Communication of critical concerns

Disclosure focus

Critical concerns include concerns about the organization’s potential and actual negative impacts on stakeholders that are raised through grievance mechanisms or other processes. They also include concerns identified through other mechanisms about the organization’s business conduct in its operations and business relationships.

Critical concerns can therefore arise through grievance mechanisms, whistleblowing and ethics channels, compliance or legal investigations, internal audit, risk-management processes, human rights due diligence, regulatory interactions and other processes. Not every complaint, hotline report, risk or routine management update is a critical concern. The organization should apply documented criticality criteria that are consistent with the scope described in the GRI Guidance.

The highest governance body is the governance body with the highest authority in the organization. The term “Board” should be used only where the Board is the organization’s highest governance body. Where concerns are first communicated to a committee, the organization should identify whether it is a committee of the highest governance body, describe its authority and explain how the concerns are communicated to the full highest governance body or otherwise treated as formally communicated to it.

The communication-process description should explain the main sources of critical concerns, who assesses whether a concern is critical, the routine and urgent escalation routes, the recipient governance body and the communication format. Routine reporting should not be included in the total unless it communicates a critical concern.

The reported total should normally represent distinct critical concerns communicated during the reporting period, rather than the number of emails, updates, meetings or Board papers. The organization should document how it treats continuing concerns, recurring concerns and multiple communications concerning the same matter.

The nature of the concerns can be reported through high-level, aggregated categories, such as occupational health and safety, human rights, business conduct, corruption, data protection or supply-chain conduct. Disclosure of identifying case details is not required.

If no critical concerns were communicated during the reporting period, the organization should report a total of zero and state this clearly.

Reasons for omission are permitted for Disclosure 2-16. Before omitting information because of confidentiality, the organization should consider whether it can report the total and provide aggregated or anonymised information on the nature of the concerns. Where a requirement cannot be reported, the organization must identify the affected requirement and provide an applicable reason for omission and the required specific explanation in its GRI content index.

This LRA educational guidance supports disclosure preparation. For the exact requirements, always refer to the official GRI source.