Disclosure focus
This disclosure asks an organisation to explain whether it has formal policies that set expectations for business conduct, and how those policies are used in practice. The focus is not just on saying a policy exists, but on showing what it covers, who it applies to, and whether it is embedded in day-to-day decision-making rather than sitting only on paper.
In practical terms, the organisation should think about coverage across the whole business, not only a few flagship sites or headquarters functions. A useful report will make clear whether the policy applies group-wide, to specific entities, operations or activities, and whether there are any important gaps, exceptions or differences in implementation across locations or parts of the business.
This LRA educational guidance supports disclosure preparation. For the exact requirements, always refer to the official EFRAG source.
Before you start
A quick mental checklist before you prepare this disclosure — tick each as you settle it.
Preparation
Key datapoints to prepare
＋ Show G1-1 sub-elements (LRA working checklist)
State which parts of the business and value chain are covered.
Set out the aims the policy is meant to achieve.
Give the policy its formal title.
Describe the boundaries and extent of the policy’s reach.
Indicate whether it is aligned with UN principles.
Indicate whether there is an anti-bribery and corruption policy.
Indicate whether the policy covers legal compliance.
Indicate whether there is a whistleblowing policy.
Show whether the business is exposed to public-sector authorities.
Identify any higher-risk countries in the business footprint.
Identify roles or functions with higher exposure to corruption risk.
How to prepare it
1Start by fixing the reporting boundary for this policy disclosure. Decide which business units, sites and activities are in scope, and make that boundary consistent across the narrative and any figures you report.
2Set out the policy details in plain business language. Capture the policy title, what it is meant to achieve, and whether it covers anti-corruption and whistleblowing matters, including any stated links to UN principles or legal coverage where relevant.
3Map the policy to the parts of the business it actually reaches. Record whether it applies to operations only, the wider supply or value chain, or both, and identify the roles, functions and locations that fall under it.
4Gather the source material that supports each entry before drafting. Use the approved policy text, internal registers, training or compliance records, and any location or role lists needed to confirm the countries or public-sector exposure you describe.
5Prepare the final disclosure in the format needed for each datapoint. Where the item asks for a yes/no response, make sure the answer matches the underlying evidence; where it asks for text, write a concise explanation that reflects the documented scope, coverage and objectives.
6Before sign-off, check the draft against the official source and note any exclusions, assumptions or changes in wording. Confirm that the reported scope, coverage and supporting statements are internally consistent and that nothing has been added, omitted or broadened beyond the source material.
Request the data
Request the business conduct policy pack and coverage details
Translate the disclosure into an internal business question — then adapt it to your organisation's own language.
Which policies and related coverage details do we need to describe our business conduct controls for the reporting period?
Use your organisation’s own policy names, control labels and team names first, then map them to the reporting disclosure. Keep the ask in everyday internal language rather than framework wording, and check the source documents before sign-off.
Weak request
Please provide the ESRS G1:G1-1 policy disclosures, including the policy name, scope, coverage, objectives, anti-corruption alignment, whistleblower coverage, high-risk functions, high-risk countries, and exposure to public authorities.
Why it fails: This uses framework language that many internal owners will not use day to day, so it is harder to route and answer quickly. It also bundles several concepts without telling the owner which documents to pull, where to look, or how to describe the business areas in their own terms.
Better request
Please send the latest business conduct policy documents and a short summary covering: the document names, what each one is for, which parts of the business or group they apply to, whether we have an anti-bribery / corruption policy, whether we have a speak-up policy and who it covers, which roles or locations carry higher exposure, which markets we treat as higher risk, and where we deal with public bodies or officials. Use our internal terms first, then we will map them to the reporting disclosure. Please check the source documents before sign-off.
Industry examples
Draft your disclosure
Notes that turn data into a disclosure
LRA training templates — adapt them to your organisation, and check the official source before sign-off.
Method note
This disclosure can explain which policies were reviewed, how the organisation defined their scope and coverage, and what counts as a high-risk role, location or external exposure for the purposes of the data set.
Context note
Taken together, these data points show whether the organisation has formal controls in place, how far they extend across operations and the value chain, and where the main corruption-related risk areas are concentrated.
Fluctuation statement
If the figures or coverage changed from the prior period, the reporter can attribute that to policy updates, a broader or narrower scope, changes in the list of higher-risk roles or countries, or a revised view of exposure to public authorities.
Content index entry
G1-1 Policies (Business Conduct) — [location / page] / [notes]
Download Centre
Preparation tools & forms
Professional preparation tools for G1-1 — free with an LRA Community membership. Register once (it's free) and every download unlocks, together with the Disclosure Library, templates and the LRA AI-assistant.
Free · Community members
Assurance readiness
For each claim, check the evidence
Evidence pack to prepare
Common reporting gaps
Figures are stated without the supporting narrative, or narrative without figures.Scope is inconsistent between the text and the numbers.The reporting boundary is left undefined.Material changes since the previous period are not disclosed.Estimates and measured values are not distinguished.Source records for the figures are not identified.
Common gaps
Mistakes to avoid when collecting the data
Wrong owner, wrong language
The request goes to a team that does not hold the policy record, or it is framed in framework terms instead of the organisation’s own policy names and business wording.
Scope left vague
The collector never pins down which policy set, business area, or entity boundary is in view, so different people send different versions of the same item.
Coverage basis mixed up
Operational sites and value-chain coverage are pulled into one count or description even though they need to stay separate in the source data.
Timing basis not fixed
One person uses the current live policy set while another uses the year-end snapshot, so the data no longer matches the same reporting period.
Counting rules drift
Yes/no fields, text fields, and any numeric coverage inputs are gathered with different counting logic, which makes the dataset internally inconsistent.
Source labels get stripped
The original file names, system tags, or document titles are lost during collection, so the team cannot trace each answer back to the source record.
Separate populations merged
Policies for different risk areas or different operating contexts are combined into one response, which hides where the organisation actually has distinct coverage.
Evidence details missing
The collector saves the answer but not the supporting metadata such as version, date, owner, or location, so later review cannot verify what was used.
No sign-off trail
The final dataset is passed on without a clear reviewer or approver record, leaving no audit trail for who checked the source and when.
Where judgement is often needed
How to treat a business bought or sold during the year
Decide whether the policy list and coverage figures reflect the group as it stood at the reporting date or include a newly acquired or recently disposed business for part of the year, and explain the cut-off used.
Where local wording differs from group wording
If country teams use different labels or legal terms for the same conduct rule, map them to one group description and note any places where the local version is narrower or broader.
Whether a borderline team counts as in scope
Set out the rule used for staff or contractors who sit close to the boundary, such as shared-service teams, temporary workers or outsourced roles, and say how you decided they belong in or out.
Choosing the basis for the coverage figure
State whether the count is taken from headcount, full-time equivalent, contract population or another internal basis, and keep the same basis across the policy items unless you explain a change.
Using a snapshot date or an average period view
Explain whether the policy coverage and related yes/no checks are assessed at period end, over the year, or on another timing basis, and disclose that basis clearly.
Mixing direct records with estimates
If some policy coverage is taken from system records and some from management judgement or sampling, identify which parts are measured and which are estimated, with the method used for the estimate.
Rounding the coverage numbers
Apply one rounding rule consistently across the policy data points, and if rounding changes the displayed figure, note the rule so readers can reconcile the published numbers.
Protecting sensitive location or role details
When naming high-risk countries, sensitive functions or public-sector touchpoints could expose confidential information, group the data at a higher level and say that the detail has been aggregated for privacy or security reasons.
Examples
Illustrative examples
Synthetic, written by LRA — not from a company report, not text from any standard.
Illustrative (synthetic) example — Consumer goods manufacturing
We describe a group-wide anti-bribery and integrity policy that applies to our own sites and the parts of the supply chain where we have direct oversight, and it is aimed at preventing misconduct and supporting ethical conduct. The policy is built to align with the recognised sustainability principles, and we also maintain a separate speaking-up policy that covers employees and contractors and is intended to meet the legal protections available in the jurisdictions where we operate. - The integrity policy covers 100% of our owned operations and 85% of tier-1 suppliers by spend; it is active across all business units. - We identify 42 roles as more exposed to bribery risk, mainly procurement, sales, customs, logistics and government-facing managers; 18 of those roles sit in three higher-risk countries, and 12 roles regularly deal with public bodies.
Synthetic example for practitioner review only. It shows how to narrate the policy name, where it applies, what it is meant to achieve, whether the anti-corruption and speaking-up arrangements exist, whether the anti-corruption policy is aligned to the UN Compact, and which roles, countries and public-authority touchpoints are treated as higher risk.
Illustrative (synthetic) example — Transport and logistics
Our compliance framework includes a gifts, hospitality and anti-corruption policy for the company and the controlled entities we manage, with the aim of reducing bribery risk and reinforcing fair dealing. We also run a confidential reporting policy that is designed to operate in line with local legal protections, and the anti-corruption policy is mapped to the recognised sustainability principles. - The policy reaches 100% of our operating sites and 70% of our key intermediaries by contract coverage; it is intended for all staff and relevant third parties. - We classify 27 positions as higher exposure, including customs brokers, fleet managers, tendering staff and country leads; 9 of those positions are in two higher-risk countries, and 7 positions involve routine contact with regulators or other public bodies.
Synthetic example for practitioner review only. It demonstrates a different sector and wording while still covering the policy title, who and what it applies to, the intended purpose, the existence of anti-corruption and whistleblowing arrangements, the UN alignment, and the main higher-risk roles, countries and public-authority interfaces.
How companies report G1-1 in practice
Real reports where this topic is disclosed. These are report practice, not exact disclosure templates to copy.
Grifols, S.A.
Pharmaceuticals / Biotech / Life Sciences · Spain · 2024
Grifols, S.A.’s 2024 Integrated and Sustainability Annual Report includes narrative evidence on compliance with its Anti-Corruption Policy, highlighting review processes tailored to different types of business conduct on page 194 and guidelines for employee interactions on page 197. The report also references training related to anti-corruption policies on page 193 and mentions risk assessments connected to corruption on page 189, though the numeric disclosure there is unclear. However, several expected narrative items related to anti-corruption are not found elsewhere in the report.
Assicurazioni Generali S.p.A.
Banks / Diverse Financials / Insurance · Italy · 2024
Assicurazioni Generali S.p.A.’s 2024 Annual Integrated Report includes narrative coverage of its Anti-Bribery and Anti-Corruption (ABC) policy, described as part of its broader business conduct policies and supported by operational guidelines that define approaches and processes (p.174). The report also references analyses of business conduct impacts and risks, including value chain exposure, though these are not clearly quantified (p.102). However, several expected narrative disclosures are missing or unclear, with no clear numeric values or detailed descriptions found beyond the policy references.
Fluidra, S.A.
Electrical Equipment and Machinery · Spain · 2025
Fluidra’s 2025 Integrated Annual Report includes a clear disclosure of its anti-corruption policy on page 238, indicating the company has established measures related to business conduct. Additionally, page 301 references business conduct policies and corporate culture, including policies managing sustainability issues in supply chain management, although these are not detailed clearly. However, the report lacks specific numeric data or comprehensive narrative disclosures on other aspects of business conduct policies, with several datapoints not found or unclear throughout the document.
✓ LRA AI Assistant · Human-in-the-loop
Ask Study Studio AI assistant about this disclosure
Get practical answers for your reporting context. Your first two answers are free — join LRA Community for free to continue without a limit.
TryHow do I prepare G1-1?What data do I need to collect?Where can I see a real-report example?What mistakes should I avoid?
2 free answers
Check your understanding
Scenarios to work through
A group finance team has one conduct policy for the parent company, but the overseas sales subsidiary uses a separate local code and the procurement team follows a third document. The reporting lead is deciding whether to describe one group-wide policy or several separate ones.
QShould the disclosure present a single policy set or explain the different documents and where each one applies?
Reveal model answer →Hide answer ↑The right approach is to describe the actual policy arrangement in plain terms: name the relevant document or documents, explain the parts of the business they cover, and make clear whether the same approach reaches the group, specific units, or only certain activities. If the organisation uses more than one document, the disclosure should not blur them into one. The description should also show what the policy is meant to achieve, so a reader can see the intended business conduct focus.
Why this matters · Be precise about the policy architecture, its reach, and its purpose rather than presenting a simplified version that hides how the organisation is actually governed.
A preparer has a draft anti-bribery policy, but it only mentions employees and says nothing about agents, distributors, or other third parties used in sales. The team is unsure whether that is enough for the business conduct note.
QCan the policy be described as covering the organisation’s conduct risks if it only speaks to staff and not to outside parties acting for it?
Reveal model answer →Hide answer ↑No. If the organisation relies on outside parties in the relevant activity, the disclosure should reflect whether the policy reaches those relationships as well as internal staff. The preparer should check whether the policy is intended to apply across the business and through the wider chain of dealings, and then describe that coverage accurately. If the policy is limited, that limitation should be clear rather than implied away.
Why this matters · Coverage should match the real footprint of the policy, including relevant external relationships where they matter to the conduct risk.
The compliance team has a whistleblowing procedure for employees in the UK, but contractors in another country use a separate hotline run by a local provider. The reporting lead is deciding how to answer the policy question for the year-end report.
QHow should the preparer decide whether to present this as one reporting channel or as multiple arrangements with different legal reach?
Reveal model answer →Hide answer ↑The preparer should map the arrangements as they actually operate and state whether the reporting route is available only to employees or also to other people connected with the business, such as contractors. If different channels exist in different places, the disclosure should explain that split and avoid suggesting one uniform system if that is not true. The key point is to show the scope of the protection and the practical reach of the reporting route, not just its existence.
Why this matters · Describe who can use the reporting route and where it applies, especially where the set-up differs by country or worker group.
A multinational has identified customs brokers, public-sector sales contacts, and permit applications as the areas where conduct risk is highest. The draft note lists these activities, but it does not say which countries are most exposed or whether dealings with public bodies are part of the picture.
QWhat should the preparer do when the risk profile is driven by certain roles, locations, and contact with public bodies?
Reveal model answer →Hide answer ↑The disclosure should identify the main roles or functions that create the highest exposure, the countries or regions where the risk is greatest, and whether interaction with public authorities is part of that exposure. The aim is to give a reader a clear picture of where the organisation sees the strongest conduct risk, rather than leaving those drivers implicit. If the organisation has no such exposure in a particular area, that should be reflected honestly in the description.
Why this matters · When risk is concentrated, spell out the roles, places, and public-sector touchpoints that drive it.
Framework references
Related framework references
How this disclosure maps across the major reporting frameworks.
Primary
Related & explore
FAQ
Questions this page answers
For G1-1, what data points do I need to gather before I can draft the disclosure?+−
The page says to prepare the policy title, policy coverage, coverage share, policy aims, anti-bribery policy, UN alignment, speak-up policy, whistleblower law coverage, sensitive roles, risk countries and public-sector exposure. Use that list as your starting checklist before drafting.
How do I use the step-by-step 'how to prepare' section for G1-1?+−
Use it as a practical workflow to move from identifying the relevant policy and scope to collecting the supporting data and evidence. It is designed to help you prepare the disclosure rather than interpret the underlying standard.
What should I include in the scope and coverage for a G1-1 business conduct policy disclosure?+−
The page points you to policy coverage and coverage share, so you should define what the policy applies to and how much of the business it covers. Keep the scope consistent with the rest of the datapoints you collect for the disclosure.
Who should own the G1-1 data collection in practice: ESG, HR, legal or the policy owner?+−
The page does not assign a single owner, so you need to decide ownership internally based on who holds the policy, the coverage data and the evidence. A practical approach is to name one accountable lead and then map supporting inputs from the relevant functions.
What evidence pack do I need to make G1-1 assurance-ready?+−
The page says there is an evidence pack with five items for assurance readiness. Use that pack to support the claims you make and to show where each datapoint came from.
What are the six assurance claims I need to verify for G1-1?+−
The page says there are six assurance claims to verify, each linked to a claim, risk and evidence. Use those claims to test whether the disclosure is supported by the underlying records before you finalise it.
What are the common reporting gaps or mistakes to avoid in a G1-1 disclosure?+−
The page includes a list of common reporting gaps and mistakes, so use that as a pre-submission check. It is there to help you spot missing scope, weak evidence or inconsistent wording before the draft goes out.
How do I turn the G1-1 data into a draft disclosure?+−
The page has a draft-output section with visualisation ideas, narrative starters and a content-index line. Use those to turn the collected datapoints into a readable draft rather than starting from a blank page.
What should I use the G1-1 workbook and printable Library Card for?+−
The Download Centre includes a Prep & Assurance workbook in .xlsx format and a printable Library Card in .pdf format. Use the workbook to organise the preparation and evidence, and the card as a quick reference while drafting or reviewing.
Does the G1-1 page give real company examples I can compare against?+−
Yes. It includes a 'From company reports' table that links to real published reports at the pages where the topic is disclosed, which you can use as reference points when shaping your own draft.
What kind of illustrative example does the G1-1 page provide?+−
The page includes synthetic illustrative example disclosures, including a quantitative table. Treat these as made-up examples for learning how the disclosure might look, not as reporting requirements.
More questions this page can help with
G1-1 business conduct disclosure checklist: what should I collect before drafting?How do I scope policy coverage and coverage share for G1-1?What evidence should sit behind a G1-1 anti-bribery policy disclosure?How do I document UN alignment in a G1-1 disclosure using the workbook?What is the best way to assign ownership for G1-1 policy data and evidence?How do I use the G1-1 narrative starters to write the disclosure?What are the most common mistakes in G1-1 business conduct reporting?How do I use the synthetic example table in the G1-1 page?What should an assurance reviewer look for in the G1-1 evidence pack?Where can I find real company report examples for G1-1 business conduct?How do I capture whistleblower law coverage and speak-up policy details for G1-1?What should go into the content-index line for a G1-1 draft output?
How this library is built
312 published reports indexed
63171 pages with page-level citations
247 practitioner guides
Free · LRA Community
Get your G1-1 tools — free
Your preparation tools are free for LRA Community members and students. Register once (it's free) and your download starts right away — plus the Disclosure Library, templates and the LRA AI-assistant.
✓
You're in — your download is starting
Your file is downloading now. Your Community Cabinet — with the Disclosure Library, templates and the LRA AI-assistant — is ready too.
Open your Cabinet →