Disclosure LibraryPractitioner guidance for every reporting disclosure

Home→ Disclosure Library→ ESRS→ ESRS 2→ GOV-4

ESRS 2: General Disclosures · 2026-5010-final

Disclosure Requirement GOV-4

Statement on Due Diligence

Practical guidance for preparing this disclosure. Use this card to identify datapoints, verify claims and organise supporting evidence. For exact requirements, always refer to the official EFRAG source.

◍ Open official EFRAG source Compare real reports → ↗ Share

Reviewed by Dr Ross Kurinko · Sustainability Reporting Trainer LRA educational guidance · Not issued or endorsed by EFRAG

To prepare this disclosure

4datapoints↓ 4claims to verify↓ 5evidence areas↓ 3report examples↓

Disclosure focus

This disclosure asks the organisation to explain whether, and how, it carries out due diligence as part of its governance and decision-making. In practice, that means describing the main processes used to identify, assess, prevent, mitigate and track material impacts, risks and opportunities, rather than simply stating that a policy exists.

The practical focus is on the real scope and consistency of those processes across the business. Report whether due diligence applies across the whole organisation and value chain, or only to selected activities, regions or flagship sites, and explain any important gaps, exceptions or differences in coverage.

This LRA educational guidance supports disclosure preparation. For the exact requirements, always refer to the official EFRAG source.

Before you start

A quick mental checklist before you prepare this disclosure — tick each as you settle it.

Have you decided which parts of the business, and which stages in the process, you will describe in your control setup? Before drafting, have you fixed the check-and-approval steps you will explain for the information you report? Have you agreed which safeguards you will mention for spotting, handling, and escalating risk issues? For any estimates you refer to, have you settled what checks and limits sit around how they are prepared and reviewed? Can every point you plan to include be traced back to a named internal source or record? Have you confirmed the time period and internal definitions you will use so the description matches the same basis throughout?

Preparation

Key datapoints to prepare

Datapoint What to capture Evidence hint Owner

Control framework overview A plain description of how the reporting process is governed and controlled, including the main checks, approvals and responsibilities that sit around the data and reporting cycle. Process maps, control narratives, RACI or responsibility matrix, approval workflow, internal control documentation. Finance / Reporting Controls

Data checking process How reported data is reviewed for accuracy and consistency before it is published, including the checks performed, who performs them and when they happen. Validation checklists, review logs, exception reports, sign-off records, data quality rules. Data Management / Reporting

Risk control measures The controls used to manage reporting-related risks, covering the key risk areas identified and the actions in place to reduce or monitor them. Risk register, control matrix, mitigation plans, monitoring reports, issue logs. Risk Management / Internal Control

Estimation control methods The methods and checks used when reported figures are estimated rather than directly measured, including how assumptions are set, reviewed and updated. Estimation methodology, assumption papers, calculation files, review and approval records, model governance notes. Finance / Technical Accounting

＋ Show GOV-4 sub-elements (LRA working checklist)

Describe the control framework used to prepare the information. Explain how the data is checked before reporting. Set out the controls used when estimates are made. Set out the controls used to manage reporting risks.

How to prepare it

1Set the reporting boundary first: decide which parts of the business, entities, systems and processes are in scope for the control narrative, and make that choice consistent across the four required areas.

2Define the control content in plain business terms: describe how the organisation oversees controls, how it checks data quality, how it manages risk-related checks, and how it handles controls used where figures are estimated.

3Gather the underlying support before drafting: collect the policies, procedures, sign-offs, reconciliations, review notes, exception logs and other records that show the controls actually operate.

4Prepare the disclosure text or tables from the evidence: explain the control setup, the validation approach, the risk checks and the estimation approach in a way that matches the records you have assembled.

5Record any limits, exclusions or changes clearly: note what was left out, why it was left out, and whether the control approach or evidence base changed during the reporting period.

6Check the final draft against the official source and internal records: confirm the wording still reflects the source requirement, the evidence supports each statement, and nothing material has been missed or overstated.

Request the data

Request the due diligence controls evidence

Translate the disclosure into an internal business question — then adapt it to your organisation's own language.

How do we describe the checks, controls and review steps that sit behind our due diligence process, and who owns them?

Use your organisation’s own names for the process, control owners and review forums first, then map them to the disclosure wording. Keep the request in business language rather than framework terms, and check the source material before sign-off.

Weak request

Please provide the ESRS 2:GOV-4 due diligence statement and all related controls, validation, risk and estimation controls.

Why it fails: This uses framework language that many teams do not use day to day, and it does not tell the owner what practical evidence to return. It also bundles several ideas together without asking for the underlying records, owners, dates or source systems.

Better request

Please share the evidence that shows how your team checks, reviews and signs off the information used in [process name] for [period]. Use your normal team terms, and include the control owner, source system or record set, latest version/date, and any logs, approvals or review notes.

Formal email template

Subject: Request for due diligence controls evidence for [reporting period]

Hi [name/team],

We are preparing the sustainability reporting pack and need your help with the evidence behind our due diligence process for [reporting period].

Please send the following in your own team’s terms, using the names you normally use internally:
- a short description of the control set or review steps that support the process
- how data or information is checked before it is used in reporting
- the main controls used to manage identified risks
- the controls used where judgement or estimates are involved
- the owner for each control or review step
- any supporting records, logs, approvals or review notes

Please include the reporting boundary, the period covered, the source system or record set, and the latest version/date for each item.

If helpful, you can return this as a table or attach the relevant documents. Please adapt this to your organisation’s language and check the source material before sign-off.

Thanks,
[preparer name]

Short Teams / Slack version

Hi [name/team] — could you share the evidence for the controls and review steps behind our due diligence process for [period]? Please use your team’s own terms, and include the owner, source record, latest version/date, and any supporting logs or approvals. Thanks.

Industry examples

Manufacturing

Context. The business uses a plant-level quality and compliance review process with manual sign-off on operational data.

Adapted request. Please share the evidence for the checks and sign-off steps used in the plant review process for [period]. Include the control owner, the line or site review step, the log or tracker used, and any exception notes.

Example response. A site control matrix, monthly review log, exception tracker, and sign-off sheet showing the plant manager, quality lead and finance reviewer.

Financial services

Context. The business relies on a formal risk and controls framework with documented testing and escalation.

Adapted request. Please send the evidence behind the risk review and control testing process for [period]. Include the control owner, the testing method, the system of record, and any issues raised or closed.

Example response. A controls register, testing results, issue log, escalation memo, and approval record from the risk committee secretary.

Draft your disclosure

Notes that turn data into a disclosure

LRA training templates — adapt them to your organisation, and check the official source before sign-off.

Method note

Explain how the control framework is defined, what counts as a validation check, how risk controls are identified, and how estimation controls are applied in practice.

Context note

Set out what the control information shows about how the reporting process is governed, checked, and managed, and why those controls matter for the reliability of the reported data.

Fluctuation statement

If the control picture has changed, point to updates in the framework, stronger or weaker validation, revised risk handling, or changes in how estimates are reviewed and supported.

Content index entry

GOV-4 Statement on Due Diligence — [location / page] / [notes]

Download Centre

Preparation tools & forms

Professional preparation tools for GOV-4 — free with an LRA Community membership. Register once (it's free) and every download unlocks, together with the Disclosure Library, templates and the LRA AI-assistant.

Free · Community members

01XLSPrep & Assurance workbookDatapoints, risks, evidence to check, owner and evidence pack.Get it free ↧ 02XLSData-request packRequest email, message template, response fields and sign-off structure.Get it free ↧ 03PDFLibrary CardPrintable one-page summary of this disclosure card.Get it free ↧

Go deeper · GOV-4

Learn to prepare this disclosure end-to-end

This guide covers one Disclosure Requirement. The ESRS / CSRD Reporting course walks the full European workflow — double materiality, datapoints, evidence and assurance — with exercises on your own data.

Available as Guided Flex, Live Cohort, 1:1 Expert Mentorship or Corporate Programme.

Explore the ESRS / CSRD course →

Assurance readiness

For each claim, check the evidence

ClaimRiskEvidence to check

We limited the figure to the parts of the business and reporting process we had actually defined for this report, and we documented where the boundary starts and ends.The assurer will test whether the boundary was set consistently, whether any material parts were left out without reason, and whether the stated scope matches the underlying reporting process.Reporting boundary memo; process maps showing included entities, sites, functions and data owners; scope approval notes; reconciliation between the reported boundary and the source population.

We checked that the underlying data set was complete and that the records had not been altered or lost between source systems and the final disclosure.The assurer will probe for missing records, duplicate entries, manual overrides, weak transfer controls, and whether the final figure can be traced back to source data without unexplained gaps.Data lineage and transfer logs; completeness checks; exception reports; access and change logs; reconciliation between source extracts, working papers and the published number.

We built the disclosure from a defined control set, including ownership, review steps, sign-off points and escalation routes before publication.The assurer will assess whether the control design is adequate, whether responsibilities were clear, whether reviews happened as described, and whether issues were escalated and resolved in time.Control framework documentation; RACI or role assignments; review and approval workflow records; issue logs; evidence of escalation and closure; publication sign-off pack.

Where the figure relied on estimates, we tested the assumptions, checked the calculation method and compared the result with available supporting evidence before we released it.The assurer will look for weak assumptions, unsupported inputs, calculation errors, bias in the estimate, and whether sensitivity or reasonableness checks were performed and documented.Estimation methodology; assumption papers; calculation sheets or model outputs; source evidence supporting inputs; sensitivity or reasonableness checks; reviewer comments and approval records.

Evidence pack to prepare

The governing policy or written commitment behind this disclosureA methodology / definition note setting out how the disclosure was scoped and preparedSource-system exports the figures or facts were drawn fromThe internal approval / sign-off record for the disclosure before publicationMinutes or records evidencing the relevant engagement or consultation

Common reporting gaps

The information is presented without a date or as-at point.The scope or boundary of the statement is left undefined.Key terms are used inconsistently across the report.Material changes since the previous period are not disclosed.Assertions are made without supporting detail or a source record.Boilerplate is used that does not actually answer what is asked.

Common gaps

Mistakes to avoid when collecting the data

Wrong owner

Chasing the board pack team for operational controls data leaves the evidence with people who do not run the checks in practice.

Framework words, not business terms

Asking for the control framework in reporting jargon instead of the organisation’s own process names makes teams send the wrong files or summaries.

No clear boundary

Collecting information without fixing which business units, sites, or activities are in scope leads to a mixed set that cannot be used cleanly.

Wrong period basis

Pulling records from a different reporting window than the one used for the disclosure creates a mismatch between the data and the period being described.

Mixed counting basis

Combining headcount-style figures with transaction counts or case counts in one extract makes the numbers impossible to compare like for like.

Source labels lost

Copying data into a new spreadsheet without keeping the original file names, field labels, or system tags breaks the trail back to the source.

Separate groups merged

Putting together data from different risk, validation, or estimation processes hides important differences that should stay separate for review.

Missing evidence trail

Saving the numbers without the supporting notes, version history, and sign-off record leaves no way to show who checked them and when.

＋ Show 5 more− Show fewer

Where judgement is often needed

Acquisitions and disposals during the year

Set a clear cut-off for when a bought-in or sold business starts or stops feeding the control, checking and risk processes, then explain any mid-year boundary change and its effect on the figures or narrative.

Different local definitions for the same control topic

Where country teams use different legal or operational labels for the same issue, choose one group-wide interpretation, describe the mapping used, and note any local exceptions that affect the way the process is described.

Units that sit partly inside and partly outside scope

Decide how to treat shared services, joint operations or other mixed arrangements, state the inclusion rule you used, and explain any material exclusions or partial coverage.

Choosing the reporting basis and timing

Be explicit about whether the description reflects the position at period end, an average over the year, or another cut-off, and explain why that basis was used if it affects how the control set is understood.

Measured data versus estimated inputs

If some parts of the control description rely on estimates rather than direct records, say which elements are estimated, what method was used, and how the estimate was checked or updated.

Rounding and aggregation choices

State the rounding rule and aggregation level used for the narrative or any supporting counts, and make sure the chosen presentation does not hide a material change in the control environment.

Privacy limits on how much detail can be shown

When personal or sensitive information cannot be shown in full, present the data in grouped form, explain the aggregation approach, and confirm that the summary still gives a fair picture of the process.

Changes in control design after a major event

If a reorganisation, system change or incident altered the way the process works during the year, describe the old and new arrangements, the date of change, and how the transition was reflected in the disclosure.

＋ Show 5 more− Show fewer

Examples

Illustrative examples

Synthetic, written by LRA — not from a company report, not text from any standard.

Illustrative (synthetic) example — Consumer goods manufacturing

We keep our oversight model simple: the board sets the tone, the audit and risk committees review key controls, and management owns day-to-day checks across reporting, operations, and compliance. - Before figures are reported, our finance team runs a documented review of source data, reconciles key balances to the ledger, and logs any corrections; in the latest cycle, 18 of 18 material data sets were checked, and 3 required adjustment before sign-off. - We use a risk register and control testing plan to track the main threats to delivery and reporting quality; 12 of 12 priority risks had named owners, and 10 had active mitigation actions in place at period end. - Where we rely on estimates, we apply approved assumptions, compare them with prior outcomes, and challenge unusual movements; 7 of 7 significant estimates were reviewed by a second person, and 5 were also tested against external benchmarks.

This example shows a plain-language description of how oversight is organised, how reported data is checked, how key risks are managed, and how estimates are reviewed and challenged.

Illustrative (synthetic) example — Renewable energy services

Our group uses a three-line approach: operational teams prepare the information, specialist functions test it, and the board and its committees receive escalation on matters that could affect reporting or delivery. - We validate data through automated checks, manual review of exceptions, and reconciliation to underlying records; in the period, 24 of 24 critical data feeds were tested, 4 exceptions were found, and all 4 were cleared before publication. - For major business and reporting risks, we maintain a control map, assign owners, and monitor whether actions are completed on time; 9 of 9 top risks were assigned, and 8 had controls operating as intended at the reporting date. - For estimates, we document the basis used, compare assumptions with recent actual results, and require independent review for higher-judgement items; 6 of 6 material estimates were reviewed, and 2 were updated after challenge from the review team.

This example illustrates a different sector’s way of describing governance, data checking, risk management, and controls over judgement-based estimates.

Company reportsReal published reports

Compare side by side →Get it free

How companies report GOV-4 in practice

Real reports where this topic is disclosed. These are report practice, not exact disclosure templates to copy.

Telecom Italia S.p.A.

Telecommunication Services · Italy · 2025

Open report →

Telecom Italia S.p.A.'s 2025 Annual Report includes a statement on due diligence, describing how the TIM Group identifies, assesses, and manages actual and potential negative sustainability impacts and risks, with details on operational phases provided (p.125). The report also mentions controls to ensure the completeness, accuracy, consistency, and traceability of sustainability information, although this is not a clear disclosure of the specific datapoint GOV 4.4 (p.127). However, no evidence was found for GOV 4.2 and GOV 4.3 disclosures in the report.

Globalvia

Ground Transportation — Highways and Railtracks · Spain · 2025

Open report →

Globalvia’s 2025 Sustainability Report provides detailed information on its management approach and policies related to due diligence procedures for identifying, assessing, preventing, and mitigating risks, as outlined on page 108. The report also references a due diligence procedure aimed at strengthening risk management and reinforcing ethical, compliance, and sustainability standards (p.30). However, the report offers only unclear or partial disclosures regarding the process for determining and assessing material impacts, risks, and opportunities (p.95), as well as the oversight and monitoring of strategic, financial, operational, and compliance risks by the Risk Department (p.32), with no clear evidence found for the methodology or narrative on this topic.

Pirelli & C. S.p.A.

Automobiles and Components · Italy · 2025

Open report →

Pirelli & C. S.p.A.’s 2025 Annual Report provides clear evidence of established due diligence processes and systems, as stated on page 139. The report includes related context on validation and risk assessment processes (pp. 107, 142), though these do not clearly disclose specific details of the due diligence governance elements. There is no explicit information found regarding the methodology or narrative for one of the governance disclosure points.

✓ LRA AI Assistant · Human-in-the-loop

Ask Study Studio AI assistant about this disclosure

Get practical answers for your reporting context. Your first two answers are free — join LRA Community for free to continue without a limit.

TryHow do I prepare GOV-4?What data do I need to collect?Where can I see a real-report example?What mistakes should I avoid?

2 free answers

Check your understanding

Scenarios to work through

An organisation uses models and estimates to fill gaps in supplier data and to approximate the scale of certain impacts. The team is unsure whether to mention those estimates because the numbers are not exact.

QWhat should the preparer include about estimation methods in the due diligence statement?

Reveal model answer →Hide answer ↑

The preparer should explain how estimates are controlled, including the way assumptions are reviewed and the limits of the estimate are managed, so readers can understand how the figures were produced. The text should be a possible LRA training template, adapted to the organisation and checked against the official source before sign-off.

Why this matters · If estimates are used, explain the controls around them so the reader can judge the reliability of the information.

The preparer receives partial evidence for ESRS 2:GOV-4 shortly before sign-off.

QWhat should they check before using it?

Reveal model answer →Hide answer ↑

They should confirm the reporting period, boundary, source owner and whether any estimates or exclusions are documented.

Why this matters · A disclosure is easier to defend when scope, timing and evidence ownership are clear.

A business unit sends data for ESRS 2:GOV-4 using labels that do not match the reporting workbook.

QHow should the preparer handle the mismatch?

Reveal model answer →Hide answer ↑

They should map the source labels to the reporting fields, record the mapping decision and ask the owner to confirm any uncertain items.

Why this matters · Clear field mapping prevents a local data label from becoming an unexplained reporting judgement.

Framework references

Related framework references

How this disclosure maps across the major reporting frameworks.

ESRS

GOV-4

within ESRS 2: General Disclosures

Open official source →

Primary

Related & explore

General Basis for Preparation of Sustainability Statements → Guide ✓Disclosures in Relation to Specific Circumstances → Guide ✓Actions and Resources in Relation to Material Sustainability Matters → Guide ✓Metrics in Relation to Material Sustainability Matters → Guide ✓Policies Adopted to Manage Material Sustainability Matters → Guide ✓Targets in Relation to Material Sustainability Matters → Guide ✓Show all 14 related disclosures →

More in ESRS 2 →Browse full catalogue →Disclosure Library home →Search all disclosures →

Go deeper · GOV-4

Learn to prepare this disclosure end-to-end

Available as Guided Flex, Live Cohort, 1:1 Expert Mentorship or Corporate Programme.

Explore the ESRS / CSRD course →

FAQ

Questions this page answers

What do I need to gather for GOV-4 before I start drafting the disclosure?+−

Start with the four datapoints listed on the page: control framework overview, data checking process, risk control measures, and estimation control methods. The page also gives a step-by-step preparation flow, so use that to organise the work before you draft.

How do I use the GOV-4 step-by-step 'how to prepare' section in practice?+−

Use it as a working checklist to move from scoping and data collection into drafting and review. The page is designed to help you turn the disclosure into a practical workflow rather than a theory note.

Who should own the GOV-4 data and narrative in my organisation?+−

The page is set up for sustainability/ESG managers, HR or data owners, and assurance reviewers, so ownership should sit with the people who can explain the controls and evidence behind the disclosure. Use the page’s datapoints and evidence pack to assign clear responsibility for each part.

What evidence do I need to build an assurance-ready GOV-4 pack?+−

The page includes an evidence pack with five items for assurance readiness, plus four assurance claims to verify using claim, risk and evidence. Use those materials together so the draft is supported by traceable documentation rather than just narrative.

What are the four assurance claims in GOV-4 and how do I check them?+−

The page says there are four assurance claims to verify, each framed around claim, risk and evidence. Use that structure to test whether the disclosure is backed by the right controls, checks and supporting documents before review.

What common mistakes should I avoid when preparing GOV-4?+−

The page lists common reporting gaps and mistakes, so use that section as a pre-submission check. It is there to help you spot missing control detail, weak evidence or unclear methodology before the draft goes out.

How do I use the GOV-4 workbook to prepare the disclosure?+−

The Download Centre includes a Prep & Assurance workbook in .xlsx format. Use it to organise the datapoints, evidence and assurance checks into a working draft.

What is the printable Library Card for GOV-4 used for?+−

The Download Centre also includes a printable Library Card in .pdf format. It is a practical companion for keeping the disclosure requirements, preparation steps and evidence needs in one place while you work.

Can I use the synthetic example disclosure on the GOV-4 page as a template?+−

Yes, but only as an illustrative guide. The page says the examples are synthetic, so they are there to show how a disclosure might look, including the quantitative table, not to replace your own company data.

How do I turn GOV-4 data into a draft narrative and content index line?+−

The draft-output section gives visualisation ideas, narrative starters and a content-index line. Use those prompts to convert your prepared controls and evidence into a readable draft that is easier to review and assure.

Get your GOV-4 tools — free

Your preparation tools are free for LRA Community members and students. Register once (it's free) and your download starts right away — plus the Disclosure Library, templates and the LRA AI-assistant.

	Report A	Report B	Report C
Datapoint 1	✓ p.213	unclear	✓ p.87
Datapoint 2	✓ p.214	—	✓ p.90

Members see the full datapoint coverage map — ✓ with page references — across 3 real reports, in the companies' own words.

First name Last name

Work email

Phone (optional) Organisation (optional)

Free to join. We'll only use your details to set up your membership — you'll finish a short onboarding in your Cabinet.

✓

You're in — your download is starting

Your file is downloading now. Your Community Cabinet — with the Disclosure Library, templates and the LRA AI-assistant — is ready too.

Open your Cabinet →

Statement on Due Diligence

Key datapoints to prepare

How to prepare it

Request the due diligence controls evidence

Notes that turn data into a disclosure

Preparation tools & forms

For each claim, check the evidence

Evidence pack to prepare

Common reporting gaps

Mistakes to avoid when collecting the data

Where judgement is often needed

Illustrative examples

How companies report GOV-4 in practice

Scenarios to work through

Related framework references

Questions this page answers

Get in touch