What counts as a conflict-affected and high-risk area under OECD guidance

Compliance teams ask this question every time a new sourcing region shows up on a tier-1's bill of materials: does this count as a CAHRA, and what are we supposed to do about it. The OECD Due Diligence Guidance for Responsible Supply Chains of Minerals from Conflict-Affected and High-Risk Areas is the source document most audit programs cite, but it's worth reading what it says before you build a policy on top of it.

The OECD definition, in its own words

The guidance doesn't hand you a list of named countries or regions. It defines two conditions, and a sourcing area can trip either one.

Conflict-affected means the presence of armed conflict, whether declared war or lower-intensity, widespread violence involving organized groups. Think areas where state forces, militias, or armed non-state actors are actively fighting for territory or resources.

High-risk is broader and gets missed more often. The guidance describes it as areas with weak governance, security, or rule of law, including widespread human rights abuses, violations of national or international law, and systemic corruption in the mineral trade. A region doesn't need an active war to qualify. A breakdown in the institutions that would normally catch forced labor, environmental violations, or illegal extraction is enough.

Annex II of the guidance then lists the specific risk indicators companies are expected to screen against: serious abuses associated with extraction, processing, or transport (torture, forced labor, child labor, violations of indigenous rights), support for non-state armed groups or public/private security forces through payments or logistics, and bribery of officials to obscure the origin or taxation of minerals. None of those indicators require you to already know who the site is. They're about conduct and conditions in the region, which is exactly why a company can determine it's sourcing from a CAHRA before it has a single tier-2 name on file.

Why a definition isn't a coordinate list

This is where most compliance programs stall. Several organizations (the Responsible Minerals Initiative among them) publish a CAHRA list that's useful as a starting screen, but those lists work at the country or sub-national region level. They tell you "eastern DRC is a CAHRA." They don't tell you which of the dozens of informal smelters, mills, or trading points inside that region are the ones your tier-1's material is moving through.

That gap matters because the OECD guidance's own five-step framework assumes you can identify the actors in your supply chain, down to specific sites, rather than only the geography they operate in. Step 2 asks companies to identify and assess risk "in the supply chain": naming the processing sites between the mine and your tier-1, a finer grain than the region they sit in. A tier-1 supplier's self-reported list covers who they've disclosed a relationship with on paper. It says nothing about the sites that process material without a named contract, a customs declaration, or any paperwork trail at all, which is routine in regions where the formal and informal trade run side by side.

So the honest answer to "what counts as a CAHRA" has two parts. The OECD definition tells you whether a region is in scope. It doesn't tell you what's physically operating inside it. Closing that second gap usually means looking at the ground itself: a smelter or tannery that's never named in a supplier questionnaire still shows up as a facility with a roof, a stack, and an effluent pond. That's the premise behind a search for the processing sites a producing region has, independent of what any supplier has declared: run the region against high-resolution imagery and surface the candidate sites nobody put on a list, then work backward to figure out which ones touch your tier-1's material.

If your CAHRA screen keeps coming back with a country name and nothing underneath it, that's a sourcing-area gap, and it's the specific gap Supply Chain Mapping was built to close.