Disclosure focus
In practical terms, the organisation should think about coverage across the whole business, not only a few flagship sites or headquarters functions. A useful report will make clear whether the policy applies group-wide, to specific entities, operations or activities, and whether there are any important gaps, exceptions or differences in implementation across locations or parts of the business.
This LRA educational guidance supports disclosure preparation. For the exact requirements, always refer to the official European Commission source.
Prepare
What to collect before drafting
Tick each field as the evidence lands. Owners are the teams that usually hold the source files.
-
Policy title
Legal / ComplianceThe exact name used for the policy in the organisation’s records, as approved and currently in use.
Evidence Approved policy register, intranet policy page, or board/management paper showing the current title.
Watch for The policy name does not match the approved document title in the policy register.
-
Policy coverage
Legal / ComplianceA plain description of what the policy applies to, including the business areas, activities or entities it covers.
Evidence Policy scope section, group policy framework, or entity applicability matrix.
Watch for The stated coverage is broader or narrower than the entities and activities the policy actually applies to.
-
Coverage share
Sustainability / RiskThe proportion of the organisation’s own operations and relevant upstream or downstream activities that fall within the policy’s reach, expressed as a number.
Evidence Coverage assessment, operational boundary mapping, or value-chain scoping workbook.
Watch for The percentage is calculated on a different boundary than the operations and value chain scope used elsewhere.
-
Policy aims
Sustainability / StrategyThe main outcomes the policy is intended to achieve, stated in business terms and aligned to the approved document.
Evidence Policy objectives section, strategy paper, or management approval pack.
Watch for The objectives are taken from a draft or related policy and do not match the approved version.
-
Anti-bribery policy
Legal / ComplianceWhether the organisation has a formal policy covering bribery and corruption prevention.
Evidence Approved anti-bribery or anti-corruption policy, policy register, or compliance framework.
Watch for The yes/no answer is based on a local procedure rather than the formal group policy.
-
UN alignment
Legal / ComplianceWhether the anti-corruption policy is stated to align with the United Nations approach referenced by the organisation.
Evidence Policy text, approval paper, or compliance statement showing the stated alignment.
Watch for The alignment flag is set from a general ethics statement rather than an explicit policy reference.
-
Speak-up policy
Legal / ComplianceWhether there is a formal policy that lets people raise concerns or report wrongdoing through a whistleblowing route.
Evidence Whistleblowing policy, speak-up procedure, or ethics hotline policy.
Watch for The answer is based on an informal reporting channel and not a documented whistleblowing policy.
-
Whistleblower law coverage
Legal / ComplianceWhether that whistleblowing policy is framed to cover the legal protections or requirements that apply in the relevant jurisdictions.
Evidence Policy wording, legal review note, or jurisdictional compliance mapping.
Watch for The coverage flag reflects one country only and misses other jurisdictions where the policy is meant to apply.
-
Sensitive roles
Risk / ComplianceThe job families, functions or positions that are treated as higher exposure to bribery or corruption risk.
Evidence Risk assessment, role-based controls matrix, or anti-corruption training scope.
Watch for A high-risk role group is omitted because the list was built from job titles rather than actual risk exposure.
-
Risk countries
Risk / ComplianceThe countries or territories identified as higher risk for bribery or corruption exposure in the organisation’s assessment.
Evidence Country risk assessment, third-party risk map, or compliance risk register.
Watch for The country list is out of date and does not reconcile to the current country risk assessment.
-
Public-sector exposure
Risk / ComplianceA description of where the organisation’s activities involve contact with public officials, regulators or other public bodies.
Evidence Government interaction log, sales pipeline notes, licensing records, or public affairs register.
Watch for Public-authority touchpoints are missed because the source list only captures direct contracts and not permits, inspections or licensing.
Before you start
- Have you settled the exact policy title you will use, and the business areas it covers, including whether it reaches only your own operations or also parts of the wider supply chain?
- Before drafting, have you decided which conduct topics you will tick as in place, and whether each one is backed by a named policy or other internal rule?
- For the anti-bribery topic, have you checked whether your wording links it to the UN principles, or whether that link is not part of your current policy set?
- For speaking-up arrangements, have you confirmed whether you have a separate channel or policy for raising concerns, and whether it is meant to cover the legal areas you plan to report on?
- Have you identified the roles, countries and dealings with public bodies that you treat as higher exposure, so you can describe the scope consistently and from the same reporting period?
How to prepare it
Request the data
Request the business conduct policy pack and coverage details
Translate the disclosure into an internal business question — then adapt it to your organisation's own language.
Which policies and related coverage details do we need to describe our business conduct controls for the reporting period?
Use your organisation’s own policy names, control labels and team names first, then map them to the reporting disclosure. Keep the ask in everyday internal language rather than framework wording, and check the source documents before sign-off.
Weak request
Please provide the ESRS G1:G1-1 policy disclosures, including the policy name, scope, coverage, objectives, anti-corruption alignment, whistleblower coverage, high-risk functions, high-risk countries, and exposure to public authorities.
Why it fails: This uses framework language that many internal owners will not use day to day, so it is harder to route and answer quickly. It also bundles several concepts without telling the owner which documents to pull, where to look, or how to describe the business areas in their own terms.
Better request
Please send the latest business conduct policy documents and a short summary covering: the document names, what each one is for, which parts of the business or group they apply to, whether we have an anti-bribery / corruption policy, whether we have a speak-up policy and who it covers, which roles or locations carry higher exposure, which markets we treat as higher risk, and where we deal with public bodies or officials. Use our internal terms first, then we will map them to the reporting disclosure. Please check the source documents before sign-off.
Formal email template
Subject: Request for policy pack and coverage details for [reporting period] Hi [name], We are pulling together the evidence pack for our [reporting period] sustainability reporting. Could you please send the current documents and a short summary for the business conduct policy area? Please include: - the policy name(s) - what each document covers - which parts of the business or group are included - the main aims of each document - whether we have a policy covering anti-bribery / corruption matters - whether we have a speak-up / whistleblowing policy - whether the speak-up route covers the relevant legal entities and workers we need to include - the roles, functions and locations that carry higher exposure - any countries or markets we treat as higher risk - any areas where we deal directly with public bodies or officials If it is easier, you can send a link to the latest approved version plus a short note confirming the points above. Please use our internal terms where possible, and we will map them to the reporting disclosure. Please also check the source documents before sign-off. Thanks, [preparer name]
Short Teams / Slack version
Hi [name] — could you share the latest policy docs and a short note on scope, coverage, aims, higher-risk roles/locations, and any public-sector touchpoints for [reporting period]? Please use our internal terms. We’ll map them to the reporting disclosure and check the source docs before sign-off. धन्यवाद / Thanks, [preparer name]
Industry examples
Manufacturing
Context. A group with overseas sales teams, customs activity and third-party distributors.
Adapted request. Please share the latest ethics, anti-bribery and speak-up documents, plus a short note on which plants, sales teams, distributors and countries they cover, and where we have customs, licensing or other public-authority touchpoints.
Example response. Policy pack includes the Code of Conduct, Anti-bribery Policy and Speak-Up Policy. Coverage: group-wide for employees and contractors; distributor clause applies to appointed third parties. Higher-exposure roles: export sales, customs brokerage, tendering and government account managers. Higher-risk markets: Country A, Country B and Country C. Public-authority touchpoints: customs clearance, import permits and local licensing.
Financial services
Context. A regulated business with client onboarding, market-facing teams and a formal speak-up channel.
Adapted request. Please provide the conduct, anti-bribery and speak-up documents, and confirm which legal entities, client-facing teams and overseas offices they cover, plus any roles with higher exposure and any dealings with regulators or public bodies.
Example response. Documents: Conduct Policy, Anti-Corruption Standard and Speak-Up Procedure. Coverage: all regulated entities and employees; contractors included in the speak-up route. Higher-exposure roles: onboarding, relationship management, procurement and public-sector sales. Higher-risk locations: Region X and Region Y. Public-authority touchpoints: licensing, supervisory reviews and permit applications.
Draft your disclosure
Notes that turn data into a disclosure
LRA training templates — adapt them to your organisation, and check the official source before sign-off.
Method note
This disclosure can explain which policies were reviewed, how the organisation defined their scope and coverage, and what counts as a high-risk role, location or external exposure for the purposes of the data set.
Context note
Taken together, these data points show whether the organisation has formal controls in place, how far they extend across operations and the value chain, and where the main corruption-related risk areas are concentrated.
Fluctuation statement
If the figures or coverage changed from the prior period, the reporter can attribute that to policy updates, a broader or narrower scope, changes in the list of higher-risk roles or countries, or a revised view of exposure to public authorities.
Content index entry
G1-1 Policies (Business Conduct) — [location / page] / [notes]Download Centre
Preparation tools & forms
Download preparation tools for G1-1 with free verified email access for 24 hours. Source-report links remain public.
Check
For each claim, check the evidence
We limited the coverage figure to the parts of the business we had actually reviewed for this topic, and we can show how we decided what was in and what was left out.
Risk An assurer will probe whether the boundary was set consistently, whether any relevant entities, sites or activities were omitted, and whether the inclusion/exclusion logic was applied in the same way across the reporting period.
Evidence to check ['Boundary-setting memo or reporting note showing the inclusion/exclusion rules used for the figure', 'List of entities, sites, functions or activities included in the review, with reasons for any exclusions', 'Internal sign-off or review trail confirming the boundary decision']
We based the disclosed figure on the operations and roles we had mapped as higher exposure areas, and we kept the underlying mapping so it can be traced back.
Risk An assurer will test whether the higher-risk areas were identified using a clear method, whether the mapping was complete, and whether the disclosed scope matches the underlying risk assessment.
Evidence to check ['Risk assessment or mapping document identifying the higher-exposure functions, roles, locations or activities', 'Source data or registers used to build the mapping', 'Version-controlled working papers showing how the disclosed scope was derived from the risk assessment']
Where we used a defined term in the disclosure, we applied the same internal meaning throughout and checked that the wording matched our source materials.
Risk An assurer will look for inconsistent use of key terms, a mismatch between the narrative and the source definition, or a definition that was applied selectively.
Evidence to check ['Internal glossary or policy definitions used for the disclosure', 'Draft-to-final comparison showing consistent use of the term', 'Review notes confirming the wording was checked against the source definition']
For the policy information, we pulled together the policy name, what it covers, where it applies, and what it is meant to achieve, then checked that each part was stated clearly.
Risk An assurer will test whether the policy description is complete, whether the stated coverage matches the actual policy documents, and whether the objectives are supported by the underlying text.
Evidence to check ['Current policy documents and any related procedure documents', 'Summary table linking each policy to its scope, coverage and stated purpose', 'Management review or legal/compliance review confirming the summary is accurate']
We confirmed that the anti-corruption and anti-bribery policy set was current and aligned with our internal framework before we published the disclosure.
Risk An assurer will probe whether the policy was actually in force, whether it covered the relevant risks, and whether the disclosure overstates the maturity or completeness of the policy set.
Evidence to check ['Approved anti-corruption and anti-bribery policy documents with effective dates', 'Policy review or approval records showing the latest update cycle', 'Cross-check between the disclosure and the policy text']
We checked that the whistleblowing policy was in place and active at the reporting date, and we retained the approval trail and version history.
Risk An assurer will test whether the policy existed at the relevant date, whether it was formally approved, and whether the disclosure is based on a current document rather than a draft or obsolete version.
Evidence to check ['Whistleblowing policy document with approval date and version control', 'Evidence of publication or internal communication of the policy', 'Document control records showing the policy was current at the reporting date']
Evidence pack to prepare
Common reporting gaps
- Figures are stated without the supporting narrative, or narrative without figures.
- Scope is inconsistent between the text and the numbers.
- The reporting boundary is left undefined.
- Material changes since the previous period are not disclosed.
- Estimates and measured values are not distinguished.
- Source records for the figures are not identified.
Where drafts go wrong
Mistakes to avoid and where judgement is needed
The left column is what preparers get wrong while collecting; the right column is where you will have to make and explain a judgement.
Mistakes to avoid
- Wrong owner, wrong languageThe request goes to a team that does not hold the policy record, or it is framed in framework terms instead of the organisation’s own policy names and business wording.
- Scope left vagueThe collector never pins down which policy set, business area, or entity boundary is in view, so different people send different versions of the same item.
- Coverage basis mixed upOperational sites and value-chain coverage are pulled into one count or description even though they need to stay separate in the source data.
- Timing basis not fixedOne person uses the current live policy set while another uses the year-end snapshot, so the data no longer matches the same reporting period.
- Counting rules driftYes/no fields, text fields, and any numeric coverage inputs are gathered with different counting logic, which makes the dataset internally inconsistent.
- Source labels get strippedThe original file names, system tags, or document titles are lost during collection, so the team cannot trace each answer back to the source record.
- Separate populations mergedPolicies for different risk areas or different operating contexts are combined into one response, which hides where the organisation actually has distinct coverage.
- Evidence details missingThe collector saves the answer but not the supporting metadata such as version, date, owner, or location, so later review cannot verify what was used.
- No sign-off trailThe final dataset is passed on without a clear reviewer or approver record, leaving no audit trail for who checked the source and when.
Judgement needed
- How to treat a business bought or sold during the yearDecide whether the policy list and coverage figures reflect the group as it stood at the reporting date or include a newly acquired or recently disposed business for part of the year, and explain the cut-off used.
- Where local wording differs from group wordingIf country teams use different labels or legal terms for the same conduct rule, map them to one group description and note any places where the local version is narrower or broader.
- Whether a borderline team counts as in scopeSet out the rule used for staff or contractors who sit close to the boundary, such as shared-service teams, temporary workers or outsourced roles, and say how you decided they belong in or out.
- Choosing the basis for the coverage figureState whether the count is taken from headcount, full-time equivalent, contract population or another internal basis, and keep the same basis across the policy items unless you explain a change.
- Using a snapshot date or an average period viewExplain whether the policy coverage and related yes/no checks are assessed at period end, over the year, or on another timing basis, and disclose that basis clearly.
- Mixing direct records with estimatesIf some policy coverage is taken from system records and some from management judgement or sampling, identify which parts are measured and which are estimated, with the method used for the estimate.
- Rounding the coverage numbersApply one rounding rule consistently across the policy data points, and if rounding changes the displayed figure, note the rule so readers can reconcile the published numbers.
- Protecting sensitive location or role detailsWhen naming high-risk countries, sensitive functions or public-sector touchpoints could expose confidential information, group the data at a higher level and say that the detail has been aggregated for privacy or security reasons.
Examples
How it reads on the page
Synthetic, written by LRA — not from a company report, not text from any standard.
We describe a group-wide anti-bribery and integrity policy that applies to our own sites and the parts of the supply chain where we have direct oversight, and it is aimed at preventing misconduct and supporting ethical conduct. The policy is built to align with the recognised sustainability principles, and we also maintain a separate speaking-up policy that covers employees and contractors and is intended to meet the legal protections available in the jurisdictions where we operate.
- The integrity policy covers 100% of our owned operations and 85% of tier-1 suppliers by spend; it is active across all business units.
- We identify 42 roles as more exposed to bribery risk, mainly procurement, sales, customs, logistics and government-facing managers; 18 of those roles sit in three higher-risk countries, and 12 roles regularly deal with public bodies.
Synthetic example for practitioner review only. It shows how to narrate the policy name, where it applies, what it is meant to achieve, whether the anti-corruption and speaking-up arrangements exist, whether the anti-corruption policy is aligned to the UN Compact, and which roles, countries and public-authority touchpoints are treated as higher risk.
Our compliance framework includes a gifts, hospitality and anti-corruption policy for the company and the controlled entities we manage, with the aim of reducing bribery risk and reinforcing fair dealing. We also run a confidential reporting policy that is designed to operate in line with local legal protections, and the anti-corruption policy is mapped to the recognised sustainability principles.
- The policy reaches 100% of our operating sites and 70% of our key intermediaries by contract coverage; it is intended for all staff and relevant third parties.
- We classify 27 positions as higher exposure, including customs brokers, fleet managers, tendering staff and country leads; 9 of those positions are in two higher-risk countries, and 7 positions involve routine contact with regulators or other public bodies.
Synthetic example for practitioner review only. It demonstrates a different sector and wording while still covering the policy title, who and what it applies to, the intended purpose, the existence of anti-corruption and whistleblowing arrangements, the UN alignment, and the main higher-risk roles, countries and public-authority interfaces.
Quality ladder
- Basic
We have a business conduct policy.
- Better
We have a business conduct policy covering our own operations and selected suppliers, with anti-bribery, speak-up and public-sector contact controls.
- Best
We updated our business conduct policy this year to cover our operations and key suppliers, set out anti-bribery, speak-up and public-sector contact controls, and broadened the high-risk role and country list after a review of where our exposure is greatest.
Check your understanding
Scenarios to work through
A group finance team has one conduct policy for the parent company, but the overseas sales subsidiary uses a separate local code and the procurement team follows a third document. The reporting lead is deciding whether to describe one group-wide policy or several separate ones.
A preparer has a draft anti-bribery policy, but it only mentions employees and says nothing about agents, distributors, or other third parties used in sales. The team is unsure whether that is enough for the business conduct note.
The compliance team has a whistleblowing procedure for employees in the UK, but contractors in another country use a separate hotline run by a local provider. The reporting lead is deciding how to answer the policy question for the year-end report.
A multinational has identified customs brokers, public-sector sales contacts, and permit applications as the areas where conduct risk is highest. The draft note lists these activities, but it does not say which countries are most exposed or whether dealings with public bodies are part of the picture.
Ask the Knowledge Hub AI Assistant about this disclosure
Get practical answers for your reporting context.
Check your text
Paste one or two paragraphs. The fragment is used for this check only and is not stored in your conversation.
Peer comparison uses examples on this card, not prevalence in the report corpus.
Advice, not assurance
Framework references
Relevant ESRS requirements and related disclosures
ESRS
G1-1
within ESRS G1: Business Conduct
Guides that settle this question
Related & explore
More in ESRS G1 →Browse full catalogue →Search all disclosures →
FAQ
Questions this page answers
The page says to prepare the policy title, policy coverage, coverage share, policy aims, anti-bribery policy, UN alignment, speak-up policy, whistleblower law coverage, sensitive roles, risk countries and public-sector exposure. Use that list as your starting checklist before drafting.
Use it as a practical workflow to move from identifying the relevant policy and scope to collecting the supporting data and evidence. It is designed to help you prepare the disclosure rather than interpret the underlying standard.
The page points you to policy coverage and coverage share, so you should define what the policy applies to and how much of the business it covers. Keep the scope consistent with the rest of the datapoints you collect for the disclosure.
The page does not assign a single owner, so you need to decide ownership internally based on who holds the policy, the coverage data and the evidence. A practical approach is to name one accountable lead and then map supporting inputs from the relevant functions.
The page says there is an evidence pack with five items for assurance readiness. Use that pack to support the claims you make and to show where each datapoint came from.
The page says there are six assurance claims to verify, each linked to a claim, risk and evidence. Use those claims to test whether the disclosure is supported by the underlying records before you finalise it.
The page includes a list of common reporting gaps and mistakes, so use that as a pre-submission check. It is there to help you spot missing scope, weak evidence or inconsistent wording before the draft goes out.
The page has a draft-output section with visualisation ideas, narrative starters and a content-index line. Use those to turn the collected datapoints into a readable draft rather than starting from a blank page.
The Download Centre includes a Prep & Assurance workbook in .xlsx format and a printable Library Card in .pdf format. Use the workbook to organise the preparation and evidence, and the card as a quick reference while drafting or reviewing.
Yes. It includes a 'From company reports' table that links to real published reports at the pages where the topic is disclosed, which you can use as reference points when shaping your own draft.
The page includes synthetic illustrative example disclosures, including a quantitative table. Treat these as made-up examples for learning how the disclosure might look, not as reporting requirements.
More questions this page can help with