ESRS S4: Consumers and End-users·Disclosure Requirement S4-3
Actions & Resources
Praxisleitfaden für die Erstellung dieser Offenlegung. Mit dieser Karte bestimmen Sie die vorzubereitenden Angaben, prüfen Aussagen und ordnen die Nachweise. Für die genauen Anforderungen ziehen Sie stets die offizielle European Commission-Quelle heran.
Veröffentlichter Steckbrief
Prüfung ausstehendStandard
ESRS S4: Consumers and End-users
Disclosure Requirement S4-3 · 2026-5010-final
Zuletzt geprüft
—
LRA-Lehrmaterial · Nicht von European Commission herausgegeben oder gebilligt
Kern der Offenlegung
This disclosure asks an organisation to explain the actions it is taking, and the resources it is putting behind them, to address material impacts, risks and opportunities connected with affected communities. In practice, that means describing what is being done, how far those actions have progressed, and what support is being committed, rather than only stating broad intentions or policies.
The practical focus is on whether the response is real, targeted and sufficiently broad in scope. Reporters should make clear if actions cover the whole business, specific sites, projects or geographies, and whether resources are matched to where the impacts actually arise. The aim is to show how the organisation is responding in a way that is proportionate to the issue, not just highlighting a few flagship initiatives.
Dieses LRA-Lehrmaterial unterstützt die Erstellung der Offenlegung. Für die genauen Anforderungen ziehen Sie stets die offizielle European Commission-Quelle heran.
Bevor Sie beginnen
Bevor Sie beginnen
Eine kurze Checkliste, bevor Sie diese Offenlegung erstellen — haken Sie jeden Punkt ab, sobald er geklärt ist.
Vorbereitung
Wichtige vorzubereitende Angaben
| Vorbereitungsfeld | Was zu erfassen ist | Nachweishinweis | Verantwortlich |
|---|---|---|---|
| Implemented actions | A plain summary of the steps the organisation has put in place during the reporting period to address the issue named in the clause. | Action plans, project updates, remediation logs, approval notes, and closure records. | Sustainability / risk / relevant business lead |
| Safety controls in place | The measures currently used to reduce product-related harm, including controls, checks, and any changes made in the period. | Product safety procedures, test results, incident follow-up records, quality assurance logs, and recall or correction files. | Product safety / quality / operations |
| Privacy controls in place | The practical steps used to protect personal data, including technical, organisational, and process measures applied in the period. | Data protection policies, access control records, security settings, training logs, breach response procedures, and audit findings. | Data protection / IT security / legal |
| Marketing safeguards | The actions taken to keep marketing activity within responsible boundaries, including review, approval, and correction steps. | Marketing review checklists, approval workflows, campaign sign-off records, complaint logs, and takedown or correction evidence. | Marketing / compliance / legal |
| Impact category | The kind of issue being reported, using the organisation’s chosen classification for the relevant harm area such as privacy, safety, or misleading information. | Incident taxonomy, case coding guidance, issue logs, and classification rules used by the reporting team. | Risk / compliance / incident management |
| Response actions | The steps taken after the issue was identified, including containment, correction, escalation, and follow-up work. | Incident response records, corrective action plans, case notes, escalation emails, and closure evidence. | Incident management / risk / relevant business lead |
| Balancing choices | Any judgement calls made where one objective had to be weighed against another, and the reason the chosen balance was accepted. | Decision papers, risk acceptance notes, committee minutes, sign-off records, and trade-off assessments. | Senior management / risk / legal |
| Key measures | The main metrics used to track the issue or response, with the exact metric names and values used internally. | Management dashboards, KPI packs, scorecards, and metric definitions. | Performance management / finance / relevant function |
| Tracking measures | The indicators used to follow progress over time, including what is measured and how each indicator is defined. | Monitoring framework, indicator catalogue, reporting templates, and data dictionary. | Risk / sustainability reporting / analytics |
| Review cadence | How often the organisation checks or updates the measures, including the actual review cycle used in practice. | Reporting calendar, meeting schedules, dashboard refresh settings, and governance pack dates. | Reporting / risk / analytics |
| Incident count | The total number of incidents recorded for the period, counted once each according to the reporting definition. | Incident register, case management system extract, and period-end reconciliation to the source log. | Incident management / risk / compliance |
| Incident type | A short description of what kind of incident it was, using the organisation’s incident categories for privacy or safety events. | Case classification rules, incident log entries, investigation notes, and root-cause summaries. | Incident management / compliance / legal |
| Incident seriousness | The level of seriousness assigned to the incident, based on the organisation’s own severity scale and assessment criteria. | Severity matrix, triage notes, incident review records, and escalation thresholds. | Incident management / risk / compliance |
So bereiten Sie es vor
Daten anfordern
Request the actions, controls and incident log from the relevant owners
Übersetzen Sie die Offenlegung in eine interne Geschäftsfrage — und passen Sie diese dann an die Sprache Ihrer Organisation an.
What actions, controls, monitoring and incident details do we need to describe how the business manages customer-facing impacts and related risks in the reporting period?
Use your organisation’s own names first, then map them to the reporting categories. For example, ask for the product safety, privacy, content, customer trust, complaints, incident or control logs that your teams already use, rather than using framework labels in the request.
Schwache Anfrage
Please provide the ESRS S4 actions and resources evidence for the disclosure, including the actions implemented, product safety measures, data protection measures, responsible marketing actions, impact type, actions taken, trade-offs, KPIs, performance indicators, monitoring frequency, number of incidents, type and severity.
Warum sie scheitert: This uses framework language that many teams do not use day to day, so the owner may not know which records to pull. It also bundles too many labels without saying which internal logs, systems or teams hold the evidence. That makes it harder to respond quickly and increases the risk of incomplete or inconsistent data.
Bessere Anfrage
Please send the latest logs, trackers or dashboards your team uses for product safety, privacy, content, customer trust and related incidents for [period]. Include the actions taken, controls in place, what you monitor, how often you review it, and any incidents with type and severity. If there were decisions where one priority had to be balanced against another, note that too. Use your own team wording first, and we will map it for the reporting pack.
Vorlage für eine formelle E-Mail
Subject: Request for customer-facing controls, actions and incident details for [reporting period]\n\nHi [name/team],\n\nWe are preparing the sustainability reporting pack and need a short evidence set from your area for [reporting period]. Please send the information your team already holds on the controls, actions, monitoring and incidents linked to [your internal terms: e.g. product safety / privacy / content / customer trust / complaints].\n\nPlease include:\n- the main actions taken during the period\n- the controls or checks in place\n- any monitoring or performance measures you track\n- any incidents, issues or breaches logged in the period, with type and severity\n- any trade-offs or decisions made where two priorities had to be balanced\n- the source system, owner and date of the extract\n\nPlease use your own internal wording first, then we will map it to the reporting categories. If helpful, send a table or export and we will format it. Please check the source material before sign-off.\n\nThanks,\n[preparer name]
Kurzfassung für Teams / Slack
Hi [name] — could you send the latest [your internal terms: product safety / privacy / content / customer trust] actions, controls, monitoring and incident log for [period]? Please include the source, owner, dates, and any key trade-offs. We’ll map your wording to the reporting pack. Thanks.
Branchenbeispiele
Consumer electronics
Kontext. A business sells connected devices and apps, so the evidence sits across product safety, privacy, customer support and marketing compliance teams.
Angepasste Anfrage. Please share the device safety actions, app privacy controls, customer issue tracker and any incidents logged for [period]. Include the checks used before launch, the monitoring cadence, and any cases where a feature or campaign was changed because of safety or privacy concerns.
Beispielantwort. The owner returns a table with launch checks, privacy review dates, complaint counts, incident types, severity ratings, monthly monitoring notes and links to the product risk register and issue tracker.
Online retail / marketplace
Kontext. A business runs a digital marketplace, so the evidence is likely held by trust & safety, fraud, marketing and data protection teams.
Angepasste Anfrage. Please send the marketplace moderation actions, customer data handling controls, ad review checks and incident log for [period]. Include the main issues found, what was done, how often the team reviews the dashboard, and any trade-offs between conversion and customer protection.
Beispielantwort. The owner provides an export from the moderation tool, a privacy control checklist, a monthly performance dashboard and a short note on one campaign that was paused after a customer complaint spike.
Offenlegung entwerfen
Notizen, die aus Daten eine Offenlegung machen
LRA-Schulungsvorlagen — passen Sie sie an Ihre Organisation an und prüfen Sie vor der Freigabe die offizielle Quelle.
Methodenhinweis
Describe the basis used to group the data, including how issue categories, response actions, performance measures and incident seriousness were defined and counted.
Kontexthinweis
Explain what the figures show in practice: the kinds of issues being managed, the actions taken to address them, the indicators used to track delivery, and the scale and seriousness of recorded incidents.
Erläuterung zu Schwankungen
If any figures moved materially, explain the operational reason for the change, such as a shift in the mix of issues, a change in monitoring approach, or a different level of response activity.
Eintrag im Inhaltsindex
S4-3 Actions & Resources — [location / page] / [notes]Download-Center
Werkzeuge & Formulare zur Vorbereitung
Professionelle Vorbereitungswerkzeuge für S4-3 — kostenlos mit einer LRA Community-Mitgliedschaft. Einmal registrieren (kostenlos) und alle Downloads sind frei — zusammen mit der Disclosure-Bibliothek, den Vorlagen und dem LRA KI-Assistenten.
Prüfungsbereitschaft
Prüfen Sie zu jeder Aussage die Nachweise
| Aussage | Risiko | Zu prüfende Nachweise |
|---|---|---|
| We checked that the coverage figure was built from the right population and period, and that any exclusions or estimates were applied consistently and explained in our working papers. | An assurer may test whether the figure is complete, whether the chosen boundary leaves out relevant cases, and whether any judgement calls were made to make the result look better or easier to report. | Boundary memo; source population list; inclusion/exclusion log; calculation workbook; estimate methodology; sign-off notes showing the period covered and any exceptions. |
| We used the disclosed operations and groups that were actually relevant to the topic, and we documented why any sites, products, channels or customer groups were left out of the count. | The assurer may probe whether the scope was narrowed without a sound basis, or whether the reported set is not aligned with the underlying issue being described. | Scope-setting paper; mapping of operations/products/channels to the topic; rationale for omissions; management review notes; version history of the draft disclosure. |
| We relied on data that had been checked against source records, and we kept evidence showing how we dealt with missing, late or inconsistent inputs before finalising the figure. | The assurer may question whether the underlying data are reliable, whether gaps were filled in a controlled way, and whether the final number could be reproduced from the source files. | Source extracts; reconciliation sheets; data quality checks; exception log; emails or tickets resolving anomalies; audit trail from source to reported figure. |
| Before publication, we carried out internal checks on the draft wording and numbers, including a review for internal consistency, obvious errors and alignment with the supporting files. | The assurer may look for weak review controls, mismatches between narrative and numbers, or signs that the published disclosure was not checked against the evidence pack. | Pre-publication review checklist; approval workflow; redline drafts; consistency checks; evidence pack index; final sign-off from the responsible owner. |
| Where we refer to actions, we kept records showing what was done, what resources were used, and how we tracked progress so we could explain the basis for the statement in the disclosure. | The assurer may test whether the action description is backed by contemporaneous records, whether resource use is real rather than aspirational, and whether progress claims are supported by monitoring evidence. | Project plans; budgets or resource allocations; progress reports; KPI dashboards; meeting minutes; implementation evidence such as training logs, process changes or remediation records. |
Vorzubereitendes Nachweispaket
Häufige Lücken in der Berichterstattung
Häufige Lücken
Fehler, die Sie bei der Datenerhebung vermeiden sollten
Wo häufig eine Ermessensentscheidung nötig ist
Beispiele
Veranschaulichende Beispiele
Synthetisch, von LRA verfasst — nicht aus einem Unternehmensbericht und kein Text aus einem Standard.
We tightened our controls around customer-facing data and product claims, while also tracking the effect on sales conversion and complaint volumes.
- We refreshed our product-safety checks, added extra review steps for customer data handling, and required a pre-publication sign-off for promotional content that could be misleading or overly aggressive.
- For privacy, safety and misinformation risks, we logged the action taken, noted where we had to balance stronger customer protection against faster campaign delivery, and reviewed the measures monthly through our compliance dashboard.
- In the year, we recorded 3 incidents in total: 2 privacy breaches and 1 product safety issue; all were classed as low severity, with no high-severity cases.
This synthetic example shows how a retailer might describe practical controls, the main risk themes addressed, the trade-off between commercial speed and customer protection, the way performance is tracked, and the incident picture for the period.
We strengthened our booking-platform safeguards, tightened how personal information is handled, and added clearer checks on promotional messages sent to customers.
- The work covered safer account access, better data-handling controls, and review of marketing content where there was a risk of pressure-selling or inaccurate claims; the same actions were used to address privacy, safety and misinformation concerns.
- We tracked the related indicators each quarter, including complaint rates, blocked risky content, and the share of staff completing refresher training, and we recorded the practical tension between higher conversion and stronger customer protection.
- During the year we noted 4 incidents in total: 3 privacy-related events and 1 safety-related event; 3 were low severity and 1 was medium severity, with none assessed as severe.
This synthetic example shows how a service business might explain the measures it put in place, the risk themes they were meant to address, the operational indicators it follows, and the incident profile for the reporting period.
Unternehmensberichte
Wie Unternehmen S4-3 in der Praxis berichten
Beispiele für vollständige und teilweise Berichtspraxis. Es handelt sich um evidenzbasierte Analysen, nicht um Vorlagen zum Abschreiben.
Fragen Sie den Study-Studio-KI-Assistenten zu dieser Offenlegung
Erhalten Sie praxisnahe Antworten für Ihren Berichtskontext. Die ersten beiden Antworten sind kostenlos — treten Sie der LRA Community kostenlos bei, um ohne Limit weiterzumachen.
Prüfen Sie Ihr Verständnis
Szenarien zum Durcharbeiten
A consumer app team has fixed a privacy setting issue and added extra checks before new releases. The team also changed its ad review process after a complaint about misleading claims, but the draft report only mentions the privacy fix.
A retailer has introduced extra product testing, clearer warning labels, and a staff training refresh after a safety complaint. The draft narrative lists the measures, but it does not explain which harm they are meant to reduce or how the business balanced sales pressure against tighter controls.
A platform team tracks the number of privacy complaints, the number of safety-related reports, and the time taken to close each case. The team reviews the dashboard every month, but the report only says that monitoring happens without naming the measures used or how often they are checked.
A company had two incidents during the year: one privacy breach affecting 120 customers and one product safety issue affecting 8 customers. The draft report says there were incidents, but it does not separate the counts, the type of incident, or how serious each one was.
Verweise auf das Rahmenwerk
Einschlägige ESRS-Anforderungen und verwandte Offenlegungen
Verfügbare Verweise auf das Rahmenwerk und benachbarte Offenlegungen, die für diese Anforderung relevant sind.
ESRS
S4-3
innerhalb von ESRS S4: Consumers and End-users
Verwandtes & Entdecken
Mehr in ESRS S4 → Gesamten Katalog durchsuchen → Startseite der Disclosure-Bibliothek → Alle Offenlegungen durchsuchen →
FAQ
Fragen, die diese Seite beantwortet
Start with the plain-language explainer, then work through the page’s step-by-step preparation section to identify the datapoints you need, the evidence pack items, and the draft-output options. Use the workbook and Library Card to organise the work and keep the disclosure consistent from data collection through to drafting.
The page lists the datapoints to prepare, including implemented actions, safety controls, privacy controls, marketing safeguards, impact category, response actions, balancing choices, key measures, tracking measures, review cadence, incident count, incident type, and incident seriousness. Use that list as the starting point for scoping your data request and evidence pack.
Use the page’s preparation section to decide which actions, controls, incidents, and measures are in scope, then align the methodology to the datapoints listed on the page. The guidance is designed to help you turn those inputs into a consistent draft rather than leaving scope decisions implicit.
The page is set up for use by a sustainability or ESG manager, HR or data owner, and an assurance reviewer, so ownership should sit with the person who can gather the relevant controls, incident data, and evidence. The workbook and evidence pack help you assign tasks and track what is needed for review.
The page includes five assurance claims to verify, each with a claim, risk, and evidence prompt, plus an evidence pack with five items for assurance readiness. Use those two sections together to build a file that shows how the disclosure was prepared and supported.
The page has a section on common reporting gaps and mistakes, which is there to help you spot weak points before drafting. A practical use is to check that your data, evidence, and narrative all line up with the datapoints and assurance claims on the page.
The Download Centre includes a Prep & Assurance workbook in .xlsx format, which you can use to organise the datapoints, evidence, and assurance checks. It is intended to support preparation rather than replace your own source records.
The Download Centre also provides a printable Library Card in PDF format, which is useful as a quick reference while you gather data and draft the disclosure. It can help you keep the page’s key points in view during review meetings or evidence checks.
The page includes synthetic illustrative example disclosures, including a quantitative table, to show how the datapoints can be turned into a draft. Treat the example as a formatting and drafting aid only, not as a template for your own numbers or conclusions.
Use the draft-output section, which gives visualisation ideas, narrative starters, and a content-index line. That section is designed to help you move from collected data to a readable disclosure without inventing extra content.
Weitere Fragen, bei denen diese Seite hilft
Tiefer einsteigen · S4-3
Lernen Sie, diese Offenlegung durchgängig zu erstellen
This guide covers one Disclosure Requirement. The ESRS / CSRD Reporting course walks the full European workflow — double materiality, datapoints, evidence and assurance — with exercises on your own data.
Available as Guided Flex, Live Cohort, 1:1 Expert Mentorship or Corporate Programme.
Holen Sie sich Ihre S4-3-Werkzeuge — kostenlos
Ihre Vorbereitungswerkzeuge sind für Mitglieder der LRA Community und für Studierende kostenlos. Einmal registrieren (kostenlos) und Ihr Download startet sofort — dazu die Disclosure-Bibliothek, Vorlagen und der LRA KI-Assistent.
Willkommen — Ihr Download startet
Ihre Datei wird jetzt heruntergeladen. Auch Ihr Community-Cabinet — mit der Disclosure-Bibliothek, Vorlagen und dem LRA KI-Assistenten — steht bereit.
Cabinet öffnen →