Sustainability Policy Template

What is a Sustainability policy?

A Sustainability policy (also known as an Environment, Social and Governance (ESG) policy) documents how your business considers and manages sustainability factors. It sets out the framework you and your colleagues use to make decisions across the three ESG areas.

It's mainly an internal tool to guide decision-making, however some growth stage companies may include it on their website and in marketing materials. Treat it as a living document that grows with your company.

If you already have a Diversity, Equity & Inclusion (DEI) and/or Environmental policy, reference them rather than duplicating. Separate policies allow more detail on goals and KPIs; a single Sustainability policy can also work for early-stage companies.

Start with materiality

Not every topic below applies to every company. Focus on what is material to your sector, stage, business model, and operating geographies. A B2B SaaS company has a different ESG profile from a hardware or deep tech company. A team of fifteen has different priorities from a team of one hundred.

Two questions to ask first:

• Which ESG topics could materially affect our business (regulation, customer requirements, talent, capital access, operational risk)?
• Where does our business have the greatest impact on people and the environment?

Anything that scores high on either dimension belongs in the policy. Park the rest until it becomes relevant.

Topics to consider when drafting

When drafting your policy, you may want to consider the following factors to the extent they are relevant to your business model and activities:

Environmental

• Your company's carbon footprint and what contributes to it
• Energy consumption in your offices, facilities and data centre usage
• Responsible disposal of hazardous waste
• Sustainable use of resources and materials
• Responsible business travel
• The environmental footprint of your supply chain
• The impact of climate change on your business (regulation, energy and water costs, water scarcity)
• Biodiversity and nature-related impacts (where material e.g. agriculture, rare earth materials, life sciences)

Social

• Diversity, equity and inclusion in your recruitment practices and across the employee experience
• Fair and equal pay, benefits and workplace culture
• Non-discriminatory employment practices and ethical labour practises
• Health, safety and wellbeing
• Human rights and labour rights in your supply chain
• Stakeholder engagement (employees, customers, suppliers, communities)
• Community impact (local hiring, mentoring, partnerships)

Governance

• Senior management and board structure, oversight and independence
• Employee relations and workplace grievance mechanisms
• Transparency of reporting and disclosure
• Data privacy (lawful basis, data subject rights, retention)
• Cybersecurity (incident response, third-party risk, security testing)
• Codes of Conduct, anti-bribery and corruption, whistleblowing
• Responsible technology and AI (governance of AI use, IP and confidentiality risk in AI tools, customer-facing AI ethics)
• Customer screening where relevant (e.g. defence tech, dual-use, sanctions exposure)

Example Template

Introduction / Statement:

Define why sustainability is important to your company and how it relates to your overall mission and vision.

Purpose / Scope of policy:

Describe the objective of the policy and who it applies to. For example, the policy outlines your commitment to sustainability and serves as a guide for employees, suppliers and other stakeholders.

1. Environment

1.1. Impact on the environment
How do your operations impact the environment and what measures are in place to reduce that impact? Have you measured your carbon footprint? Do you have a reduction direction or target? How will you track progress?

1.2. Climate change impact on your business
How might climate change affect your business operations in future and what can you do to mitigate it? (i.e regulatory changes, rising energy and water costs, water scarcity)

1.3. Supply chain and resources
What is the environmental footprint of your supply chain? How do you manage resource use and waste?

1.4. KPIs
Examples: emissions intensity, % renewable electricity, % suppliers screened. Have you set specific targets?

2. Social

2.1. Diversity, Equity and Inclusion:
What initiatives are in place to support DEI? How do you measure and monitor progress?

2.2. Compensation and Benefits:
What are your policies for fair pay? How do you measure it? What benefits do you have in place that encourage employee wellbeing?

2.3. Culture, Engagement and Growth:
How do you make sure your culture is reflected in the behaviours of your team? Do you measure employee engagement? How do you promote a culture of learning and development with your employees?

2.4. Health, Safety and Wellbeing:
What practices have you put in place to promote and support Health and Safety? How do you monitor it?

2.5. Human & Labour Rights:
Do you have policies for suppliers around human rights and labour issues? Do you screen your suppliers or customers?

2.6. Community Impact and Stakeholder Engagement
How does your company engage with employees, customers, suppliers and communities? What positive contribution do you aim to make?

2.7. KPIs
Examples: gender and ethnicity representation, employee engagement score, % suppliers signed up to a code of conduct. Have you set specific targets?

3. Governance

3.1. Corporate Governance:
How do you maintain good governance? What oversight exists at board or senior management level (sustainability committee, working group, named board sponsor)? How do you comply with relevant laws and regulations?

3.2. Reporting and Disclosure:
Do you report on ESG performance? How do you ensure transparency in disclosures? Will you align with any voluntary frameworks?

3.3. Ethics:
Do you have a Code of Conduct that defines expected behaviours and prohibits unlawful discrimination, harassment, bribery and corruption?

3.4. Data Privacy and Cybersecurity
What personal data do you collect and what is your lawful basis? What rights do data subjects have? How long do you retain data? Separately, what does your cybersecurity programme cover (access controls, incident response, third-party risk, testing)?

3.5. Responsible technology and AI
How do you govern the use of AI inside the business (acceptable use, IP and confidentiality risk in AI tools)? Where AI is in your product, what processes ensure responsible deployment, transparency, and human oversight? How do you assess AI risk in hiring or customer-facing decisions?

3.6. Customer and counterparty considerations
Where relevant (e.g. dual-use technology, sensitive sectors, sanctions exposure), how do you assess the ESG profile of customers and counterparties? 3.7. KPIs Examples: number of security incidents, % of staff completing annual training, frequency of policy reviews.

Policy adherence:

All employees should be required to read the policy and confirm they have understood it.

Policy approval: How will your policy be governed? Who is accountable (sustainability committee, working group, named board member)? How often will the policy be reviewed and updated (annually as a minimum)?

How to embed this policy

Drafting this policy is the start, not the finish. Use these prompts to make it real:

• Where will the policy live so employees can find it (handbook, intranet, shared drive)?
• How will it be introduced (onboarding, all-hands, training)?
• Who owns it day to day, and who is the escalation point?
• How often will it be reviewed and refreshed (annually as a minimum)?
• How will employees confirm they have read and understood it?
• How will it be communicated to suppliers, customers, and other relevant third parties?

How this policy connects

This policy works alongside others. Cross-reference where helpful:

• Code of Conduct (overarching behaviour and ethics)
• DEI policy (recruitment, fair treatment, inclusion)
• Anti-Harassment & Discrimination policy (protecting against unwanted behaviours)
• Whistleblowing policy (raising concerns)