Disclosure focus
This disclosure asks an organisation to explain the policy commitments that guide how it manages its material impacts, risks and opportunities. In practice, that means setting out the key policies it relies on, what they are intended to achieve, and how they connect to the organisation’s sustainability approach rather than just listing documents by name.
The practical focus is on whether those commitments are real and usable across the organisation. Reporters should make clear where the policies apply, whether they cover the whole organisation or only certain parts of it, and how they are communicated and embedded in day-to-day decision-making. If coverage is uneven, that should be clear too.
This LRA educational guidance supports disclosure preparation. For the exact requirements, always refer to the official GRI source.
Before you start
A quick mental checklist before you prepare this disclosure — tick each as you settle it.
Preparation
Key datapoints to prepare
＋ Show GRI 2-23 sub-elements (LRA working checklist)
Set out how the policy is shared with employees, suppliers, and other relevant parties.
State the responsible-business commitments and name the intergovernmental instruments they draw on.
State whether the commitments include using a precautionary approach.
State whether the commitments include carrying out due diligence.
State whether the commitments include respect for human rights.
Set out the organisation’s human-rights commitment, including which stakeholder groups it pays special attention to, such as at-risk or vulnerable people.
Set out which internationally recognised human rights are covered by the human-rights commitment.
If the policy commitments are not public, explain why they are not available.
If the policy commitments are public, provide the relevant links.
Explain how far the commitments apply across the organisation’s own operations and its business relationships.
State where each commitment was approved in the organisation, and whether that was the most senior approval level.
How to prepare it
1Set the reporting boundary first: decide which policy statements you will include, and make sure you cover every required topic — the business conduct commitments, the human-rights commitment, the named international references, due diligence, precautionary thinking, and the human-rights coverage details.
2Define what each item means in your own filing: separate the general conduct commitments from the specific human-rights promise, then map the human-rights promise to the rights it covers and the groups it is meant to protect, including any people who need extra attention because they may be at greater risk.
3Gather the source material that proves the content: use the approved policy text, board or committee papers, policy registers, intranet or public web pages, and any internal guidance that shows whether the commitments mention the required instruments, due diligence, precautionary approach, and respect for rights.
4Assemble the disclosure in the order the data points need: state the commitments, note whether the human-rights promise is specific and what it covers, add the public link where available or the reason it is not public, identify who approved each commitment and how senior that approval was, explain how far the commitments reach across your own operations and wider business ties, and describe how you share them with staff, partners, and other relevant groups.
5Record any gaps, exceptions, or changes clearly: if a commitment is not public, explain why; if wording, coverage, approval level, or communication method has changed since the last report, note what changed and when; keep the explanation tied to the actual policy evidence you hold.
6Check the final draft against the source documents line by line: confirm that every required point is answered, the wording matches the underlying policy position, the links work, the approval level is accurate, and the scope, coverage, and communication statements are consistent with the official records.
Request the data
Request the policy pack and approval trail
Translate the disclosure into an internal business question — then adapt it to your organisation's own language.
What policy statements do we have on responsible business conduct, who approved them, how far do they apply, and how are they shared internally and externally?
Use your organisation’s own policy names and governance terms first, then map them to the reporting disclosure. Avoid asking in framework language unless that is already how your team talks.
Weak request
Please provide the GRI 2-23 policy commitments disclosure, including all required elements and the approval hierarchy.
Why it fails: This uses framework wording that many internal owners will not recognise, and it does not tell them which documents, systems, or practical details to pull together. It also risks a partial answer because it does not separate policy content, approval, scope, publication status, and communication methods.
Better request
Please send the current policy statements that cover responsible business conduct, plus the approval trail and how they are shared. For each one, include the policy name, what it covers, whether it mentions due diligence, precautionary approach, and human rights, which human rights topics and stakeholder groups it focuses on, who approved it, whether that was the top decision-making level, whether it is public, the link if it is, and how it is communicated to staff and external partners. Use your own policy names and internal terms, and we will map them for reporting.
Industry examples
Draft your disclosure
Notes that turn data into a disclosure
LRA training templates — adapt them to your organisation, and check the official source before sign-off.
Method note
This disclosure can be built by listing each policy commitment, noting the external principles it refers to, and recording whether it includes due diligence, a precautionary approach, and respect for human rights, together with the approval level, scope of application, communication methods, and any public link or reason for non-public status.
Context note
Taken together, the data show how the organisation frames responsible business conduct in policy, how formally those commitments are authorised, how widely they apply, and how the organisation makes them known to people inside and outside the business.
Fluctuation statement
If the picture changes from one period to the next, explain whether that is because policies were updated, approval moved to a different level, coverage was broadened or narrowed, links were added or removed, or communication practices changed.
Content index entry
GRI 2-23 Policy commitments — [location / page] / [notes]
Download Centre
Preparation tools & forms
Professional preparation tools for GRI 2-23 — free with an LRA Community membership. Register once (it's free) and every download unlocks, together with the Disclosure Library, templates and the LRA AI-assistant.
Free · Community members
Assurance readiness
For each claim, check the evidence
Evidence pack to prepare
Common reporting gaps
The information is presented without a date or as-at point.The scope or boundary of the statement is left undefined.Key terms are used inconsistently across the report.Material changes since the previous period are not disclosed.Assertions are made without supporting detail or a source record.Boilerplate is used that does not actually answer what is asked.
Common gaps
Mistakes to avoid when collecting the data
Wrong policy owner
The data request goes to the wrong team, so the person who actually holds the policy register, approval record, or web link is never asked.
Framework language only
The collector asks for the item using reporting jargon instead of the organisation’s own policy names, so the source team cannot match the request to their records.
No boundary set
The team never agrees which policies, entities, or business relationships are in scope, so some commitments are counted twice while others are left out.
Wrong time basis
Evidence is pulled from a different reporting period or approval date than the one being reported, so the dataset does not line up with the year under review.
Mixed counting basis
One spreadsheet combines policy-level records, approval-level records, and communication records in a single count, which makes the figures impossible to reconcile.
Source labels lost
The original file names, document titles, or system tags are stripped away during collection, so no one can trace each data point back to the source.
Separate groups merged
Policies that should stay distinct, such as different commitment types or different stakeholder groups, are merged into one population and the detail is lost.
Missing evidence trail
The collector saves the content but not the supporting metadata, such as who approved it, when it was approved, or where it was published, so later review is blocked.
No sign-off record
The draft data set is circulated without a named reviewer or approval trail, so there is no clear record that the source information was checked before disclosure drafting.
Where judgement is often needed
What counts as a policy change after a deal or disposal
Use the reporting cut-off you apply elsewhere, then explain whether newly acquired or sold parts of the business are included, excluded, or shown separately and why.
When local policy language differs by country
If the same commitment is written differently across jurisdictions, describe the common substance, note any country-specific differences, and explain which version you treat as the main one for reporting.
Where a team or entity sits on the boundary of scope
For joint ventures, franchises, agents, contractors, or other close relationships, state the practical rule you used to decide inclusion and disclose any exclusions at the edge of the perimeter.
Choosing the timing basis for approval and publication
If approval, launch, or public posting happened at different times, state which date you use for the disclosure and explain the basis for that choice.
Deciding between exact figures and estimates
Where you cannot verify every policy link, approval level, or communication route directly, say what was checked, what was estimated, and how material gaps were handled.
Handling privacy limits in communication reporting
If naming specific worker groups, partners, or vulnerable populations would create privacy or safety issues, aggregate the information and explain the level of grouping used.
Setting the level of detail for human-rights coverage
When the commitment refers to broad rights or a long list of protected groups, state the categories you grouped together and make clear any important exclusions or overlaps.
Explaining whether the commitment reaches beyond owned operations
If the policy also covers suppliers, distributors, contractors, or other linked parties, spell out which relationships are covered in practice and where the commitment stops.
Dealing with mixed approval levels across commitments
If different commitments were signed off by different parts of the organisation, list each one with its approval point and note whether any sits below the most senior level.
Using rounded or summarised wording for public links and access
If you provide a landing page, document library, or grouped link rather than a direct file, explain how a reader can reach the relevant policy and whether any parts are restricted.
Examples
Illustrative examples
Synthetic, written by LRA — not from a company report, not text from any standard.
Illustrative (synthetic) example — consumer goods manufacturing
We have set out our responsible-conduct policy in a public code that points to the recognised human-rights due-diligence expectations, the recognised responsible-business guidance, and the ILO core labour standards; it also says we carry out due diligence, apply a precaution-first approach where impacts are uncertain, and respect human rights across our operations and value chain. Our human-rights commitment covers civil, political, economic, social and cultural rights, with extra attention to migrant workers, women in lower-paid roles, young workers, and people with disabilities. - The code was approved by the board, which is the most senior approval level for this set of commitments, and it applies to our own sites as well as suppliers, contractors and other business links. - The policy pack is available on our website at synthetic example links: https://example.com/policy-code, https://example.com/human-rights-policy; we share it through induction, annual refresher training, supplier onboarding, contract clauses, and internal notices to relevant teams and managers.
Synthetic illustration only: this example shows how a reporter might describe the policy basis, approval, scope and communication channels in plain language.
Illustrative (synthetic) example — food and beverage distribution
Our sustainability policy refers to the recognised sustainability principles, the OECD guidance for multinational enterprises, and the ILO labour standards, and it states that we expect risk-based due diligence, a precautionary mindset for serious or irreversible harm, and respect for human rights in day-to-day decisions. The human-rights section covers the full range of internationally recognised rights and gives particular attention to seasonal workers, agency workers, smallholder suppliers, and communities near our depots and transport routes. - These commitments were signed off by the executive committee rather than the board, so they are not approved at the most senior level, and they are intended to cover our operations plus key trading relationships. - The policies are not posted publicly because they are embedded in internal governance documents and supplier manuals; we communicate them through manager briefings, e-learning, supplier packs, onboarding materials, and periodic reminders from procurement and HR.
Synthetic illustration only: this example shows a non-public policy set, a lower approval point, and internal/external communication routes in a concise narrative form.
Company reports
How companies report GRI 2-23
Real reports where this topic is disclosed. These are report practice, not exact disclosure templates to copy.
Interconexión Eléctrica S.A. E.S.P.
Electric Utilities / IPP / Energy Traders · Colombia · 2024
Interconexión Eléctrica S.A. E.S.P.'s 2024 Integrated Management Report includes coverage of certain narrative items related to sustainability disclosures, such as references to intergovernmental instruments on page 140 and details on due diligence processes and complaint handling on page 142. The report also describes how stakeholder engagement has influenced company actions on page 144. However, several narrative items, including (a-iii), (a-iv), (b-i), (b-ii), (d), and (e), are not found or clearly addressed in the report.
Oberoi Realty Limited
Real Estate · India · 2025
Oberoi Realty Limited’s ESG Report FY 2024-25 provides covered evidence of policy commitments related to its Code of Conduct on page 126, indicating embedding of these commitments and associated processes. Partial context is given on due diligence processes and employee training on page 36, as well as human rights risk management and monitoring on page 102, though no headline values are presented. Several narrative items, including specific disclosures under (a-iii), (b-ii), (d), (e), and (f), are not found or remain unclear in the report.
Globalvia
Ground Transportation — Highways and Railtracks · Spain · 2025
Globalvia's 2025 Sustainability Report provides coverage on its business conduct policies, including prevention and detection of corruption and bribery (p.106), and its commitment to human rights (p.104). The report also includes a message from the General Manager addressing policy commitments and due diligence (p.113). However, several narrative items related to other aspects of the disclosure are not found or unclear in the report, indicating gaps in the coverage of certain required elements.
✓ LRA AI Assistant · Human-in-the-loop
Ask Study Studio AI assistant about this disclosure
Get a practical answer for your reporting context. Your first answer is free — create a free account to continue the conversation.
TryHow do I prepare GRI 2-23?What data do I need to collect?Where can I see a real-report example?What mistakes should I avoid?
1 free answer
Check your understanding
Scenarios to work through
A reporting lead has a draft policy pack that mentions the UN Guiding Principles and the OECD Guidelines, but the human rights section was copied from an old supplier code and does not say whether the company’s own policy covers due diligence or the precautionary approach. The board paper is due for sign-off next week.
QWhat should the preparer check before finalising the disclosure on the policy pack?
Reveal model answer →Hide answer ↑They should make sure the write-up clearly states which intergovernmental references the business policy draws on, and separately says whether the policy includes due diligence, a precautionary approach, and respect for human rights. If any of those points are not actually covered, they should not be implied; the disclosure should reflect the policy as written.
Why this matters · Separate the policy’s source references from the specific commitments it actually contains.
A sustainability manager is drafting the human rights part of the report. The company has a short statement saying it respects human rights, but the team has not yet agreed whether it covers all internationally recognised rights or only a narrower set linked to operations in three countries.
QHow should the preparer handle the scope of the human rights commitment?
Reveal model answer →Hide answer ↑They need to describe the scope exactly as the policy sets it out, including which recognised rights are covered. If the commitment is narrower than a full human-rights statement, the disclosure should say so plainly rather than broadening it for presentation purposes.
Why this matters · Report the actual reach of the human rights commitment, not an expanded version.
The legal team says the policy is on the intranet, but the external website only has a summary page. The report team is unsure whether to include a link, note that the full text is internal, or say the policy is unavailable to the public.
QWhat is the right way to present public access to the policy commitments?
Reveal model answer →Hide answer ↑If the commitments can be accessed publicly, the disclosure should point readers to that location. If they are not publicly accessible, the report should explain why that is the case instead of leaving the point blank or implying a public link exists.
Why this matters · Either direct readers to a public source or explain why no public access is available.
A group policy was approved by the audit committee, while the parent company’s board later endorsed the same wording for the wider group. The communications team also wants to say the policy applies to employees, joint ventures, and key suppliers, but the current draft only mentions employees and direct suppliers.
QWhat should the preparer confirm about approval level and coverage before publishing?
Reveal model answer →Hide answer ↑They should identify where each commitment was approved and whether that was the most senior decision-making level involved. They also need to state how far the commitments reach across the organisation’s own operations and its business relationships, and describe how the policy is shared with workers, partners, and other relevant audiences.
Why this matters · Show who approved the commitments, how far they extend, and how they are communicated.
Framework references
Related framework references
How this disclosure maps across the major reporting frameworks.
Primary
Related & explore
Organizational details → Guide ✓Nomination and selection of the highest governance body → Guide ✓Chair of the highest governance body → Guide ✓Role of the highest governance body in overseeing the management of impacts → Guide ✓Delegation of responsibility for managing impacts → Guide ✓Role of the highest governance body in sustainability reporting → Guide ✓Show all 29 related disclosures →
FAQ
Questions this page answers
For GRI 2-23, what data points do I need to gather before I start drafting the disclosure?+−
The page lists the main datapoints to prepare, including policy basis, due diligence commitment, precautionary approach, human rights commitment and scope, stakeholder groups, public policy links, access restrictions, approval level, policy reach and how the policy is communicated. Use that list as your collection checklist before you draft.
How do I use the step-by-step preparation section for GRI 2-23 in practice?+−
Use it as a working sequence: confirm the disclosure topic, collect the listed datapoints, check the assurance claims, then build the evidence pack and draft output. It is designed to help you move from raw information to a reviewable draft.
What should I include in the evidence pack for GRI 2-23 so it is assurance-ready?+−
The page includes a five-item evidence pack to support assurance readiness. Use it to assemble the documents and records that back up the datapoints, the claims to verify and the final draft.
What are the assurance claims I need to test for GRI 2-23?+−
The page sets out four claims to verify, each with a linked risk and evidence point. Use them to check whether the disclosure is supported, consistent and traceable before sign-off.
How do I avoid the common reporting gaps in a GRI 2-23 disclosure?+−
The page highlights common mistakes so you can spot missing scope, weak evidence, unclear ownership or incomplete communication detail early. Use that section as a pre-submission quality check.
Who should own the GRI 2-23 disclosure in my organisation?+−
The page is set up for practitioners to assign ownership across ESG, HR, policy or data owners, depending on where the underlying information sits. Use the datapoint list and evidence pack to decide who can confirm each item.
How do I decide the scope for the policy reach and human rights scope datapoints in GRI 2-23?+−
The page asks you to prepare both policy reach and human rights scope, so you need to define what parts of the organisation, workforce or value chain the policy covers. Keep the scope consistent across the narrative, table and evidence pack.
What does the page mean by public policy links and no public access reason for GRI 2-23?+−
These are separate datapoints to prepare: one captures whether the policy connects to public policy, and the other explains why the policy is not publicly accessible if that applies. The page does not add extra rules, so use the wording and evidence from your own records.
How do I turn the GRI 2-23 data into a draft disclosure?+−
The page includes draft-output support with visualisation ideas, narrative starters and a GRI content-index line. Use those to convert your collected data into a short narrative, a simple table if needed and a traceable index entry.
Can I use the synthetic example on the GRI 2-23 page as a template for my own disclosure?+−
Yes, but only as an illustrative guide. The example is synthetic, so you should replace it with your own internally consistent data and evidence.
More questions this page can help with
GRI 2-23 workbook download: what is the Prep & Assurance workbook for and how should I use it?Where do I find the printable Library Card PDF for GRI 2-23 and what is it for?What should I check before I say the GRI 2-23 disclosure is assurance-ready?How do I evidence approval level and policy communication for GRI 2-23?What are the most common mistakes people make when drafting GRI 2-23?How do I use the from company reports table on the GRI 2-23 page?What narrative starters does the GRI 2-23 page give for the draft output?How should I document due diligence commitment for GRI 2-23?How do I show responsible business policy basis in a GRI 2-23 draft?What evidence should I keep for priority stakeholder groups in GRI 2-23?How do I make sure the GRI 2-23 data table is internally consistent?Does the GRI 2-23 page give an ESRS or ISSB mapping I can rely on?
Free · LRA Community
Get your GRI 2-23 tools — free
Your preparation tools are free for LRA Community members and students. Register once (it's free) and your download starts right away — plus the Disclosure Library, templates and the LRA AI-assistant.
✓
You're in — your download is starting
Your file is downloading now. Your Community Cabinet — with the Disclosure Library, templates and the LRA AI-assistant — is ready too.
Open your Cabinet →