ESRS G1 Business Conduct: Ethics, Corruption, Whistleblowing, Suppliers and Payment Practices

Business-conduct reporting fails when narrative claims are written from policies alone while legal, investigations, procurement and finance records tell a different story. The risk is not merely an incomplete datapoint. Weak classification can turn an allegation into an apparent confirmed breach, omit a final sanction, double-count a fine, publish personal data, or claim prompt payment while the payment ledger shows otherwise. G1 therefore needs a cross-functional reporting process, not a sustainability-team questionnaire.

Figure 1. ESRS G1 evidence chain from culture and policies to controlled disclosure. London Reporting Academy learning visual.

Revised ESRS G1 covers three prescribed sub-topic groups: corporate culture, including anti-corruption and anti-bribery, whistleblower protection and animal welfare; supplier relationships, including payment practices and especially late payment to SMEs; and political influence, including lobbying. The undertaking reports G1 information only when the topic or relevant sub-topic relates to material impacts, risks or opportunities. A conclusion that one sub-topic is not material does not remove the need to assess the others.

Corporate culture is broader than a code of conduct. A useful disclosure explains how expected behaviour is established, communicated, reinforced, monitored and challenged. Depending on materiality, the evidence may include values and codes, leadership communications, incentives and consequences, training, speak-up arrangements, investigation independence, culture surveys, control testing, internal-audit findings, recurring root causes and governance oversight.

The reporting team should distinguish policy existence from implementation and effectiveness. A policy approved in December does not demonstrate that employees, agents and high-risk third parties understood it during the reporting period. Completion rates do not by themselves prove changes in behaviour. Conversely, a rise in reports through a speak-up channel may reflect greater trust and awareness rather than a deterioration in culture. The article wording should explain the evidence and its limitations rather than draw unsupported causal conclusions.

G1-1 asks whether anti-corruption and anti-bribery policies are consistent with the United Nations Convention against Corruption and identifies the functions or roles most at risk. G1-2 then moves from policy to action: procedures to prevent, detect, investigate and respond to allegations or incidents; training for at-risk functions, including relevant members of the administrative, management and supervisory bodies; and actions taken to address breaches.

Risk mapping: countries, public-sector interaction, licensing, customs, sales intermediaries, procurement, charitable donations, gifts and hospitality, joint ventures and acquisitions.

Prevention: due diligence, approval thresholds, contract clauses, segregation of duties, beneficial-ownership checks and payment controls.

Detection: transaction monitoring, audit analytics, conflicts declarations, whistleblowing channels and third-party alerts.

Investigation: independent case allocation, legal privilege where applicable, evidence preservation, interviewing protocols and documented conclusions.

Response: remediation, discipline, contract action, control redesign, reporting to authorities and lessons learned.

Training data should be tied to the risk universe. A group-wide completion rate can obscure whether the highest-risk sales, government-relations, procurement and customs roles received role-specific training. Retain the at-risk population definition, numerator, denominator, training content, delivery date, exceptions and evidence of management-body participation.

Revised G1-1 requires the undertaking to state whether it has whistleblower-protection policies. Where national law transposes the EU Whistleblower Directive, or equivalent requirements apply, the undertaking may state that it is subject to those legal requirements. That statement is not a substitute for explaining material implementation facts when they are necessary to understand the policy, action or outcome.

A reporting register should not use one field called “confirmed”. Different legal and reporting consequences attach to an allegation, an internally substantiated breach, an administrative finding, a final sanction and a final criminal conviction. The undertaking should also protect confidential reporters, witnesses and accused persons, restrict access by role, and aggregate or redact public information to avoid identification.

G1-2 asks how sustainability performance is considered in supplier selection, what sustainability training is provided to procurement teams, and how the undertaking engages suppliers to improve performance. A supplier code can be cross-referenced, but it does not answer these operational questions on its own.

Supplier relationship disclosures should connect to ESRS S2 where value-chain worker impacts are material. The same supplier record can support both standards, but G1 focuses on business-conduct management and payment practices, while S2 focuses on impacts on value-chain workers and the associated policies, actions, engagement and remedy.

Revised G1-6 requires a description of standard payment terms in days by main supplier category, identifying different SME terms; the percentage of payments aligned with those terms; and the number of outstanding legal proceedings for late payments. If late payment to SMEs is material, ESRS 1 may require an entity-specific metric. The 2023 G1-6 also prescribed average time to pay; the revised text does not. Keep both calculations in the system during transition, but publish the metric required by the version applied and any additional material information.

G1-5 requires the total monetary value of direct and indirect financial and in-kind political contributions, disaggregated by country or geographical area where relevant and by recipient type. It also requires the main lobbying issues and positions, how lobbying interacts with material impacts, risks and opportunities, and relevant appointments of members of the administrative, management and supervisory bodies who held comparable public-administration positions in the preceding two years.

Create one population covering direct payments, trade associations, lobbyists, think tanks, charities linked to political causes, in-kind support and fundraising events.

Document valuation methods for in-kind contributions and avoid netting positive and negative political positions.

Compare public-policy positions with transition plans, material impacts, targets and trade-association memberships; explain material inconsistencies or governance responses.

Use HR and company-secretariat records to screen relevant appointments, then obtain legal and privacy review before publication.

Lock the version and period. Identify the ESRS text applied, transition route and legal status.

Confirm G1 materiality by sub-topic. Link each conclusion to the IRO register and ESRS 2 IRO-2.

Build the disclosure-to-evidence matrix. Assign a requirement, owner, source, reviewer and retention rule.

Reconcile populations. Align group entities, functions-at-risk, suppliers, political-contribution accounts, legal cases and invoices.

Classify cases legally. Separate concerns, internal findings, final sanctions, final convictions, fines and outstanding proceedings.

Calculate and challenge metrics. Reperform payment and contribution calculations and reconcile fines to the financial statements.

Draft balanced narrative. Explain scope, actions, outcomes, limitations and changes without implying effectiveness that evidence cannot support.

Approve and preserve the trail. Obtain legal, finance, compliance, procurement and governance sign-off; freeze the published dataset and evidence index.

Why it works: the wording separates legal metrics from internal findings, states the reporting group and period, links the fine to financial recognition and identifies remediation. It must be adapted for materiality, privacy, privilege, jurisdiction, currency, consolidation and the precise final status of each matter.