ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
An ESG policy is the document that turns a company’s sustainability intentions into commitments someone is accountable for. It sits above the environmental, human rights, anti-corruption and governance policies that operate the detail, and its job is to state what the company has decided — its material topics, its principles, its targets, who owns them, how they are measured and how the board oversees them — in a form that a regulator, an investor, a lender or a customer can hold it to. Most ESG policies fail by being either a values statement with no commitments or a reporting appendix with no decisions. This guide sets out the six sections a working ESG policy needs, what each has to contain, how the policy connects to the ESRS and ISSB disclosures and the EU’s new rules on sustainability claims, and how to write one that stays true after it is published.
Three audiences read it. Regulators and assurance providers read it because the ESRS require companies to disclose the policies they have adopted to manage each material sustainability matter — their scope, the senior level accountable, the standards they follow — and a company without a policy for a material topic has to say so. Investors and lenders read it to see whether commitments exist that the company can be held to, which is what an ESG rating or a sustainability-linked loan covenant is built on. Employees and suppliers read it to know what is expected of them. A policy that serves all three is short on values and long on decisions.
| # | Section | What it contains | What it must not be |
|---|---|---|---|
| 1 | Purpose and scope | Why the policy exists; which entities, sites, workers and value-chain relationships it covers; its relationship to the policies beneath it | A mission statement |
| 2 | Material topics and principles | The topics the materiality assessment found material, listed; the principle the company adopts for each; the standards and frameworks it follows | A list of every ESG topic in existence |
| 3 | Commitments and targets | Specific, dated, measurable commitments per material topic; the base year; interim milestones | Aspirations without dates or numbers |
| 4 | Governance and accountability | Board oversight body; the executive accountable; owners per topic; how sustainability performance affects remuneration | ‘Everyone is responsible’ |
| 5 | Implementation and measurement | The policies and procedures that implement each commitment; the KPIs, their definitions and data owners; due diligence processes | A restatement of the commitments |
| 6 | Review and reporting | Review cycle and trigger events; where and how performance is reported; assurance; how claims derived from the policy are controlled | ‘Reviewed periodically’ |
State the scope precisely, because it is the boundary every KPI inherits: all consolidated subsidiaries under operational control, all employees and contingent workers, and the parts of the value chain the company has decided to address — tier-one suppliers, or high-risk suppliers, or the whole chain. Name the subordinate policies the ESG policy governs: environmental, human rights and labour, anti-bribery and anti-corruption, corporate governance, supplier code of conduct. The ESG policy sets direction; those operate it.
List the material topics from the materiality assessment — not the full ESRS topic list — and state the company’s principle for each in one sentence. “We will reduce absolute Scope 1 and 2 emissions in line with a 1.5°C pathway”; “We will not tolerate forced or child labour in our operations or supply chain”; “We will not offer or accept bribes or facilitation payments”. Name the frameworks followed: the GHG Protocol for emissions, the UN Guiding Principles for human rights due diligence, ISO 37001 or the equivalent for anti-bribery, the ESRS or ISSB for reporting. Our guide to the double materiality assessment covers how the list is produced.
The section that makes the policy enforceable, and the one most often left vague. Each material topic gets a target with a number, a unit, a base year and a date: a 42% reduction in Scope 1 and 2 emissions by 2030 against 2024; zero fatalities and a recordable injury rate below a stated figure; 100% of high-risk suppliers assessed by a date; 40% women on the board by a date. Interim milestones make the target reportable each year rather than only at the end. Targets that are not yet set are stated as such, with a date by which they will be, which is better than a placeholder.
Name the board committee that oversees sustainability, the executive accountable for the policy, and the owner for each material topic. State how sustainability performance enters executive remuneration, because the ESRS disclose it and investors ask. This is also where the policy states its relationship to risk management: material ESG risks on the enterprise risk register, reviewed on the same cycle as other risks.
For each commitment: the policy or procedure that implements it, the KPI that measures it, the KPI’s definition and data owner, and — for human rights and environmental impacts in the value chain — the due diligence process by which risks are identified, addressed and remedied. This is where an ESG policy connects to the operational documents and to the metrics register; our guide to ESG KPIs covers the metrics and their documentation.
The review cycle — annually, and on trigger events: a material change in the business, a new regulation, a serious incident, a change in the materiality assessment. Where performance is reported: the sustainability statement, the annual report, the website. Whether and to what level it is assured. And, since 27 September 2026, a control on claims: every environmental or social claim the company makes in marketing must be traceable to a commitment in this policy and to evidence, because Directive (EU) 2024/825 now prohibits generic and unsubstantiated sustainability claims across the EU. Our guide to the EU greenwashing rules covers what is prohibited.
The policy and the sustainability report should be built from the same skeleton. The ESRS minimum disclosure requirement on policies asks, for each material matter, for the policy’s key contents, its scope, the most senior level accountable, the third-party standards it follows and how it is made available — six things the six sections above supply directly. IFRS S1 asks for governance, strategy, risk management and metrics and targets, which map onto sections 4, 2–3, 5 and 3 respectively. A company that writes its ESG policy in these six sections has written the policy disclosures for its report at the same time.
What should an ESG policy include?
Six sections: purpose and scope; material topics and principles; commitments and targets with base years and dates; governance and accountability including remuneration links; implementation, KPIs and due diligence; and review and reporting, including control of sustainability claims.
Is an ESG policy required?
Not as a named document, but the ESRS require companies in CSRD scope to disclose the policies adopted for each material sustainability matter — or to state that none exists. An ESG policy is the practical way to have and disclose them coherently.
How does it differ from an environmental policy?
The ESG policy sets direction across environmental, social and governance topics and names the accountable roles and targets. The environmental policy is one of the operating policies beneath it, alongside human rights, anti-bribery and governance policies.
How long should it be?
Four to eight pages. Long enough to contain real commitments, targets and named accountabilities; short enough that a board reads it and a supplier understands it.
How often should it be reviewed?
Annually, and whenever the materiality assessment changes, a regulation changes, the business changes materially or a serious incident occurs — each stated in the policy as a trigger.
Write the ESG policy as six sections of decisions: scope, material topics and principles, numbered and dated commitments, named accountability, the operating policies and KPIs that implement it, and a review and claims-control cycle. Built that way it is the top of the policy hierarchy, the skeleton of the sustainability report, and — since the EU’s claims rules took effect — the document that decides what the company is allowed to say about itself.
ESG policy templates for five sectors, with the environmental, anti-bribery and anti-corruption and corporate governance policies that sit beneath them and an ESG gap analysis tool, are in the ESG Toolkit, or start with the free templates.
September 20, 2026
September 20, 2026
September 19, 2026
September 19, 2026
September 19, 2026