How to use this
ISO 26000 is guidance, so there is no pass mark and no auditable requirement list. What this checklist does is give you the questions an assessor asks under each core subject, so you can see where you stand before anyone external looks.
Answer each with evidence, not intention. "We treat suppliers fairly" is a position. A supplier code of conduct, signed acknowledgements and a record of what happened when someone breached it is evidence.
A note on the standard itself: ISO 26000 is a copyrighted ISO document and has to be purchased from ISO or a national standards body. Anyone offering a free full PDF is distributing it without licence. This checklist is our own work and is free to use.
1. Organizational governance
Is there a documented decision-making structure showing who is accountable for social responsibility? Does leadership demonstrably consider social and environmental impact in decisions? Are there mechanisms for stakeholders to influence decisions? Is authority delegated with accountability attached? Do you monitor and report on how decisions turned out?
Evidence: governance structure, terms of reference, minutes showing social impact discussed, stakeholder engagement records.
2. Human rights
Have you conducted human rights due diligence across your operations and supply chain? Do you have a policy covering discrimination and vulnerable groups? Is there a grievance mechanism workers can actually use, including anonymously? Have you assessed risk of complicity in abuses through business relationships? Do you address civil, political, economic, social and cultural rights?
Evidence: due diligence records, policy, grievance log with outcomes, supplier assessments.
This is one of the two subjects SA8000 audits in enforceable detail.
3. Labour practices
Are employment relationships documented and lawful, including for contract and agency workers? Are working conditions, hours and remuneration recorded and compliant? Is there genuine social dialogue and freedom of association? Is health and safety systematically managed? Is training and development available across the workforce, not only management?
Evidence: contracts, hours and payroll records, health and safety records, training completion by role.
The other subject SA8000 covers in depth — and where most supplier programmes focus.
4. The environment
Do you identify environmental impacts across the life cycle of what you produce? Is there pollution prevention with measured outcomes? Do you manage resource use and efficiency? Have you assessed climate impact and adaptation? Do you consider ecosystems and biodiversity where relevant?
Evidence: impact assessments, consumption and emissions data with a trend, improvement targets and progress.
Certifiable separately through ISO 14001.
5. Fair operating practices
Is there an anti-corruption policy with training and a reporting route? Are political contributions and lobbying disclosed? Do you compete fairly and avoid anti-competitive practice? Do you promote social responsibility in your value chain rather than only your own operations? Do you respect property rights including intellectual property?
Evidence: anti-corruption policy and training records, supplier code of conduct, whistleblowing records.
6. Consumer issues
Is marketing fair, factual and unbiased? Do you protect consumer health and safety in products and services? Do you enable sustainable consumption? Is there accessible dispute resolution? Is consumer data protected and privacy respected? Is essential service access considered where applicable?
Evidence: marketing review process, safety records, complaint handling with outcomes, privacy policy and practice.
7. Community involvement and development
Do you engage with communities affected by your operations? Do you contribute to education, skills or local employment? Do you consider technology access and local economic development? Are contributions tracked and their outcomes assessed rather than only their spend?
Evidence: engagement records, programme documentation, outcome measurement rather than donation totals.
Scoring your answers
| Answer | Means | What to do |
|---|---|---|
| Evidenced | Documented, operating, records exist | Nothing — this is your baseline |
| Stated | Policy exists, practice unverified | Find the evidence or accept it is not in place |
| Partial | Happens inconsistently | Systematise before an assessor looks |
| Absent | Not addressed | Decide whether it is relevant to you at all |
"Not relevant" is a legitimate answer under ISO 26000 in a way it is not under a certifiable standard. Community involvement means something very different for a twelve-person software firm than for a mining operation. What matters is that the judgement is deliberate and written down.
From checklist to attestation
A self-assessment tells you where you think you stand. It cannot tell a customer anything, because you produced it yourself.
What converts it into something external is an independent gap assessment and attestation — the same questions, asked by an assessor who samples evidence rather than accepting answers, ending in a signed statement you can share.
And if what you actually need is a certificate rather than an attestation, that is SA8000 — see the comparison.
FAQs
Is there an official ISO 26000 checklist?
No. ISO 26000 is guidance rather than a requirements standard, so there is no official audit checklist and no pass mark. Practical checklists like this one organise the questions an assessor would ask under each of the seven core subjects, but they are interpretations rather than an official instrument.
Where can I download the ISO 26000 standard PDF?
From ISO or your national standards body. It is a copyrighted document that must be purchased, and sites offering a free full PDF are distributing it without licence. Self-assessment checklists and summaries, including this one, are separate works and can be shared freely.
What are the seven core subjects of ISO 26000?
Organizational governance, human rights, labour practices, the environment, fair operating practices, consumer issues, and community involvement and development. Each is addressed through a set of issues, and not all will be equally relevant to every organization.
Can I self-assess against ISO 26000?
Yes, and it is a sensible first step. What a self-assessment cannot do is tell a customer anything, because you produced it. An independent gap assessment asks the same questions but samples evidence rather than accepting answers, and ends in an attestation you can share.
Do all seven core subjects apply to my organization?
Not necessarily to the same degree. ISO 26000 is guidance, so judging a subject less relevant is legitimate in a way it would not be under a certifiable standard — community involvement means something very different for a small software firm than for a mining operation. What matters is that the judgement is deliberate and documented.
Where to go next
Get it assessed independently with an ISO 26000 gap audit, compare with SA8000, or read the ISO 26000 overview.