What ESG procedures should your business have?

What does an ESG committee do?

As ESG – environmental, social, and governance – criteria become more important for regulators, investors, and customers, many managers are facing an ESG imperative – to measure ESG risks and track progress. ESG may seem like a fundamental shift in business practices, and in some cases, it may be. Fortunately, however, ESG can be integrated into many familiar business processes, such as the annual cycle of financial reporting. ESG can then be matured through annual iterations to achieve more ambitious targets.

This article outlines the key procedures that businesses need to respond to the ESG imperative, addressing stakeholder needs while creating value:

  1. The materiality assessment
  2. Goal setting and gap analysis
  3. Data collection
  4. Reporting
  5. Assurance

1. Start with a materiality assessment

The foundation of any ESG strategy is a materiality assessment. This tool prioritizes the most important environmental, social and governance issues for the business and its stakeholders. Materiality assessments are conducted by surveying relevant stakeholders, such as management, employees, customers, and the public. This exercise focuses ESG efforts on the most relevant issues. For example, water usage is highly material for a textile manufacturer but not for an IT consultancy.

While most ESG procedures are annual, materiality assessments can be conducted every few years and serve as the basis for the ESG program.

2. Set goals regularly and assess what’s needed to achieve them

ESG is grounded in performance assessment. That is what sets ESG apart from traditional CSR. ESG strategy requires goal setting and gap analysis between the current and goal states. Setting goals and assessing gaps can be iterative because the goals must be reasonable given the current state and vice versa.

To set goals, managers can look to science-based targets for environmental goals, and industry peers or gold standards for social and governance goals. These goals are then translated into initiatives. For example, if the goal is to achieve 75% renewable energy by 2025, initiatives may be:

  1. Expand power purchase agreements with renewable providers
  2. Reduce overall energy use through an office retrofit

This process should be repeated annually as the firm progresses toward its goals.

3. Establish interdisciplinary data collection channels

Robust data collection is essential for ESG reporting and performance assessment. As such, managers should identify data collection channels for material issues. For example, engaging a service provider to calculate company emissions (environmental), or HR reports on diversity metrics (social/governance).

Data collection will be interdisciplinary with inputs from multiple departments. Therefore, senior leadership buy-in and endorsement are essential to ensure collaboration.

Finally, ESG data collection should be formalized. Reporting should be done annually to track progress over time. Leveraging technology can streamline data collection and reduce the overhead of each reporting cycle.

4. Report ESG progress & risk management with a standard

Material issues, goals, initiatives, and analyses should be consolidated into an annual ESG or integrated report. ESG information is best reported in alignment with a recognized standard. Using a standard improves the credibility, comprehensiveness, and comparability of reports. The most common reporting standards are GRI and SASB. It is important to choose a reporting standard that fits the audience. For example, reporting to investors may differ from that to consumers.

Reports should follow the same standard year over year to enable comparison. Reports should then be made publicly available on the company website. Read more about ESG reporting best practices here.

5. Consider an audit of ESG reporting

Finally, managers may want to consider audit procedures for ESG reporting. While rarely required, audits support the accuracy and completeness of the report. The audit can be conducted via an internal review with the relevant subject-matter experts and senior leadership. The company can also use a third-party auditor to assure the report, if feasible.

Not only does this reduce the risk of liability, but it also provides confidence for the audience that senior leadership takes ESG seriously. Companies should describe the internal review or audit in the ESG report to build credibility and legitimacy.

VinciWorks’ ESG training suite

ESG awareness training

A core part of any ESG initiative is employee training. Training all staff transforms ESG from an isolated activity undertaken by a small group of staff into a process that is deeply embedded into an organisation’s culture. Further, ESG rating agencies and reporting frameworks use training as a measure of ESG effectiveness.

VinciWorks’ ESG awareness training is designed to give your employees an overview of what ESG means, why it’s important, and what you can do to help your company achieve its ESG goals. While our micro-course gives an introduction to ESG, our in-depth course goes into further detail about each employee’s personal role and responsibilities in their company’s ESG initiatives.

Want to know more about how we can help you with your ESG programme? Complete the short form below and we’ll be in touch.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”

Picture of James

James

VinciWorks CEO, VInciWorks

Spending time looking for your parcel around the neighbourhood is a thing of the past. That’s a promise.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.