Published

Why an Ethics and Compliance Program is the ESG Tie That Binds

In recent years, one question that has taken center stage in governance, risk, and compliance circles is, “Who should ‘own’ environmental, social and governance (ESG) management?” But that question is a bit misguided and can even lead to potentially damaging consequences for organizations that view ESG initiatives as a tick-box exercise.

Here’s why: To “own” something connotes a meaning of belonging. The idea of one person, or even one group of people – such as an oversight committee – “owning” ESG management could create the perception among others in the organization, including senior executives, that they have no individual responsibility or accountability for ESG management at all. At the same time, however, if everyone owns ESG management, then no one owns it at all.

In this respect, it’s important to not confuse ESG ownership with ESG data ownership. In other words, it is the ESG data itself that should be owned, not the organization’s ESG responsibilities.

It is more than just semantics. There are key differences: ESG responsibilities are principles by which to live and operate the enterprise. They are timeless. They are unchanging, and they speak to each individual’s moral and ethical duties to treat the planet with respect (environment); to protect all people and treat one another with respect (social); and to engage in fair business practices because it is the right thing to do (governance).

Comparably, ESG data ownership speaks to the financial and regulatory requirements that do need to be owned and managed from a legal, compliance and risk management standpoint. ESG data ownership is essential for meeting amplified ESG-related regulatory obligations – including heightened disclosure obligations in the United States – as well as the demands of institutional investors.

Unlike ESG principles themselves that are timeless and unchanging, ESG data ownership is ever-evolving and dependent upon multiple factors – for example, the size of the business, the type of industry, and the specific and varied ESG-related regulations for which the business must comply.

ESG program challenges

Today’s heightened ESG regulatory landscape demands that businesses have a comprehensive view of all their ESG risks they can manage and monitor alongside all other risks as part of an overall enterprise-wide ethics and compliance program.

In practice, that requires collecting and assessing both financial and nonfinancial ESG risks deemed “material” to the business. In this regard, the SASB Standards, the Global Reporting Initiative standards, and the Carbon Disclosure Project are examples of frameworks helpful for better understanding industry-to-industry comparisons.

That said, if a company’s data and business processes are siloed, then following such frameworks will amount to nothing more than a senseless cat-herding exercise. Some questions to consider first: Does the organization still manually collect data on spreadsheets? Is it hoarded by multiple internal functions and/or external vendors on disparate systems? How do you know the data is complete, accurate and auditable?

From an ethics and compliance standpoint, ESG data that is complete, accurate, verifiable and auditable will help not only meet the needs of regulators and investors, but also mitigate common ESG-related legal and financial risks. Robust ESG data can signal, for example, if the business is engaging in greenwashing – making false or misleading statements about the environmental benefits of a product or service – or using ESG initiatives as window-dressing to cover up poor business performance or, worse, environmental and/or labor violations within the supply chain.

Most companies already collect a great deal of the ESG-related data they need, but it is often not labeled under the umbrella of “ESG” data. Thus, a robust ESG program starts with good data hygiene. Knowing exactly what data needs to be collected, where it is stored, how to get access to it, and who is allowed access to it are all important and necessary considerations.

Integrating ESG-related data by implementing a comprehensive ESG software solution can help organizations to better measure and manage ESG data, alongside all the other risks faced by the business.

ESG-linked executive compensation

Even after collecting ESG data, getting buy-in from the C-suite could still prove challenging. More and more companies have started to tie executive compensation or bonuses directly to how the company performs on specific ESG metrics. While such an approach can encourage accountability in corporate cultures with mature ESG programs, compensation tied to ESG metrics in a profit-driven culture could be easily manipulated and/or misguided if those efforts are insincere.

For example, Scope 3 greenhouse gas (GHG) emissions – those linked to downstream activities from assets not owned or controlled by the reporting company – contribute to the majority of organizations’ GHG emissions, according to the Environmental Protection Agency. So, linking compensation and bonus incentives to Scope 1 (direct emissions) and Scope 2 (indirect emissions from electricity, heating, or cooling activities), while incentivizing Scope 3 reductions could be counterintuitive.  

This is most acute in the oil and gas industry. Tying an oil executive’s compensation or bonus package to emissions reduction targets is meaningless if dwarfed by gains in new fossil fuel extraction projects. Moreover, it’s difficult to perceive ESG efforts as sincere if they don’t align with related governance and social initiatives, like respecting the rights of indigenous cultures in parts of the world where oil production occurs.

Beware of how social-related metrics can be manipulated as well. For example, in industries susceptible to workplace hazards, executives should not be rewarded for meeting what should be standard health and safety protocols.

Linking executive pay or bonuses to ESG metrics is not a bad idea, but how to do so in a way that truly demonstrates the sincerity of ESG efforts demands there be a lot more transparency around companies’ pay practices than is currently the case.   

ESG partnership, not ownership

Where chief compliance officers (CCOs) play an especially valuable role is not in “owning” ESG initiatives, per se. CCOs can effectively impact ESG programs by leading and overseeing a dedicated cross-functional committee with the collective aim to determine what material ESG risks need to be managed and what ESG metrics need to be measured. This should also include assessments on how the business is performing against those metrics, and how to share the story in a way that integrates with other risks reported out to the C-suite, regulators, investors, and other key stakeholders.

CCOs are uniquely positioned for this oversight role because they can dually ensure the business is meeting its ESG regulatory requirements, while championing ESG initiatives as a shared cultural responsibility embedded into the company’s ethos. Moreover, many of the goals and initiatives of an ethics and compliance program already overlap with other functions.

Regarding environmental initiatives, CCOs can help by substantiating ESG data or checking for false or misleading statements that may indicate greenwashing claims, for example. With social issues, CCOs can partner with the supply chain team to help monitor any potential links to modern slavery, human trafficking, pay inequities, and more.

Relatedly, compliance can help ensure the ESG practices of third-party vendors and suppliers align with those of the company’s code of conduct and values. Also, in the governance space, many aspects of compliance training – such as anticorruption and third-party due diligence – naturally touch upon ESG issues that can be seamlessly rolled into training.

At the end of the day, weaving ESG principles into the fabric of an ethics and compliance program should be a fairly seamless process in a company with a mature ESG program – one in which ESG principles are championed not merely as a nice-to-have or as a regulatory tick-box exercise, but rather as an integral part of business operations, as a competitive differentiator, and as a way to create profits in new and innovative ways.

To learn more about how to get started with ESG, download the Definitive Guide to Guide to ESG.

Download Now


Chat with a solutions expert to learn how you can take your compliance program to the next level of maturity.



State of R&C Report Key Finding – Interdependence Grows for Compliance, Data Privacy and IT/Information Security

NAVEX recently surveyed over 1,300 Risk and Compliance (R&C) leaders across the globe to delve into compliance program maturity, priorities, struggles, and more. Several findings point toward a growing interdependence for Compliance, Data Privacy and Information Security.

Previous/Next Article Chevron Icon of a previous/next arrow. Previous Post

Embracing the Whistleblower - 3 Ways Your Business Can Encourage Internal Reporting

The role whistleblowers play in identifying and bringing to light corporate misconduct, toxic cultures and the like is vital for the cultural health of any company. In many cases, whistleblowers put their career or reputation at risk by reporting – this is especially true in businesses where a “speak-up” culture may not be fully embraced. To that end, let’s discuss three things to keep in mind to help businesses better embrace the critical role whistleblowers play creating an ethical and compliant culture.

Next Post Previous/Next Article Chevron Icon of a previous/next arrow.