RBA Responsible Business Alliance standards and audit improvement guidance｜Startrust

From customer audit pressure to daily management, establish a responsible business system that can operate consistently in documents, on-site and employee interviews

The RBA requires more than just preparing a set of documents for auditors to review. Working hours, wages, recruitment fees, occupational safety, chemicals, waste, business ethics, grievances and supplier responsibilities all need to be implemented on the actual site and can be verified through records, observations and employee interviews.

If an enterprise only temporarily fills in the form after the customer notifies the audit, there will often be inconsistencies between the writing of the system and scheduling, payroll, agency management, on-site operations, or employee cognition. Even if the documentation is complete, there may still be repeated deficiencies due to unaddressed root causes, inconsistent cross-factory standards, or unverified corrective actions.

Startrust assists companies to take inventory of the five major aspects of labor, health and safety, environment, ethics and management systems in accordance with the current RBA Code of Conduct 8.0, establish a gap list from self-assessment questionnaires, document inspections, on-site inspections and simulated interviews, and then design root causes, corrective prevention, evidence and management review processes to support customer requirements and VAP audit preparations.

Compare RBA Code 8.0 with applicable enterprise regulations and customer requirements
Inventory the consistency of policies, procedures, records, on-site and employee perceptions
Review hours and wages, recruitment fees, freely chosen employment and grievance risks
Strengthen occupational safety, environment, ethics and supplier responsibility management
Identify high risks and systemic gaps through simulated audits
Establish root cause analysis, correction prevention and effectiveness confirmation

Reservation consultation

Why do companies need to introduce RBA management?

International customers include RBA in supplier requirements

The RBA guidelines originate from the electronics industry supply chain and are currently used by a variety of industries. Customers may require suppliers to sign a commitment, complete a self-assessment questionnaire, provide evidence, accept customer audits or participate in VAP.

Labor and occupational safety issues often involve high operational risks

Forced labor, child labor, excessive working hours, insufficient wages, discrimination, harassment, major occupational accidents and hazard exposure may have a serious impact on employees, and may also affect customer relationships, orders, recruitment and operational continuity.

On-site practice is more critical than institutional documents

The audit will review documents, records, on-site and employee interviews for consistency. Even if the policy is well written, gaps will still arise if scheduling, payroll, fire protection, chemicals, or grievance procedures are not implemented.

Missing needs to deal with the root cause instead of just filling in the file

Working hours excess may arise from production capacity, orders, work shortages or scheduling systems; recruitment fees may involve overseas intermediaries and cross-border processes. Just filling out a form cannot prevent recurrence, and companies need to process it across human resources, production, purchasing and management levels.

Management system can reduce the heavy work of multiple audits

Establishing common policies, risk assessments, responsibilities, training, monitoring, grievances, internal audits and management reviews can help companies respond to RBA, customer codes of conduct and other social responsibility requirements simultaneously.

What is RBA Code of Conduct 8.0?

The RBA Code of Conduct is a set of social, environmental and ethical industry standards. Version 8.0 will take effect from January 1, 2024. The official reference document is in English and multi-lingual translation is provided for assistance.

The RBA Code doesn’t just apply to RBA members

RBA members have their formal commitments and responsibilities; non-member companies may also be required to manage in accordance with RBA guidelines due to customer contracts or supply chain policies. Enterprises should confirm the source of requirements, applicable sites, audit types and customer expectations.

RBA Code is not equal to the list of local regulations

Enterprises need to comply with applicable laws and customer contracts where they operate, and handle relevant management requirements in accordance with RBA guidelines. When the requirements are different, the legal and responsible departments should confirm the applicable and higher protection methods, and you cannot ignore the laws on your own.

Versions will be reviewed regularly

The RBA normally reviews and updates its code of conduct every three years. Enterprises should establish a version tracking and gap update mechanism and should not continue to use old versions of self-evaluation forms or customer teaching materials for a long time.

What are the five major aspects of RBA?

A. Labor

Covers freely chosen employment, youth labor, working hours, wages and benefits, humane treatment, non-discrimination and non-harassment, freedom of association, etc. Companies need to pay special attention to recruitment agencies, employee IDs, fees, contract language, overtime voluntariness and salary calculations.

B. Health and Safety

Covers occupational safety, emergency preparedness, occupational injuries and diseases, industrial hygiene, physical work, machinery protection, hygienic food and accommodation, and health and safety communication. On-site equipment, fire protection, accommodation and hazard controls need to be consistent with risk assessment and training.

C. Environment

Covers environmental permitting and reporting, pollution prevention and resource conservation, hazardous substances, solid waste, air emissions, material restrictions, water resources and energy and greenhouse gases. Enterprises need to have evidence of licensing, monitoring, operations and abnormal response.

D. Morality

Covers business integrity, improper interests, information disclosure, intellectual property, fair dealing and advertising competition, identity protection and non-retaliation, responsible mining, privacy, etc. The system needs to link investigation, reporting, conflicts of interest and third-party management.

E. Management System

Covers corporate commitments, management responsibilities, regulations and customer requirements, risk assessments, improvement goals, training, communication, employee feedback and grievances, audit evaluations, corrective actions, documentation and supplier responsibilities. This is the common skeleton that allows the first four aspects to continue to operate.

What are the differences between RBA self-assessment, customer audit and VAP?

###Self-evaluation questionnaire

Enterprises can fill out self-assessments according to customer or RBA platform requirements to identify policies, management and on-site risks. The results of self-assessment should be supported by real data, not the more boxes the better.

Customer or second party audit

Clients may use their own audit procedures or use RBA as a reference for auditing. The scope, scoring and subsequent requirements are determined by the client’s plan.

VAP Audit

The Validated Assessment Program is RBA’s standardized on-site audit program, which is executed by audit resources arranged through an approved process, using relevant operation manuals, standard explanations and quality management mechanisms.

VAP is not a permanent “RBA certification”

VAP results reflect the compliance status of the specific audited site, scope and period, and may require corrective actions and closure reviews. Companies should not describe audit reports as a permanent guarantee for all locations, products, or future periods.

How do audits usually obtain evidence?

Documents and Records

Includes policies, procedures, licensing, risk assessments, staff rosters, working hours, wages, contracts, training, monitoring, incidents, grievances, investigations and improvements.

On-site observation

Including production, warehousing, chemicals, waste, fire protection, machinery protection, personal protective equipment, restaurants, dormitories and emergency facilities.

Management interviews

Confirm that the responsible person understands the system, risks, critical deficiencies, resources, goals and management review, rather than just reciting the policy.

Employee Interviews

Understand actual recruitment, working hours, wages, benefits, grievances, occupational safety, training and whether there is retaliation. Businesses should not teach employees to memorize answers or interfere with interviews.

Data cross comparison

Audits may compare working hours with access control, output, wages, leave requests, outsourced personnel and other records to identify whether documents are consistent with actual operations.

Which companies are suitable for priority preparation?

Electronics, semiconductors, information communications and their multi-layer supply chains
Automotive, aerospace, machinery, battery and industrial manufacturing suppliers
Enterprises that receive RBA self-assessment, audit or VAP requirements from customers
Enterprises that use foreign migrant workers, agencies, dispatchers, interns or a large number of contractors
Factories with high overtime, fluctuating peak seasons, and complex shift or piece-rate systems
Locations with chemicals, machinery, high temperature, high pressure or other major occupational safety risks
Enterprises with multiple factories in the group need to establish common responsible business standards
Enterprises that have experienced customer audit deficiencies and wish to address the root cause and prevent recurrence

What information do I need to prepare?

Organization, Staff and Recruitment

Including organizational chart, employee and non-employee labor roster, nationality, age, contract, agency, recruitment fees, certificates and separation information.

Working hours, wages and benefits

Including punch-in, shift schedule, overtime application, salary calculation, statutory deductions, leave, benefits and sampling period data. It is necessary to be able to cross-reference with the same employee and the same period.

Health Safety and Site

Includes risk assessments, permitting, inspections, incidents, health checks, operating environment monitoring, firefighting, drills, chemicals and equipment maintenance.

Environment and Licensing

Including environmental permits, declarations, emission monitoring, waste, chemicals, water, energy, greenhouse gases, emergency response and abnormal records.

Ethics and Complaints

Including anti-corruption, conflicts of interest, whistleblowing, privacy, information security, responsible minerals, investigations, confidentiality, non-retaliation and redress records.

Management system

Includes policies, responsibilities, regulatory checklists, risk assessments, objectives, training, communications, internal audits, management reviews, corrective actions and supplier management.

Common RBA import problems in enterprises

Only centrally fill in the documents before the audit

The records lack long-term operation, and the site and employees do not know the system, which can easily expose inconsistencies during sampling and interviews.

The system completely copies the model

The procedures did not reflect the company’s actual shift schedules, recruitment, chemicals, dormitories, and management responsibilities, and the documents appeared to be complete but were unenforceable.

Working hours are only the responsibility of the Human Resources Department

The root causes of working hours may come from orders, production capacity, shortages, equipment or customer changes, which need to be dealt with by business, production, planning, purchasing and management levels.

Ignore dispatch, contracting and foreign migrant workers

Only checking regular employees without understanding agency fees, contracts, working hours, wages and grievances may leave high-severity risks.

On-site measures are inconsistent with risk assessment

The risk assessment lists hazards, but the site lacks engineering controls, signage, protective gear, training or regular inspections.

The grievance mechanism is only mailbox

The mechanism cannot operate effectively if employees are unaware of the channels, fear retaliation, cannot remain anonymous, or cases are not investigated, responded to, remedied, and trended.

Corrective action only addresses the surface

If you change a sign, make up for a training session or refill a form without revising the system, responsibilities, resources and monitoring, the deficiencies will easily recur.

Treat simulated audits as result guarantees

Simulation audits can only help identify gaps based on sampling time points. Formal audits are still determined by the designated plan based on current rules, sampling and on-site evidence.

How does Startrust help enterprises introduce RBA?

1. Requirements, scope and version confirmation

Confirm the customer, member, platform or VAP requirements, and define the assessed locations, employee scope, timeline and applicable RBA Code version.

2. Gap analysis between documents and regulations

Inventory policies, procedures, permits, records, and applicable regulations against the five major aspects to identify high risks and missing evidence.

3. On-site inspection and practical interviews

Inspect production, warehousing, chemicals, fire protection, dormitories and other sites, and interview responsible departments to understand the actual operation of the system.

4. Special inspection of working hours, wages and recruitment

Compare working hours, wages, contracts, agencies, fees, certificates and overtime voluntariness on a sample basis to find out the root causes of data and processes.

5. Self-assessment and mock audit

Conduct document, on-site, management interviews and employee interview simulations based on the assessment situation, and establish priorities for gaps, evidence and severity.

6. Root cause and corrective and preventive measures

Assist enterprises to use appropriate methods to analyze people, equipment, systems, production capacity and management reasons, and set responsibilities, deadlines, evidence and preventive measures for recurrence.

7. Validity confirmation and management review

Through record sampling, on-site review, employee feedback and KPI, it is confirmed that improvement is not just about completing documents and reporting remaining risks to management.

8. Capability transfer and supply chain extension

Train internal auditors and responsible departments, establish annual self-evaluation, version updates and supplier requirements, and gradually reduce external dependence.

Coaching content and deliverables

The actual delivery project is confirmed based on points, employees, customer requirements, audit type and current status. Common results include:

Gap analysis of five major aspects of RBA Code 8.0
Applicable regulations, customer requirements and responsible department matrix
Suggestions for improving policies, procedures, forms and necessary records
Sampling inspection of working hours, wages, benefits and leave
Risk analysis of foreign migrant workers, agency, dispatch and recruitment costs
On-site inspection records of occupational safety, fire protection, chemicals, dormitories and environment
Self-assessment questionnaire evidence and explanation script
Simulated audit of documents, site, management and employee interviews
Gap list, risk prioritization and improvement roadmap
Root cause analysis, corrective and preventive measures and liability period
Validity confirmation, case closing evidence and management review data
Recommendations on grievance, non-retaliation, investigation and remediation processes
Internal audit procedures, checklists and auditor training
Supplier RBA requirements, evaluation and improvement mechanism

This service provides system establishment, gap analysis and audit preparation. Formal VAP, customer audit, defect determination, scoring and any recognition results are determined by the designated audit plan or the customer in accordance with the current rules.

What can companies get after importing?

Documents, on-site and employee perceptions are more consistent

The system does not only exist in documents, but must be understood by responsible persons and employees and implemented in daily operations.

High-risk issues are identified in advance

Working hours, recruitment fees, occupational safety, chemicals, grievances and major incidents can enter management decisions before formal audits.

Missing improvement changed from patching to preventing recurrence

Each defect has a root cause, action, responsibility, deadline, evidence and validity confirmation to reduce recurrence.

The RBA management system can support customer codes of conduct, EcoVadis, sustainable procurement and human rights due diligence, reducing duplication of construction.

The internal team has the capability of continuous self-evaluation

Companies can regularly perform self-assessments, on-site inspections and management reviews without having to wait for customer notification each time.

Why choose Startrust?

Check the system, data and site at the same time

We not only provide a comparison of provisions, but also pay attention to possible inconsistencies in working hours and wages sampling, on-site risks and interviews.

Arrange improvements based on risk severity

Prioritize issues that may harm employees, violate regulations, or create significant customer risks, and then complete systems and evidence enhancements.

Pay attention to root causes and effectiveness

Assist companies to analyze the reasons from production capacity, orders, manpower, equipment, procedures and supervision to avoid closing the case with just supplementary documents.

Tandem supply chain responsibility requirements

Can be integrated with ISO 20400, Responsible Minerals, EcoVadis and supplier management systems to establish consistent supplier requirements and improvement processes.

Establish a method for enterprises to maintain their own operations

Keep internal teams updated through checklists, sampling methods, auditor training and management reviews.

FAQ

Is RBA Code only applicable to the electronics industry?

The RBA originated from the electronics industry, but officials say its guidelines are also used by other industries. Applicability should still be confirmed based on customer contracts, group policies, member responsibilities and supply chain requirements.

Is importing RBA equivalent to obtaining RBA certification?

no. RBA Code is a code of conduct and VAP is a standardized audit plan. Formal audit results are site-specific, scope- and period-specific and should not be described as permanent certification for all products and future periods.

Will the RBA requirements be completed after filling out the SAQ?

uncertain. The self-assessment questionnaire is used to identify risks and management status. Clients may also require evidence, improvements, remote audits, on-site audits or VAP. Companies should also address significant gaps identified in self-assessments.

Can a simulated audit guarantee the passing of a formal audit?

cannot. Simulation audits can identify gaps based on current sampling and observation. The official results still depend on the designated plan, audit team, sampling, on-site and current rules.

What should I do if the RBA working hour requirements are different from local regulations?

Companies need to comply with applicable regulations and confirm RBA and customer contract requirements. Legal, human resources and management should evaluate stricter requirements and actual improvement paths, and should not ignore laws or hide records on their own.

Why are the recruitment costs of foreign migrant workers high risk?

Overpaying labor can create debt bondage and forced labor risks. Enterprises need to understand the cross-border intermediation, fees, contracts, documents and compensation processes, and cannot just check the human resources documents within the factory.

Can you provide standard answers before employee interviews?

Employees should not be taught to recite or interfere with interviews. Enterprises should let employees understand their rights, risks and appeal channels through real training, effective communication and system implementation.

What evidence should be prepared for missing improvements?

Typically includes immediate correction, root cause, systemic actions, responsibilities, completion date and confirmation of effectiveness. Photos or modified documents may only be part of the evidence, and actual operating records still need to be provided depending on the nature of the lack.

If you already have ISO 14001 or ISO 45001, do you still need to prepare for RBA?

The existing management system can provide the basis for environmental, occupational safety and common management processes, but the RBA also covers labor, hours and wages, recruitment, ethics, grievances and specific supply chain requirements, which requires further gap analysis.

If the company has received RBA self-assessment or audit requirements, Startrust can help identify high-risk gaps first and arrange the order for system, on-site and evidence improvement.