Disclosure focus
This disclosure asks an organisation to explain the actions it is taking, and the resources it is putting behind them, to address material impacts, risks and opportunities connected with affected communities. In practice, that means describing what is being done, how far those actions have progressed, and what support is being committed, rather than only stating broad intentions or policies.
The practical focus is on whether the response is real, targeted and sufficiently broad in scope. Reporters should make clear if actions cover the whole business, specific sites, projects or geographies, and whether resources are matched to where the impacts actually arise. The aim is to show how the organisation is responding in a way that is proportionate to the issue, not just highlighting a few flagship initiatives.
This LRA educational guidance supports disclosure preparation. For the exact requirements, always refer to the official EFRAG source.
Before you start
A quick mental checklist before you prepare this disclosure — tick each as you settle it.
Preparation
Key datapoints to prepare
＋ Show S4-3 sub-elements (LRA working checklist)
Put the measures you have put in place into practice.
Set out the steps used to protect personal data.
Set out the steps used to keep products safe.
Set out the steps used to market responsibly.
Describe the steps you have taken.
State what kind of impact it is, such as privacy, safety or misleading information.
Explain the trade-off involved, for example between promotion and protection.
List the key measures you use to track performance.
Say how often you review or monitor them.
Set out the indicators you use to judge performance.
State how many incidents occurred.
Describe how serious each incident was.
State what kind of incident it was, such as a privacy breach or a safety issue.
How to prepare it
1Set the reporting boundary first. Decide which products, services, channels and customer-facing activities sit inside the scope for this disclosure, then use that same scope consistently across the whole response.
2Translate the required topics into your own internal categories. Separate the actions already in place for product safety, data protection and responsible marketing, and distinguish them from the impact description, the actions taken in response, and any trade-off you had to manage.
3Gather the underlying records before drafting. Pull together incident logs, issue trackers, control reports, monitoring outputs, KPI dashboards and any other source material that supports the narrative and the figures.
4Compile the disclosure in the order the data needs it. Provide the action descriptions, then the impact type, response actions and trade-offs, followed by the KPIs, performance measures and how often they are checked; include the incident count, incident type and severity where relevant.
5Explain any gaps, exclusions or changes in method. If something is left out, treated differently or measured in a new way, note that clearly so the reader can understand what is included and how the numbers or narrative were built.
6Do a final source check against the official ESRS text. Confirm that each required item is covered, the wording still matches the underlying requirement in substance, and nothing material has been missed or added.
Request the data
Request the actions, controls and incident log from the relevant owners
Translate the disclosure into an internal business question — then adapt it to your organisation's own language.
What actions, controls, monitoring and incident details do we need to describe how the business manages customer-facing impacts and related risks in the reporting period?
Use your organisation’s own names first, then map them to the reporting categories. For example, ask for the product safety, privacy, content, customer trust, complaints, incident or control logs that your teams already use, rather than using framework labels in the request.
Weak request
Please provide the ESRS S4 actions and resources evidence for the disclosure, including the actions implemented, product safety measures, data protection measures, responsible marketing actions, impact type, actions taken, trade-offs, KPIs, performance indicators, monitoring frequency, number of incidents, type and severity.
Why it fails: This uses framework language that many teams do not use day to day, so the owner may not know which records to pull. It also bundles too many labels without saying which internal logs, systems or teams hold the evidence. That makes it harder to respond quickly and increases the risk of incomplete or inconsistent data.
Better request
Please send the latest logs, trackers or dashboards your team uses for product safety, privacy, content, customer trust and related incidents for [period]. Include the actions taken, controls in place, what you monitor, how often you review it, and any incidents with type and severity. If there were decisions where one priority had to be balanced against another, note that too. Use your own team wording first, and we will map it for the reporting pack.
Industry examples
Draft your disclosure
Notes that turn data into a disclosure
LRA training templates — adapt them to your organisation, and check the official source before sign-off.
Method note
Describe the basis used to group the data, including how issue categories, response actions, performance measures and incident seriousness were defined and counted.
Context note
Explain what the figures show in practice: the kinds of issues being managed, the actions taken to address them, the indicators used to track delivery, and the scale and seriousness of recorded incidents.
Fluctuation statement
If any figures moved materially, explain the operational reason for the change, such as a shift in the mix of issues, a change in monitoring approach, or a different level of response activity.
Content index entry
S4-3 Actions & Resources — [location / page] / [notes]
Download Centre
Preparation tools & forms
Professional preparation tools for S4-3 — free with an LRA Community membership. Register once (it's free) and every download unlocks, together with the Disclosure Library, templates and the LRA AI-assistant.
Free · Community members
Assurance readiness
For each claim, check the evidence
Evidence pack to prepare
Common reporting gaps
Figures are stated without the supporting narrative, or narrative without figures.Scope is inconsistent between the text and the numbers.The reporting boundary is left undefined.Material changes since the previous period are not disclosed.Estimates and measured values are not distinguished.Source records for the figures are not identified.
Common gaps
Mistakes to avoid when collecting the data
Wrong owner asked
The team chases a central reporting contact instead of the business owner who actually tracks the action, measure, or incident in day-to-day operations.
Framework terms used too early
People ask for answers in disclosure language rather than the organisation’s own labels, so the source team cannot map the request to its normal records.
Scope left vague
The request does not pin down which business line, product, channel, or customer group is in scope, so different teams pull different populations.
Timing basis not fixed
The data pull mixes calendar timing, reporting cut-off, and event date, which makes the figures impossible to compare cleanly.
Counting rules mixed together
One extract combines counts, percentages, and narrative logs without separating the basis for each field, so the final dataset cannot be reconciled.
Original source labels lost
The team strips out the names and codes used in the operational system, so later reviewers cannot trace each item back to its source record.
Separate populations merged
Cases that should stay apart, such as different issue types or different response groups, are rolled into one file and the distinctions disappear.
Evidence details not captured
The file is saved without the date, owner, version, or system reference for the underlying record, leaving no audit trail for review.
No sign-off trail kept
The draft data is circulated and edited informally, but nobody records who checked it, when it was approved, or which version was cleared.
Where judgement is often needed
What counts as an action already in place
Decide whether to include only measures that are live in the reporting period or also those approved but not yet rolled out, and explain the cut-off you used.
How to handle a business bought or sold mid-year
State whether you include measures, incidents and tracking data only for the time the unit was under your control, and say how you treated any partial-period figures.
Where local rules use different labels for the same issue
Map country-specific terms to one internal set of categories, then disclose the mapping so readers can see how like-for-like issues were grouped.
People close to the boundary of your scope
Explain the rule used for groups such as contractors, agency staff, users, customers or other affected people who sit near the edge of your operational reach.
Measured figures or management estimates
If complete records are not available, use a clear estimate method, label it as such, and say what source data or assumptions were used.
When to count an incident
Set out whether you count events by first report, confirmation, closure or another date, and keep that timing basis consistent across the period.
How to treat one event with several impacts
Choose whether a single case is counted once or across multiple issue types, and explain the rule so the total is not overstated or understated.
Rounding and small-number suppression
If you round or suppress small values for privacy or readability, disclose the approach and make sure the published totals still reconcile to the underlying data.
How much detail to give when privacy limits apply
Aggregate sensitive information enough to protect individuals, but still provide enough context for readers to understand the kind of action taken and the issue addressed.
Examples
Illustrative examples
Synthetic, written by LRA — not from a company report, not text from any standard.
Illustrative (synthetic) example — Consumer electronics retail
We tightened our controls around customer-facing data and product claims, while also tracking the effect on sales conversion and complaint volumes. - We refreshed our product-safety checks, added extra review steps for customer data handling, and required a pre-publication sign-off for promotional content that could be misleading or overly aggressive. - For privacy, safety and misinformation risks, we logged the action taken, noted where we had to balance stronger customer protection against faster campaign delivery, and reviewed the measures monthly through our compliance dashboard. - In the year, we recorded 3 incidents in total: 2 privacy breaches and 1 product safety issue; all were classed as low severity, with no high-severity cases.
This synthetic example shows how a retailer might describe practical controls, the main risk themes addressed, the trade-off between commercial speed and customer protection, the way performance is tracked, and the incident picture for the period.
Illustrative (synthetic) example — Online travel services
We strengthened our booking-platform safeguards, tightened how personal information is handled, and added clearer checks on promotional messages sent to customers. - The work covered safer account access, better data-handling controls, and review of marketing content where there was a risk of pressure-selling or inaccurate claims; the same actions were used to address privacy, safety and misinformation concerns. - We tracked the related indicators each quarter, including complaint rates, blocked risky content, and the share of staff completing refresher training, and we recorded the practical tension between higher conversion and stronger customer protection. - During the year we noted 4 incidents in total: 3 privacy-related events and 1 safety-related event; 3 were low severity and 1 was medium severity, with none assessed as severe.
This synthetic example shows how a service business might explain the measures it put in place, the risk themes they were meant to address, the operational indicators it follows, and the incident profile for the reporting period.
How companies report S4-3 in practice
Real reports where this topic is disclosed. These are report practice, not exact disclosure templates to copy.
Globalvia
Ground Transportation — Highways and Railtracks · Spain · 2025
Globalvia's 2025 Sustainability Report provides partial context on various spheres including employment, taxation, financial regulation, government contracts, privacy and data protection, environment, and occupational health and safety (p.74). However, the report lacks headline values or specific quantitative data related to these areas. Additionally, no clear narrative or numeric evidence directly addressing the disclosure was found elsewhere in the report.
SNCF Group
Ground Transportation — Railroads · France · 2025
SNCF Group’s 2025 Full-Year Financial Report provides partial narrative context on safety procedures and related risks, mentioning topics such as abandonment of post and violations affecting privacy, reputation, and safety (p.156). The report references safety regulations overseen by the EPSF (p.38) and outlines safety policies, programmes, and action plans implemented across the Group, including targets for occupational first aiders in operational and functional teams (p.163, p.250). However, no headline values or specific quantitative data are presented, and there is no clear, quotable evidence directly addressing the full scope of the disclosure.
Redeia Corporación, S.A.
Electric Utilities / IPP / Energy Traders · Spain · 2025
Redeia Corporación, S.A.'s 2025 report provides a specific safety performance metric, noting a decrease in accident rates among its own employees with a severity rate of 0.07 and frequency rate of 1.09 (p.98). There is some related contextual information on policies and processes concerning affected communities, including engagement and remediation, but these are not clearly disclosed or detailed (p.152). No quotable evidence was found for other narrative or numeric items related to this disclosure, indicating gaps in comprehensive reporting.
✓ LRA AI Assistant · Human-in-the-loop
Ask Study Studio AI assistant about this disclosure
Get practical answers for your reporting context. Your first two answers are free — join LRA Community for free to continue without a limit.
TryHow do I prepare S4-3?What data do I need to collect?Where can I see a real-report example?What mistakes should I avoid?
2 free answers
Check your understanding
Scenarios to work through
A consumer app team has fixed a privacy setting issue and added extra checks before new releases. The team also changed its ad review process after a complaint about misleading claims, but the draft report only mentions the privacy fix.
QShould you include both the privacy-related fix and the marketing review change, or only the most obvious action?
Reveal model answer →Hide answer ↑Include every material action you have put in place for the issue area you are reporting on, not just the most visible one. In this case, the report should cover both the privacy fix and the change to ad review, because they address different harm areas and both are part of the response. Adapt the wording to your organisation and check the source before sign-off.
Why this matters · Cover the full set of response actions, even when they relate to different harm types.
A retailer has introduced extra product testing, clearer warning labels, and a staff training refresh after a safety complaint. The draft narrative lists the measures, but it does not explain which harm they are meant to reduce or how the business balanced sales pressure against tighter controls.
QDo you need to link the measures to the harm type and explain any tension between commercial goals and protection steps?
Reveal model answer →Hide answer ↑Yes. The write-up should show what kind of harm the measures are aimed at, what was done, and any practical trade-off the business had to manage, such as slower promotions or tighter approval steps in exchange for better protection. Adapt this to your organisation and check the source before sign-off.
Why this matters · Explain both the harm being addressed and any business trade-off created by the response.
A platform team tracks the number of privacy complaints, the number of safety-related reports, and the time taken to close each case. The team reviews the dashboard every month, but the report only says that monitoring happens without naming the measures used or how often they are checked.
QWhat level of detail should you give about the follow-up metrics and review cycle?
Reveal model answer →Hide answer ↑State the key measures you use to track progress, the indicators that show whether the response is working, and how often you look at them. A reader should be able to see both what is being watched and the cadence of review, not just that some monitoring exists. Adapt this to your organisation and check the source before sign-off.
Why this matters · Describe the measures, the indicators, and the review rhythm together.
A company had two incidents during the year: one privacy breach affecting 120 customers and one product safety issue affecting 8 customers. The draft report says there were incidents, but it does not separate the counts, the type of incident, or how serious each one was.
QHow should you present the incident information so it is useful for a reader?
Reveal model answer →Hide answer ↑Report the number of incidents, identify what kind they were, and describe how serious they were in practical terms. In this example, the privacy breach and the safety issue should be shown separately, with the counts kept consistent with the totals and the severity explained for each. Adapt this to your organisation and check the source before sign-off.
Why this matters · Give the count, the incident type, and the seriousness for each event.
Framework references
Related framework references
How this disclosure maps across the major reporting frameworks.
Primary
Related & explore
FAQ
Questions this page answers
How do I prepare disclosure S4-3 using the step-by-step guidance on this page?+−
Start with the plain-language explainer, then work through the page’s step-by-step preparation section to identify the datapoints you need, the evidence pack items, and the draft-output options. Use the workbook and Library Card to organise the work and keep the disclosure consistent from data collection through to drafting.
What datapoints do I need to collect for S4-3 on consumers and end-users?+−
The page lists the datapoints to prepare, including implemented actions, safety controls, privacy controls, marketing safeguards, impact category, response actions, balancing choices, key measures, tracking measures, review cadence, incident count, incident type, and incident seriousness. Use that list as the starting point for scoping your data request and evidence pack.
How should I define the scope and methodology for S4-3 before I draft the disclosure?+−
Use the page’s preparation section to decide which actions, controls, incidents, and measures are in scope, then align the methodology to the datapoints listed on the page. The guidance is designed to help you turn those inputs into a consistent draft rather than leaving scope decisions implicit.
Who should own the S4-3 data collection and sign-off process?+−
The page is set up for use by a sustainability or ESG manager, HR or data owner, and an assurance reviewer, so ownership should sit with the person who can gather the relevant controls, incident data, and evidence. The workbook and evidence pack help you assign tasks and track what is needed for review.
What evidence do I need to make S4-3 assurance-ready?+−
The page includes five assurance claims to verify, each with a claim, risk, and evidence prompt, plus an evidence pack with five items for assurance readiness. Use those two sections together to build a file that shows how the disclosure was prepared and supported.
What are the common mistakes to avoid when preparing S4-3?+−
The page has a section on common reporting gaps and mistakes, which is there to help you spot weak points before drafting. A practical use is to check that your data, evidence, and narrative all line up with the datapoints and assurance claims on the page.
How do I use the Prep & Assurance workbook for S4-3?+−
The Download Centre includes a Prep & Assurance workbook in .xlsx format, which you can use to organise the datapoints, evidence, and assurance checks. It is intended to support preparation rather than replace your own source records.
How do I use the printable Library Card for S4-3?+−
The Download Centre also provides a printable Library Card in PDF format, which is useful as a quick reference while you gather data and draft the disclosure. It can help you keep the page’s key points in view during review meetings or evidence checks.
What does the synthetic example disclosure on S4-3 show me?+−
The page includes synthetic illustrative example disclosures, including a quantitative table, to show how the datapoints can be turned into a draft. Treat the example as a formatting and drafting aid only, not as a template for your own numbers or conclusions.
How can I turn S4-3 data into a draft narrative and content-index line?+−
Use the draft-output section, which gives visualisation ideas, narrative starters, and a content-index line. That section is designed to help you move from collected data to a readable disclosure without inventing extra content.
More questions this page can help with
S4-3 consumers and end-users: what evidence pack items should I gather before assurance?S4-3 consumers and end-users: how do I map incident count, incident type, and incident seriousness into a draft?S4-3 consumers and end-users: what should I check in the assurance claims before sign-off?S4-3 consumers and end-users: how do I use the workbook to track controls, measures, and review cadence?S4-3 consumers and end-users: what are the most common reporting gaps on this page?S4-3 consumers and end-users: how do I decide which implemented actions and response actions belong in scope?S4-3 consumers and end-users: how should I document safety controls, privacy controls, and marketing safeguards?S4-3 consumers and end-users: how do I prepare a reviewer-friendly evidence trail from the page?S4-3 consumers and end-users: what can I use the synthetic example disclosure for?S4-3 consumers and end-users: how do I use the draft-output section to write the narrative?S4-3 consumers and end-users: is there a downloadable checklist or workbook for preparation?S4-3 consumers and end-users: does this page give a one-to-one ESRS or IFRS mapping?
How this library is built
312 published reports indexed
63171 pages with page-level citations
247 practitioner guides
Free · LRA Community
Get your S4-3 tools — free
Your preparation tools are free for LRA Community members and students. Register once (it's free) and your download starts right away — plus the Disclosure Library, templates and the LRA AI-assistant.
✓
You're in — your download is starting
Your file is downloading now. Your Community Cabinet — with the Disclosure Library, templates and the LRA AI-assistant — is ready too.
Open your Cabinet →