Disclosure focus
This disclosure asks an organisation to explain how it deals with compliance across its activities, rather than just saying it has policies in place. In practice, it is about whether the organisation has systems to identify, monitor and respond to legal and regulatory requirements, and whether it can show where any non-compliance has occurred and how it was handled.
The practical focus is on coverage and consistency across the organisation’s operations, not only at flagship sites or headquarters. A useful response should make clear the scope of the reporting boundary, the main areas of law and regulation that matter to the business, and any significant issues, patterns or follow-up actions that show how compliance is managed in reality.
This LRA educational guidance supports disclosure preparation. For the exact requirements, always refer to the official GRI source.
Before you start
A quick mental checklist before you prepare this disclosure — tick each as you settle it.
Preparation
Key datapoints to prepare
＋ Show GRI 2-27 sub-elements (LRA working checklist)
Set out the method used to decide which breaches count as significant.
Set out the significant breaches themselves.
Split the significant legal and regulatory breaches in the period by those that led to fines.
Split the significant legal and regulatory breaches in the period by those that led to non-cash penalties.
For fines paid in the period, separate those linked to earlier-period breaches and give both the count and the amount.
For fines paid in the period, separate those linked to breaches arising in the current period and give both the count and the amount.
State the amount of fines paid during the period.
State the number of fines paid during the period.
State the total number of significant legal and regulatory breaches in the period.
How to prepare it
1Set the reporting boundary first: confirm which entities, sites, and activities are in scope for the period, so you only capture breaches linked to that defined perimeter.
2Agree the counting rules before you start compiling data: decide what your team will treat as a material breach, and keep that test consistent across all sources and locations.
3Pull together the underlying records: gather case logs, legal notices, penalty letters, sanction records, and payment evidence so you can identify each relevant breach and whether it led to a financial penalty or another sanction.
4Build the disclosure outputs from those records: prepare the overall count, the split between cases with fines and cases with other sanctions, and the fine totals and amounts paid, including the split between amounts tied to the current period and those linked to earlier periods.
5Write a short explanation of the cases themselves and your method: summarise the significant breaches, and explain the basis you used to judge which cases were treated as significant.
6Check the final draft against the source records and the official guidance: make sure exclusions, reclassifications, and period-to-period changes are explained, and that the figures and narrative match the evidence trail.
Request the data
Request the compliance incidents and penalties log
Translate the disclosure into an internal business question — then adapt it to your organisation's own language.
What significant legal or regulatory breaches were identified in the period, what penalties were paid, and how were those cases classified?
Use your organisation’s own incident, breach, case, penalty and sanction terms first, then map them to the reporting categories before sending anything back. Keep the request in the language your legal, compliance or company secretariat team already uses, and check the source records before sign-off.
Weak request
Please provide the GRI 2-27 compliance with laws and regulations data, including the number of significant instances, fines, non-monetary sanctions, and how significance was determined.
Why it fails: This uses framework language rather than the team’s own records and labels, so the owner has to translate the ask before they can answer it. It also does not clearly separate the case log, the payment record, and the explanation of significance, which makes the return harder to verify.
Better request
Please send the legal/compliance case log for [period] for [scope], showing each significant breach or enforcement case, any cash penalty paid during the period, any non-cash sanction, the amount paid, whether the case started this year or earlier, and a short note on why it was treated as significant. Use your own internal labels and add a mapping note if needed. Please check the source records before sign-off.
Industry examples
Draft your disclosure
Notes that turn data into a disclosure
LRA training templates — adapt them to your organisation, and check the official source before sign-off.
Method note
Explain how the organisation decides which breaches are material enough to include, and state the basis used to count cases, fines and amounts paid.
Context note
Clarify what the figures represent in practice: the scale of notable legal or regulatory breaches, how many led to penalties, and how much was paid in fines during the period.
Fluctuation statement
If the numbers moved materially, note whether this was driven by new issues arising in the year, settlements of older cases, changes in how cases were classified, or a different mix of penalties.
Content index entry
GRI 2-27 Compliance with laws and regulations — [location / page] / [notes]
Download Centre
Preparation tools & forms
Professional preparation tools for GRI 2-27 — free with an LRA Community membership. Register once (it's free) and every download unlocks, together with the Disclosure Library, templates and the LRA AI-assistant.
Free · Community members
Assurance readiness
For each claim, check the evidence
Evidence pack to prepare
Common reporting gaps
The information is presented without a date or as-at point.The scope or boundary of the statement is left undefined.Key terms are used inconsistently across the report.Material changes since the previous period are not disclosed.Assertions are made without supporting detail or a source record.Boilerplate is used that does not actually answer what is asked.
Common gaps
Mistakes to avoid when collecting the data
Wrong owner for the case list
The data request goes to Legal or Compliance in framework language, but the real source sits with the teams that log breaches, penalties, and case outcomes in their own systems.
Scope is left vague
The collector does not pin down which entities, sites, or activities are in scope, so different teams send different populations that cannot be reconciled.
Period basis is mixed up
The team blends cases that happened in the year with fines that were paid in the year, which makes the counts and values impossible to separate cleanly.
Current and prior cases are merged
Payments linked to this year’s cases are not kept apart from payments linked to older cases, so the breakdown by when the breach occurred is lost.
Count basis changes mid-stream
Some teams count incidents, others count fines, and others count payment lines, so the same event can be captured more than once or not at all.
Source labels are stripped out
Original case IDs, regulator references, and internal file names are removed during collection, leaving no way to trace each figure back to the underlying record.
Different populations are combined
Monetary penalties and non-cash sanctions are rolled into one spreadsheet without separate fields, so the required split between them disappears.
No evidence trail is kept
The collector saves only the final numbers and drops the supporting extracts, dates, and approver names, so the sign-off path cannot be checked later.
Where judgement is often needed
Setting the group boundary after a deal closes
Decide whether to include a business only from the date control starts or stops, and explain the cut-off used so the count of significant breaches and any related fines matches the reporting boundary.
Handling local rulebooks that do not line up
Where the same conduct is treated differently across countries, use a consistent internal basis for deciding what counts as a significant breach and say which local rules were applied in each case.
Borderline cases near the reporting perimeter
For joint ventures, agents, contractors or other close-to-scope arrangements, set out the rule used to include or exclude an incident and describe any material cases that sit near the edge.
Choosing the date for a fine or sanction
State whether you use the payment date, the decision date or another internal cut-off for the year’s totals, and keep the same basis for both the number and the value reported.
Separating current-year and earlier-year penalties
If a payment in the year relates to an older breach, show it in the prior-period split and explain how you traced the case back to the year in which the breach happened.
Using estimates where the case is still open
If the final amount or sanction is not yet settled, explain whether you have used a measured amount, a best estimate or excluded the case for now, and disclose the method used to update it later.
Rounding and currency conversion choices
Set out the rounding rule and exchange-rate basis used for monetary values so readers can reconcile the totals, especially where small differences could change the reported amount.
Protecting privacy in the case description
When naming the incident would expose personal or sensitive details, give a high-level description that still explains the nature of the breach and the sanction without identifying individuals.
Deciding what makes a breach significant
Explain the internal threshold used to judge significance, such as size, repeat pattern, legal exposure or operational impact, and show that the same test was applied across the period.
Reconciling duplicate records across systems
If the same case appears in legal, finance and compliance logs, use one source of truth for the final count and value, and note how duplicates were removed before reporting.
Examples
Illustrative examples
Synthetic, written by LRA — not from a company report, not text from any standard.
Illustrative (synthetic) example — Manufacturing
Synthetic example only: during the year, we recorded 5 material breaches of law or regulation, of which 3 led to fines and 2 to non-cash penalties. We paid 7 fines in total, worth £420,000; 4 of those fines related to matters arising this year (£260,000) and 3 related to earlier years (£160,000).
We treat an issue as material when it is significant in scale, seriousness, or likely impact, using our internal review of legal notices, regulator correspondence, and management escalation. The summary below separates the cases by outcome and shows which paid fines came from the current year versus earlier periods.
Illustrative (synthetic) example — Transport
Synthetic example only: we identified 4 material breaches in the period, with 1 resulting in a fine and 3 in non-cash sanctions. We settled 2 fines during the year, totalling £95,000; both were linked to issues that arose in previous years, and none related to the current year.
Our judgement of materiality is based on whether the matter was formally escalated, involved a regulator or court, and could reasonably affect our licence, operations, or reputation. The figures below split the breaches by outcome and show the fines paid by when the underlying issue first occurred.
Company reports
How companies report GRI 2-27
Real reports where this topic is disclosed. These are report practice, not exact disclosure templates to copy.
Interconexión Eléctrica S.A. E.S.P.
Electric Utilities / IPP / Energy Traders · Colombia · 2024
Interconexión Eléctrica S.A. E.S.P.'s 2024 Integrated Management Report provides specific data on fines and penalties, noting monetary penalties exceeding USD 10,000 amounting to 2,887 (p.14) and mentions significant fines for non-compliance with service regulations (p.146). The report also details the breakdown and movements of the company’s debt by currency, source, and rates (p.124), and states there were no significant changes in relevant areas (p.131). However, no clear information was found regarding other narrative items related to the disclosure, indicating gaps in coverage for some expected details.
Advantech Co., Ltd.
Technology Hardware and Equipment · Taiwan · 2024
Advantech Co., Ltd.'s 2024 ESG Report includes coverage of compliance with laws and regulations, noting incidents related to corruption and bribery on page 37 and referencing environmental law violations and fines on page 128. The report also mentions governance aspects tied to legal compliance on page 231. However, there is no clear evidence of reported fines for environmental violations in 2024, as page 260 states no fines were imposed, indicating some inconsistency or lack of clarity in the reporting of such incidents.
Sands China Ltd.
Hotels, Restaurants, Leisure, Tourism Services · Macao · 2025
Sands China Ltd.’s 2025 ESG Report provides specific data on significant instances of noncompliance with laws and regulations, reporting two such instances on page 47, with no fines paid (p.47). The report also details greenhouse gas emissions by category, including purchased goods and services and capital goods, with figures provided on page 31 (p.31). However, there is no clear information on monetary losses related to fines and settlements beyond money laundering, which is reported as zero on page 54, and several other expected narrative items are not found or unclear in the report.
✓ LRA AI Assistant · Human-in-the-loop
Ask Study Studio AI assistant about this disclosure
Get a practical answer for your reporting context. Your first answer is free — create a free account to continue the conversation.
TryHow do I prepare GRI 2-27?What data do I need to collect?Where can I see a real-report example?What mistakes should I avoid?
1 free answer
Check your understanding
Scenarios to work through
During year-end close, a preparer finds two serious breaches that were settled in the period: one led to a cash penalty and the other to a non-cash enforcement action. The legal team also notes a third minor breach that was not treated as significant.
QWhich items should be counted and split out in the disclosure, and which should be left out?
Reveal model answer →Hide answer ↑Include only the breaches judged to be significant. In the count, separate the cases that led to cash penalties from those that led to non-cash sanctions. The minor breach is not included if it was not assessed as significant.
Why this matters · Only matters assessed as significant belong in this disclosure, and they need to be split by the type of outcome they led to.
A fine of 120,000 was paid during the reporting period for a permit breach that happened this year. Another payment of 80,000 was made in the same period for a case that arose last year and was only settled now.
QHow should the paid fines be grouped for reporting?
Reveal model answer →Hide answer ↑Report both the number and the amount of fines paid in the period, then separate them by whether the underlying breach happened in the current period or in an earlier one. In this example, the 120,000 relates to the current period and the 80,000 to a prior period, so each sits in its own bucket.
Why this matters · Payments made this year need to be split by when the underlying breach happened, not just by when the cash left the business.
The compliance team has a register showing three significant cases: one ended with a cash penalty, one with a licence restriction, and one is still open but already considered significant. The draft report currently lists only the two closed cases.
QShould the open case be described as well, and what level of detail is needed?
Reveal model answer →Hide answer ↑Yes. The narrative should cover the significant cases themselves, not only the ones that have finished. The description should be enough to explain what happened in each significant case, including the open one if it is still significant at the reporting date.
Why this matters · The narrative is about the significant cases identified for the period, including those still unresolved if they remain significant.
A group prepares its report using a central compliance dashboard, but each business unit applies different thresholds for what counts as significant. The group wants to state only that it uses a “materiality review” without explaining the process.
QWhat should the preparer do about the method used to decide significance?
Reveal model answer →Hide answer ↑Explain the basis used to decide which breaches were treated as significant, in enough detail for a reader to understand the approach. If different parts of the group use different thresholds, the report should reflect that the assessment was not done on a single uniform basis unless it truly was.
Why this matters · Readers need a plain explanation of how significance was judged, not just a label for the review process.
Framework references
Related framework references
How this disclosure maps across the major reporting frameworks.
Primary
Related & explore
Organizational details → Guide ✓Nomination and selection of the highest governance body → Guide ✓Chair of the highest governance body → Guide ✓Role of the highest governance body in overseeing the management of impacts → Guide ✓Delegation of responsibility for managing impacts → Guide ✓Role of the highest governance body in sustainability reporting → Guide ✓Show all 29 related disclosures →
FAQ
Questions this page answers
For GRI 2-27, what data points do I need to gather before I start drafting the disclosure?+−
The page says to prepare the serious-breach and fine datapoints, including counts, values, split by current and prior year, plus breach descriptions and the seriousness method. It is set up as a practical checklist, so you can use it to confirm the dataset is complete before drafting.
How do I use the step-by-step 'how to prepare' section for GRI 2-27 in practice?+−
Use it as a working sequence for collecting the data, checking the scope, and turning the inputs into a draft. The page is designed to help you move from raw records to a disclosure-ready summary rather than just read the topic in theory.
What should I include in the scope and methodology for GRI 2-27 serious breaches and fines?+−
The page points you to a seriousness method and to the current-year and prior-year split, so the scope and method need to explain how breaches were classified and how the periods were separated. Keep the explanation tied to the datapoints on the page and the evidence you can show.
Who should own the GRI 2-27 data collection if the information sits across HR, legal, finance and compliance?+−
The page is aimed at sustainability/ESG managers, HR or data owners, and assurance reviewers, so ownership should sit with whoever can evidence the breach and fine records and coordinate the inputs. In practice, assign clear owners for the breach log, fine values, and the seriousness assessment so the pack is complete.
How do I build an evidence pack for GRI 2-27 that is ready for assurance?+−
The page includes an evidence pack with five items and four assurance claims to verify, so the aim is to keep the source records, calculations and supporting explanations together. Use the pack to show how the counts and values were derived and how the seriousness method was applied.
What are the four assurance claims on the GRI 2-27 page and how do I use them?+−
The page says there are four claims to verify, each with a claim, risk and evidence prompt. Use them as an assurance checklist to test whether the disclosure is complete, consistent and backed by documents before it goes into the report.
What common mistakes does the GRI 2-27 page warn about when reporting serious breaches and fines?+−
The page lists common reporting gaps and mistakes, so it is useful for a final quality check before sign-off. Use it to catch missing datapoints, inconsistent splits, weak descriptions or unsupported calculations.
How do I turn the GRI 2-27 data into a draft disclosure and narrative?+−
The page includes draft-output guidance with visualisation ideas, narrative starters and a content-index line. That means you can use the prepared numbers and breach descriptions to produce a first draft, then refine the wording for clarity and consistency.
Can I use the synthetic example disclosure on the GRI 2-27 page as a template for my own numbers?+−
Yes, as an illustration only. The page says the example is synthetic and includes a quantitative table, so it can help you see how the disclosure may look, but you still need to replace it with your own internally consistent data.
Where can I download the GRI 2-27 workbook and printable card, and what are they for?+−
The Download Centre includes a Prep & Assurance workbook in .xlsx format and a printable Library Card in .pdf format. Use the workbook to organise the data and evidence, and the card as a quick reference while preparing the disclosure.
More questions this page can help with
GRI 2-27 serious breaches and fines: what datapoints should be in my source file?How do I split current-year and prior-year fines for GRI 2-27?What evidence should I keep for GRI 2-27 breach descriptions and fine values?How do I write a first draft for GRI 2-27 using the workbook?What are the most common GRI 2-27 reporting gaps to check before submission?How should I document the seriousness method for GRI 2-27?What does the GRI 2-27 example disclosure show about formatting the data table?How do I assign ownership across teams for GRI 2-27 reporting?What should an assurance reviewer look for in a GRI 2-27 evidence pack?Where can I find real company reports that disclose GRI 2-27 topics?How do I use the GRI 2-27 content-index line in a report draft?What is the best way to check that my GRI 2-27 counts and values are internally consistent?
Free · LRA Community
Get your GRI 2-27 tools — free
Your preparation tools are free for LRA Community members and students. Register once (it's free) and your download starts right away — plus the Disclosure Library, templates and the LRA AI-assistant.
✓
You're in — your download is starting
Your file is downloading now. Your Community Cabinet — with the Disclosure Library, templates and the LRA AI-assistant — is ready too.
Open your Cabinet →