18 (b) Will vary in complexity with the size of the business enterprise, the risk of severe human rights impacts, and the nature and context of its operations; (c) Should be ongoing, recognizing that the human rights risks may change over time as the business enterprise’s operations and operating context evolve. Commentary This Principle defines the parameters for human rights due diligence, while Principles 18 through 21 elaborate its essential components. Human rights risks are understood to be the business enterprise’s potential adverse human rights impacts. Potential impacts should be addressed through prevention or mitigation, while actual impacts – those that have already occurred – should be a subject for remediation (Principle 22). Human rights due diligence can be included within broader enterprise riskmanagement systems, provided that it goes beyond simply identifying and managing material risks to the company itself, to include risks to rights-holders. Human rights due diligence should be initiated as early as possible in the development of a new activity or relationship, given that human rights risks can be increased or mitigated already at the stage of structuring contracts or other agreements, and may be inherited through mergers or acquisitions. Where business enterprises have large numbers of entities in their value chains it may be unreasonably difficult to conduct due diligence for adverse human rights impacts across them all. If so, business enterprises should identify general areas where the risk of adverse human rights impacts is most significant, whether due to certain suppliers’ or clients’ operating context, the particular operations, products or services involved, or other relevant considerations, and prioritize these for human rights due diligence. Questions of complicity may arise when a business enterprise contributes to, or is seen as contributing to, adverse human rights impacts caused by other parties. Complicity has both non-legal and legal meanings. As a nonlegal matter, business enterprises may be perceived as being “complicit” in the acts of another party where, for example, they are seen to benefit from an abuse committed by that party.