milton Friedman to argue that PSCs will only adhere to a code of conduct if there is a business case to do so. He advocates, therefore, ascribing a market value to human rights in order that they be considered in the corporate cost–benefit calculus.Footnote 22 His restricted approach to human rights in the study laid the groundwork for the development of the content of the ICoC.
Narrowing explanations of business actors’ behaviour to the instrumental profit motive cannot, however, adequately account for their acceptance of human rights responsibilities, as that singular motivation remains the same whether companies do or do not adopt such commitments and practices, and is also present in later stages of norm internalization.Footnote 23 Thus, the profit motive alone cannot account for variance in corporate behaviour.
This article accepts and builds on aspects of the critique of the constructivist literature as applied to corporations. First, the logic of consequences and logic of appropriateness are not two distinct, and potentially opposing, logics. Beyond the challenge of ever knowing what ‘truly’ motivates a business actor, manifestations of both may be deployed in demands on and justifications of corporate behaviour, and ultimately as a means of narratively defending what a legitimate corporate actor is and what it should or should not do.Footnote 24 Rational profit maximization is a norm and one promoted by shareholders and companies themselves, as well as being embedded in market forces.Footnote 25 Yet, however important, it is still only one among other norms. Second, it is agreed that much of the constructivist literature on norm internalization has portrayed a unidirectional process, whereby a ‘tipping point’Footnote 26 is reached and further diffusion or ‘cascade’ of a norm becomes almost inevitable.Footnote 27 This robs actors of their agency as they become automaton-like,Footnote 28 apparently reacting to the internal pressures created by an internalized norm. It discounts that norms are intersubjectively constituted during social interactions. Actors engage in creative acts in interpreting and applying norms in practice that in turn can re-shape shared understanding of that norm.Footnote 29 In other words, norms are not ‘fixed standards’, they are ‘constantly in the making’.Footnote 30 For example, companies develop norms once they are widely accepted by further elaborating a norm’s content, specific requirements, and appropriate enforcement mechanisms.Footnote 31 In other words, even in the later stages of norm internalization, the definition and requirements of norm compliance and how it is manifested and measured, can be a point of contention. In relation to PSCs, contention arose among security industry stakeholders on the relationship between certification to management standards and certification by the ICoCA as a means of evidencing norm compliance, as discussed below.
The lived and contested nature of norms are captured by highlighting the different views held by the stakeholders in private security global governance initiatives on what the corporate responsibility to respect human rights means, what it entails in terms of operationalized business practices, and how it is best evidenced.Footnote 32 It is a negotiated outcome that there is now a dominant discourse that the risk management standards reflect an operationalization into business practice standards of the ICoC’s human rights principles and that adherence to them is best evidenced by third-party certification to those standards with additional human rights-related information provided to the ICoCA. Evidence exists that this is a strategy that has been used by corporations before. For example, with ISO 14001, which embeds environmental norms into a quality assurance management process, companies managed to shift the focus of the standard to management processes and not environmental targets.Footnote 33
The risk management approach to fulfilling human rights responsibilities creates opportunities, but also closes off certain courses of action, and thus has implications for ensuring norm compliant behaviour. For example, an enterprise risk management approach, traditionally used to assess corporate risks, may result in a delimited set of human rights issues being examined rather than a full-fledged human rights due diligence process which captures risks to rights-holders.Footnote 34 Such a delimitation of human rights can be seen in the ICoC, which focuses attention on human rights issues around the use of force, detention, torture, sexual exploitation and abuse or gender-based violence, human trafficking, slavery and forced labour, child labour and discrimination, with some additional references to rights to freedom of expression, association, peaceful assembly and freedom from arbitrary or unlawful interference with privacy or deprivation of property.Footnote 35 Even though the Code expressly states that human rights are ‘not limited to’ the rights articulated, nevertheless, in practice it is being interpreted as a delimited approach and has resulted in a truncation of human rights due diligence among PSCs. This threatens to turn HRRIAs into a tick box exercise, as well as impairing the development of rights-compliant training and grievance mechanisms.Footnote 36 An enterprise risk management approach also tends to reinforce soft law initiatives relative to government regulation by limiting governments to validating the adequacy of corporate self-regulatory practices.Footnote 37 Finally, relying on third-party certifications conducted on the basis of a contractual agreement between two private actors may also constrain the ability of other interested parties, such as civil society and multi-stakeholder associations, to contribute to and scrutinize the sufficiency of assurance frameworks meant to attest to norm internalization.Footnote 38
These opportunities and challenges are explored to assess whether certification to risk management standards can ensure PSC adherence to the internationally recognized norm of the corporate responsibility to respect human rights.
III. The Development of Multi-Stakeholder Initiatives for the International Private Security Industry
Much has been written about the evolution of the international private security industry in the last decade and a half, but an understanding of the industry and the development of its regulatory frameworks is essential to any analysis of the effectiveness of those frameworks in changing corporate human rights culture.Footnote 39 It is generally well known that the industry came under increasing global scrutiny as a result of its extensive expansion and use by allied State forces during the interventions in Iraq and Afghanistan in the early 2000s. The absence of oversight, poor corporate governance and the immunity granted to US companies under Coalition Provisional Order 17 in particular, gave significant cause for international concern in an environment that has been described by those on the ground at the time as chaotic and by academics as lawless and anarchic.Footnote 40 These circumstances gave rise to frequent allegations of alarming behaviour by PSCs, with claims of human rights violations often being made, many of which were the subject of subsequent legal proceedings, some successful, others not.Footnote 41
Against a backdrop of a more universal shift towards regulation of business and human rights through the Ruggie process and the drafting and later adoption of the UNGPs,Footnote 42 it became clear that regulatory action ‘to address the most pressing challenges to effective private security regulation’ was urgently required.Footnote 43 Thus, in response to the twin difficulties of weak corporate governance and failure to adhere to human rights standards, and with eye on the emerging corporate responsibility to respect human rights, the Swiss Government and the International Committee of the Red Cross brought together multiple governmental, civil society and industry stakeholders in 2005 under the umbrella of the so-called ‘Swiss Initiative’. The resulting multi-stakeholder negotiations led to the adoption of the Montreux Document three years later in September 2008.Footnote 44 Aimed at States, the Montreux Document articulates how international law applies to the activities of private military and security companies during armed conflict and sets out good regulatory practices. Currently 54 States and three international organizations adhere to the Montreux Document.Footnote 45 It is not a binding agreement and it explicitly does not create any new legal obligations for States. Moreover, it does not aim to regulate PSCs directly other than to offer some ‘good practices’, but it establishes the foundations for the ICoC, which was finalized in 2010 and addresses the responsibilities of PSCs directly. From its earliest conceptions, the ICoC set out to address governance gaps and to unequivocally situate human rights and humanitarian standards as an integral part of the regulatory process.Footnote 46 In the Wilton Park Nyon Declaration of 2009, it is clear that industry participants accepted this position unequivocally: ‘Following a collective process involving pertinent stakeholders, we have achieved a broad consensus that an international code of conduct must be compliant with Human Rights and IHL. Further, there is a clear necessity for effective oversight, accountability and operational standards in such a code.’Footnote 47
In drafting the ICoC, multiple stakeholders including civil society, governments and industry created a soft law mechanism in which signatory companies ‘commit to the responsible provision of Security Services so as to support the rule of law, respect the human rights of all persons, and protect the interests of their clients’.Footnote 48 This corporate commitment extends to the provision of security services in so-called ‘complex environments’, a controversial term because it restricts the application of the Code to: ‘any areas experiencing or recovering from unrest or instability, whether due to natural disasters or armed conflicts, where the rule of law has been substantially undermined, and in which the capacity of the state authority to handle the situation is diminished, limited, or non-existent’.Footnote 49 Thus many PSC commercial activities fall outside the deliberately narrow scope of the ICoC as they do not take place in, e.g., conflict or post-conflict zones or other fragile environments.Footnote 50
As mentioned previously, the Code unambiguously endorses and incorporates the Protect, Respect and Remedy framework of the UNGPs and therefore envisages that adherence to human rights standards and good corporate governance will be achieved through the process of norm internalization, as described above.Footnote 51 To that end PSCs are expected to adhere to rules on: (1) human rights, also explained above;Footnote 52 and (2) management and governance including, inter alia, standards on the use of force, risk assessment, vetting, training, weapons, incident reporting, health and safety and grievances.Footnote 53 Notably, the section on respecting human rights precedes the section on management and governance which further bolsters the importance of the human rights provisions in the Code. Furthermore, human rights due diligence principles and a requirement to ensure the provision of internal remedies and whistleblowing are integrated into the Code.Footnote 54 In essence the ICoC broadly reflects the key substantive elements of the UNGPs’ corporate responsibility to respect human rights as well as its norm internalization approach. The Code is no longer open for signature by PSCs but by 2013, 708 companies had signed it. Today, companies wishing to adhere to the ICoC are instead invited to become members of the International Code of Conduct Association (ICoCA), a Swiss-registered non-profit organization that governs and oversees compliance with the Code. In doing so, PSCs commit to an ICoCA certification process as well as agreeing to ‘ongoing independent monitoring, auditing, and verification’ including a grievance procedure.Footnote 55 At the time of writing, the ICoCA has 92 member PSCs.
Like the drafting process of the Code, the ICoCA is multi-stakeholder in nature, consisting of three pillars, government, industry and civil society, and is governed by a Board of Directors whose make-up reflects the pillars. The purpose of the ICoCA is to ensure member compliance with the Code. To that end, it is mandated by its Articles of Association to receive compliance reports from its members, certify compliance to the ICoC, monitor member activities in certain instances, as well as being authorized to receive complaints alleging violations of the Code. If a member company is found to have violated the Code and fails ‘to take corrective action or to cooperate with the Association in good faith’ it may be suspended by the ICoCA Board.Footnote 56 To date, no company has been suspended for failure to comply with the ICoC.
IV. Security Industry Management Systems: ANSI/ASIS PSC.1, ISO 18788 and ISO 28007
As outlined above, the idea that norm internalization can alter corporate behaviour is embedded in the UNGPs for all business actors generally, and in the ICoC and the ICoCA for PSCs specifically. Thus, according to the Code, ICoCA member PSCs are required to ‘establish and/or demonstrate internal processes to meet the requirements of the Code’s principles and the standards derived from the Code’. For ICoCA member PSCs there is a two-stage process. Firstly, they choose a commercial certification body (CB) to carry out independent auditing and certification of those processes. CBs in turn are accredited to carry out the audits by National Accreditation Bodies (NABs). There are currently three CBs accredited to audit to these management system standards and all are accredited by the UK Accreditation Service (UKAS).Footnote 57 Secondly, member PSCs must obtain certification from the ICoCA itself by submitting evidence of successful conformance to an approved standard. At present the ICoCA recognises the US-developed ANSI/ASIS PSC.1 standard and the international ISO 18788 and ISO 28007 management systems as meeting the majority of the requirements of the Code.Footnote 58 A PSC that is certified to one of these standards will then receive ICoCA certification subject to the fulfilment of some additional requirements. This is because the ICoCA Board, after having reviewed the standards against the ICoCA’s requirements, determined that there are gaps between the Code and the standards; a determination which some government and corporate stakeholders opposed. Therefore, in addition to a certificate, PSCs must provide their audit results and any corrective action plans as well as additional human rights-related information to include, among other things, their HRRIA process.Footnote 59 It is important to note that the ICoCA Articles of Association 11.2.4 provide that ‘[t]he certification process shall operate in a manner that is complementary to, and not duplicative of, certification under Board-recognized national and international standards.’ What this has meant in practice is that the Association has been actively discouraged from exploring the competence or efficacy of the auditors and monitoring ongoing conformance to the standards and so a certification by a CB is taken largely at face value. This has serious consequences as will be shown below.
Certification of PSCs by third parties, whether CBs or MSIs, in this case the ICoCA, is supposed to indicate conformance with the human rights-related and other requirements in management system standards and the Code. However, as discussed next, what certification is meant to attest to in theory and what it really evidences in practice may diverge, which in turn affects perceptions of the sufficiency of certification as an indicator of norm compliance.
In examining whether certification is an adequate and effective means of ensuring that PSCs meet their corporate responsibility to respect human rights, certification methodologies, audit results, and corporate process and performance data are ideally needed to compare requirements against actual corporate implementation and outcomes. This in turn would allow a determination of whether auditors identify and capture discrepancies between requirements and performance and make appropriate decisions regarding awarding of certification, and if certification drives an ongoing continual improvement process leading to a deepening internalization of the corporate responsibility to respect.
Unfortunately, instances of opacity throughout the certification process inhibit access to complete data. In particular, the agreements between PSCs and the CBs auditing them represent a contractual relationship between two private actors involving information deemed proprietary and confidential by both. This means that CBs do not publicly share their self-developed, proprietary auditing methodologies, because they believe them to be an important source of competitive advantage relative to their competitors. PSCs are similarly not required to share the results of their audits but may choose to do so, as some member PSCs have done with the Secretariat of the ICoCA as part of the additional information required for ICoCA certification. While the Secretariat of the ICoCA has access to the audit reports of its members, it must be noted that it cannot see the methodology behind the audit results and determinations, and in any event it cannot share such information publicly.
While non-transparency, due to concerns about the disclosure of proprietary and confidential information which could have a range of second order competitive and legal effects, is certainly justified in some instances, it poses a challenge for researchers and other interested parties – industry clients, NGOs, government officials, the media – seeking to assess the sufficiency of certification. The authors have sought, therefore, to overcome these challenges by basing their conclusions on four distinct sources of data:
(1) Direct participant observation: participant observation is ‘research in which the researcher observes and to some degree participates in the action being studied’, which ‘produces the most direct evidence on action as the action unfolds in everyday life’.Footnote 60 It allows a synthesis of evidence gathered through observation with theories of social processes, enabling an integration between micro and macro levels of analysis as the researcher moves back and forth between observed practices and theory application and extension. The authors have participated in various capacities (e.g., Human Rights Technical Experts) in the development of the governance initiatives examined here including contributing to the drafting of the ICoC, the ICoCA’s Articles of Association, and ANSI/ASIS PSC.1 and ISO 18788, participating in the UK Foreign and Commonwealth Office’s (UK FCO) PSC.1 pilot scheme to certify the first PSCs to PSC1, and serving as Observers to the ICoCA.
(2) Research project: data collected in 2014–2015 through questionnaires and semi-structured interviews of government, industry and civil society stakeholders for a research project on human rights standards and training in the private security industry.Footnote 61 Respondents and interviewees included government representatives, legal counsel and compliance officers from the PSC sector, civil society and other stakeholders.
(3) Additional semi-structured interviewing: this article draws to a limited extent on semi-structured interviews conducted in 2014 for a research project on the interactions between private security governance initiatives and more extensively on interviews carried out in October 2017 to support research examining PSCs as agents in global governance.Footnote 62 Interviewees included corporate representatives, government officials, civil society representatives, individuals involved in the governance initiatives, and employees of law and consulting firms. Interviews were conducted for non-attribution to facilitate a more open sharing of information.
(4) Desk-top research of materials made publicly available by PSCs: using an adaptation of Sebstead’s methodology initially applied to assess whether PSCs certified to ANSI/ASIS PSC.1 had adequately fulfilled the public-facing, transparency requirements of the standard, the authors conducted a similar assessment of the 16 PSCs currently certified to the ICoCA as well as PSC1 and (or) ISO 18788, which focus on land-based security services, based on materials accessible on their websites.Footnote 63
V. Auditing and Certification ‘In Theory’
MacLeod has described the interconnection between the requirements for PSCs to receive ICoCA certification and auditing and certification to the management system standards ANSI/ASIS PSC.1 and ISO 18788 as ‘self-regulation-“plus”’.Footnote 64 Indeed the combination of evidenced conformance to commercial management system standards with additional human rights-related certification and monitoring and oversight requirements laid out by a MSI promises, in theory, a particularly rigorous assurance process that should ideally minimize the possibility of decoupling. Decoupling has been a main critique of the efficacy of management system and other accountability standards and captures the idea that weak assurance frameworks can result in compliance as ‘window dressing’ by determining adherence to a process rather than accountability for substantive outcomes.Footnote 65 Before detailing how certification manifests itself in practice, the workings of this system are described briefly in theory.
Turning first to ANSI/ASIS PSC.1 and ISO 18788, these governance initiatives have a disaggregated and marketized infrastructure supporting them.Footnote 66 In a nutshell, the standards are drafted by Technical Committees under the auspices of standards-setting bodies, in this case ASIS International (US) and the International Organization for Standardization (ISO) (global), respectively.Footnote 67 In both instances, the US Department of Defense (DoD) funded the development process of the standards, although this is not supposed to lend the DoD greater voice in the process. The Committees consist of interested stakeholders, but are heavily dominated by business interests, such as PSCs, commercial clients and consultants. For example, Committee members for ANSI/ASIS PSC.1 were drawn from three stakeholder categories: users/managers, producers/service providers, and general interest, the first two of which primarily represent for-profit interests. National standards bodies, such as ANSI, recognize standards as having been developed in accordance with their standards development requirements. The standards are published and available for a fee.
National accreditation bodies such as the UK Accreditation Service (UKAS) or the US-based ANSI-ASQ National Accreditation Board (ANAB) create rules and guidance for accrediting CBs to audit PSCs on their conformance to the standards.Footnote 68 Accreditation rules generally build on ISO’s standard for accreditation, ISO 17011 Conformity Assessment – General Requirements for Accreditation Bodies Accrediting Conformity Assessment Bodies. In this case, ANAB’s accreditation rule and UKAS’ accreditation guidance were developed after the first CBs were accredited and the first PSCs certified under a UKAS pilot project supported by the UK FCO. Probably due to the limited market for PSC certification, as mentioned above, there are only three UKAS-accredited CBs.Footnote 69 While a small number of companies around the globe offer certification it is unclear whether they are accredited by national accreditation bodies.
ANAB and UKAS are members of another oversight body, namely the International Accreditation Forum (IAF). The IAF describes its purpose as ‘to develop a single worldwide program of conformity assessment which reduces risk for business and its customers by assuring them that accredited certificates may be relied upon. Accreditation assures users of the competence and impartiality of the body accredited.’Footnote 70 The ICoCA certification procedure stipulates that it will only recognize certification to the management standards granted by CBs accredited by an IAF-member national accreditation body.Footnote 71
Under management system standard certification schemes, CBs are bound by additional standards that set out how audits are to be conducted. ANSI/ASIS PSC.2-2012: Conformity Assessment and Auditing Management Systems for Quality of Private Security Company Operations provides such guidance and is built on the ISO 17021 Conformity Assessment – Requirements for Bodies Providing Audit and Certification of Management Systems standard. Often, auditors are certified individually after participating in accredited auditor training programmes. In this case, however, CBs are training their own auditors on auditing ANSI/ASIS PSC.1 and ISO 18788 specific elements in-house, although it is known that two of the accredited CBs worked with external human rights consultants for a limited time prior to and during some of the early ANSI/ASIS PSC.1 certifications.
Determining accurately the precise number of PSCs certified to either ANSI/ASIS PSC.1 or ISO 18788 is problematic. There are several reasons for this. Firstly, the international security industry is in a regular state of flux with frequent takeovers and mergers as well as insolvencies. This means that there are some certified PSCs that have been absorbed by other certified companies and some that were not competitive and were dissolved, thus reducing the overall number of certified PSCs. Secondly, complex corporate structures hamper identification of the number of certified PSCs. The use of subsidiaries, joint ventures and other commercial arrangements creates a certain haziness around which specific entity is certified. Thirdly, some PSCs are certified to both ANSI/ASIS PSC.1 and ISO 18788. Notwithstanding these difficulties, at the time of writing, the Security in Complex Environments Group (SCEG) counts 40 PSCs as ANSI/ASIS PSC.1 certified and 27 as ISO 18788 certified, but it should be noted that these numbers are inflated as some PSCs are certified to both standards.Footnote 72 Nevertheless there has been a significant increase in certifications since 2015 and it is understood that another 20+ certifications are currently in progress.Footnote 73
As can be seen below in the analysis of the data, it is also challenging in many instances to identify the precise scope of a certificate when this information is not shared publicly. While it is permissible to limit the scope of certification to parts of a business enterprise, certain operations or programmes and delimited geographies, any party interested in the scope as an indicator of which portion of the PSC’s business activities are norm compliant will almost certainly not have easy access to this information. While the 2011 version of ISO 17021, which formed the foundation of ANSI/ASIS PSC.2, contained requirements in clause 8.3 that a CB maintain and make publicly accessible a directory of valid certificates, which among other things contains information about certificate scope, that requirement was eliminated in the updated 2015 version of ISO 17021. Now under clause 8.1.2 of the 2015 version such information must only be made available upon request.
Currently 16 out of 92 ICoCA member PSCs are further certified by the ICoCA, which brings the companies into full compliance with the Code, i.e., they have fulfilled the additional ICoCA requirements.Footnote 74 The ICoCA recently determined that upon joining the Association, PSCs have a two-year period in which to earn certification. That transitional membership process began in April 2018 for current members.
It must be noted, however, that the current ‘fit’ between the management system standards and ICoCA, as two very different types of governance initiatives, resulted from an intensely negotiated compromise between stakeholders that took nearly two years. As detailed elsewhere, while the dominant narrative is that the management system standards represent an ‘operationalization’ into business practice standards of the high-level human rights and humanitarian law commitments contained in the ICoC, the initial proposals for an international governance and oversight mechanism (later to be named the ICoCA) and participating civil society organizations did not foresee dependence of ICoCA certification on prior certification to ANSI/ASIS PSC.1 or ISO 18788.Footnote 75 The linkage to the standards created certain path dependencies for the ICoCA in terms of the extent to which it could request additional information from members. In particular, in discussions around the development of the certification procedure, member PSCs and governments pushed the Association to avoid what they termed ‘duplication’ of certification requirements already met under the standards. Similarly, there was also initial resistance to aspects of the proposed field-based monitoring procedure justified by the fact that Stage 2 audits required for ANSI/ASIS PSC.1 and ISO 18788 certification incorporated field visits. Interviews with some industry representatives indicate, however, that the dependency may flow both ways, as they recognize that the multi-stakeholder nature of the ICoCA can lend legitimacy to the management standards, whose credibility could otherwise be called into question as a solely industry-driven initiative. Current stakeholders from all three pillars of the ICoCA – governments, PSCs and civil society – see positive potential in melding a management system approach with the independence, oversight and accountability offered by an MSI to ensure PSCs’ internalization of their corporate responsibility to respect human rights.
Nevertheless, an analysis of publicly available data relating to the 16 PSCs certified by the ICoCA reveals some disturbing trends and in some instances demonstrates that compliance is worsening rather than improving, i.e., the opposite of norm internalization. Of the 16 companies analysed, 11 have been certified by MSS Global with the remaining five certified by Intertek. The 16 certified companies have all received either an ANSI/ASIS PSC.1 or an ISO 18788 certification (and in some cases, both) and have subsequently been assessed by the ICoCA as meeting the full requirements of the ICoC (eight via PSC.1 and eight via ISO 18788). Again, it must be borne in mind that the Association accepts the certifications as verification of conformance with ANSI/ASIS PSC.1 or ISO18788 and only assesses whether the PSC seeking ICoCA certification successfully addresses the gaps between the ICoC and the standards.Footnote 76 The ICoCA does not monitor conformance to either PSC.1 or ISO 18788.
The authors monitored the websites of the 16 certified PSCs over several months from February to September 2018 and discovered multiple and ongoing instances of non-conformance with the human rights elements of the Standards (Fig. 1):
Figure 1 Mapping ICoCA certified companies: conformance with key human rights indicators of ICoC and/or ANSI/ASIS PSC.1 and/or ISO18788
What these figures show is that even when companies are certified to a recognized standard, they are not acting in conformance with some of the most basic human rights elements of ANSI/ASIS PSC.1 and ISO 18788, which they must evidence publicly. By extension this means that they also cannot be complying with the ICoC, not to mention the UNGPs.
There are two groups of companies included in the group mapped: (1) those that received certification post-2016 and whose public-facing human rights indicators have not been mapped previously; and (2) those companies that received certification prior to 2016 and some of whose conformance has been subject to scrutiny previously.Footnote 82 Both groups demonstrate instances of non-conformance. Not one of the ICoCA certified PSCs met all of the human rights indicators mapped and astonishingly one company does not meet a single one of the indicators.
Of most concern, however, is that the authors identified numerous instances of the pre-2016 certified PSCs that had in fact regressed in their level of conformance with the standards and so their behaviour contradicts the theory that there is a unidirectional norm cascade process toward ever greater norm internalization. So, for example:
∙ In two cases, ANSI/ASIS PSC.1 and ISO 18788 certificates that were previously available publicly, are no longer available and formal confirmation of the geographical scope of those certifications is also unavailable;
∙ Similarly, Statements of Conformance that demonstrate commitment to human rights at the highest level that were previously available publicly are no longer available;
∙ A link to a previously accessible third-party grievance mechanism did not work for a minimum of eight months, rendering it inaccessible.
Furthermore, for some of the PSCs, human rights policies that were previously published on company websites can no longer be accessed. In another case, references to human rights due diligence have been removed, and in several cases where human rights are mentioned, the references to assessment and mitigation of human rights risks and impacts are vague or non-existent.
While a couple of the PSCs have improved the accessibility to grievance mechanisms and policies since previous mapping, shockingly two companies have no publicly available and accessible third-party grievance mechanism at all. In seven cases, while a grievance mechanism is made available, there is no information given about the grievance process itself in terms of describing, e.g., who will hear the complaint, how long it will take and possible outcomes. Upon closer examination, other barriers include mechanisms only being available in English, several broken links to online information, overly legalistic wording and a requirement to submit complaints in writing to a head office in another country. Furthermore, five of the supposedly third-party grievance mechanisms focus on whistleblowing and internal stakeholders, such as employees, rather than external stakeholders such as local communities as required. This is a recurring problem with the international private security industry. MacLeod’s research has identified that even when a company has been through a certification process, corporate understanding of the definition of external stakeholders can be confused, with respondent PSCs identifying employees, for example, as external stakeholders.Footnote 83 For companies yet to be certified, lack of awareness of human rights risks and impacts for external stakeholders increases substantially, with half of non-certified respondents in MacLeod’s research omitting any reference to local communities.Footnote 84 Given this lack of understanding it is not surprising, therefore, that many PSC third-party grievance mechanisms fall short of conformance by focusing only on internal stakeholders, but it also raises questions about the likely effectiveness of any HRRIA undertaken by a company. It will be impossible for PSCs to undertake an adequate HRRIA if they cannot identify accurately those whose human rights may be impacted adversely by their commercial activities.
These findings should be of the utmost concern to all stakeholders as it undermines the credibility of the overall PSC regulatory project. They raise several issues:
(1) If the simple public-facing elements for conformance are not being met, to what extent can PSCs be trusted to conform to the less transparent human rights requirements of the standards, e.g., human rights due diligence?
(2) If the CBs are not requiring conformance with the public-facing elements of the standards, through regular surveillance audits, special audits or monitoring or even withdrawal of the certificate, to what extent can they be trusted to require conformance with the less transparent human rights requirements?
(3) If PSCs struggle to even recognize that the standards require them to consider human rights risks to and impacts on local communities, and that they should incorporate human rights methodologies into their risk management processes, how can they be trusted to conduct HRRIA appropriately and effectively?
(4) As noted above, the ICoCA has been explicitly discouraged by its stakeholders from examining PSC conformance with the standards once a certificate has been awarded by a CB. So there is a clear lack of adequate and effective public oversight of a private certification process.
VI. Conclusion
The constructivist theories now implicit in the business and human rights sphere, and by extension regulation of the international private security industry, assume that norms matter and that once the normative tipping point is reached corporate actors will comply with human rights as a matter of course.Footnote 85 This article has demonstrated that within the context of the international private security industry such assertions may be challenged and, in some instances, disproved. There is a real danger that the hard-won promise of the PSC multi-stakeholder regulatory framework and its associated certification processes will lose all credibility if urgent attention is not paid to these serious problems. So, while there is no doubt that the international security industry is evolving, nevertheless, it seems that the shift to primary reliance on quality assurance and risk management is resulting in companies losing sight of fact that the standards were created to address deficiencies in corporate governance AND human rights.
In an attempt to resolve some of the manifest weaknesses of the certification process, the following improvements are proposed:
∙ Role of National Accreditation Bodies (NABs)
While a certification approach to human rights is not problematic per se there are two clear problems that the research findings highlight that must be addressed at the national accreditation level: (1) human rights training for CBs; and (2) effective oversight by NABs.
As management standards had never been used to regulate human rights previously, there was an initial knowledge deficit which still persists. It is crucial, therefore, that both the NABs (in particular UKAS as the sole NAB currently accrediting in this field) and the CBs acknowledge this ongoing deficit and tackle it head-on. NABs must ensure that they, and the CBs that they accredit to conduct human rights-based audits, are fully informed and trained in using human rights methodologies. NABs must ensure that CBs establish and maintain internal human rights expertise or competence at minimum and both NABs and CBs should utilize external human rights expertise more extensively and effectively. In particular, CBs must understand that compliance with corporate responsibility to respect requires the application of different methodologies than other forms of risk assessment entail and must adjust their training and audit methodologies accordingly. HRRIA is distinguishable from other forms of traditional enterprise risk management and moreover demands that focus be on impacts to rights-holders and that the severity of adverse human rights impacts be examined for scale, scope and irremediability.Footnote 86 Furthermore, NABs must monitor the theoretical understanding of and practical implementation of human rights methodologies by CBs in order to provide informed, effective and credible accreditation oversight.
∙ Role of PSCs and CBs
PSCs are comfortable with an auditing and certification process because: (1) they understand and are familiar with this system because many PSCs have already undergone auditing by CBs to management standards in other areas, e.g., ISO 9001; (2) the private contractual nature of the certification process is more easily controlled by them; and (3) the certification approach is reinforced by State clients and the ICoCA itself. There are several problems with this approach:
(1) There is a manifest lack of transparency in the private contractual relationship between the CB and the PSC being audited;
(2) Commercial confidentiality is often used to justify and restrict disclosure of audit and certification related information by PSCs and CBs;
(3) The private contractual nature of the CB/PSC relationship can lead to PSCs treating the awarding of certification as guaranteed;
(4) The demand for PSC certification is currently delimited. CBs are commercial entities operating in a niche market and feel the financial pressure of offering audits with diminishing returns. Thus they are under pressure to maintain their existing client base.
In order for the certification approach to be regarded as effective and credible, PSCs must operationalize their human rights commitments in a fashion that does not subordinate human rights to the business case or to corporate risk management. They must ensure that they undertake comprehensive human rights due diligence, engaging with external stakeholders, as well as effective external communication of fulfilment of their human rights obligations under the standards and the Code. Failure to do so will rightly be perceived as PSCs conveniently holding themselves out as responsible business actors by adopting human rights language but doing little in the way of concrete behavioural shifts.
∙ Role of ICoCA
The findings of the research highlight and emphasize the importance of the oversight and monitoring role of the ICoCA, but unfortunately the Association is being hampered in fulfilling its mandate by the reluctance of certain stakeholders to allow it to monitor the effectiveness of certifications. Currently there is an unhealthy and unbalanced reliance on the perspectives and competencies of the NABs (e.g., UKAS), the CBs and the industry itself. The ICoCA could, within the terms of its mandate, further scrutinize areas of a PSC’s operations that were already audited should there be cause for concern, but that would require the ICoCA to expand its monitoring procedure.Footnote 87 There is an apposite opportunity here to raise the alarm and fix the problems before they spiral out of control and harm the credibility of ICoCA as an oversight mechanism, but it will require all stakeholders to support the Association in this goal.
∙ Lessons to be learned by other commercial sectors?
While it is clear that there are substantial problems with ensuring that the soft law initiatives and auditable standards for the international private security industry fit within the larger international consensus on the corporate responsibility to respect human rights, nevertheless, the certification approach supported by MSI oversight offers many useful lessons for other industries. Any sector considering this approach must, however: (1) ensure robust human rights training for NABs and CBs, drawing on external expertise if necessary; (2) safeguard transparency of the private audit process; and (3) guarantee independent and effective third-party oversight.
What is also clear, is that in the absence of such safety measures the constructivist ‘tipping point’ resulting in the internalization of the corporate responsibility to respect human rights becomes a distant fantasy when there is inadequate norm compliance or, worse yet, norm regression.
