Safety Norms: ESG Advisory Services

1Purpose, Scope, and Safety Principles

These norms govern how staff plan, perform, record, and communicate ESG advisory work. They cover desk-based research, client data requests, carbon and energy calculations, human rights and supply chain screening, governance reviews, disclosure drafting, stakeholder interviews, and any visit to a client facility, warehouse, construction site, or operating plant. They apply to employees, contractors, and subcontracted analysts working under the firm's name.

Three principles guide every decision: protect people first, protect information second, and never present a claim the evidence does not support. When two rules conflict, the stricter rule applies until an authorized manager documents a decision.

• Mandatory: no staff member enters an operating site without a host induction and written permission from the host.
• Recommended: keep the firm's escalation contacts in both digital and printed form while travelling.

2Roles, Competence, and Accountability

The engagement lead is accountable for scope, staffing, quality, and sign-off on each engagement. The engagement lead confirms that every team member holds the training and access needed for assigned tasks. The safety coordinator, normally the operations or health and safety lead, maintains site visit procedures and incident logs. The security officer owns access control and breach response. Compliance or legal counsel reviews any statement that could be read as a regulatory, investment, or public disclosure claim.

Competence means demonstrated ability, not seniority. Staff who are not qualified to judge a technical matter, such as process safety, structural integrity, or toxicology, must refer it to a qualified specialist and must not give an informal opinion in a deliverable.

• Mandatory: only staff with written authorization may release an ESG conclusion to a client or the public.
• Mandatory: any person may pause a site visit or data request if they believe a safety or confidentiality breach is occurring.
• Recommended: pair newer analysts with an experienced reviewer for the first two engagements in an unfamiliar sector.

3Realistic Hazards and Risk Assessment

ESG work produces harms that are quieter than industrial accidents but can be serious for clients, staff, and the public. Physical hazards arise during site visits, including slips on wet floors, falls from loading docks, forklift traffic, machinery, heat, noise, dust, and chemical storage. Remote travel adds road risk and limited medical access. Information hazards include leakage of unpublished financial plans, personal data of employees or interviewees, and confidential supplier terms. Decision hazards include overstating an achievement, relying on unverified data, and failing to disclose a conflict of interest.

Each engagement starts with a written risk assessment. Rate each hazard as low, medium, or high for likelihood and severity, record the existing control, and assign an owner. Any high rating requires an added control before work begins. Reassess when scope changes, a new site is added, or the client shares sensitive material.

• Site visits, high severity: work at heights, energized equipment, confined spaces, or hazardous storage areas. Control: host induction, restricted zones, escort, and no entry to closed areas.
• Travel, medium to high: remote locations or night driving. Control: itinerary shared with the coordinator, check-in schedule, and vetted transport.
• Information, high: market-sensitive or personal data. Control: classification, encryption, and need-to-know access.
• Public claims, high: sustainability targets, certifications, or performance statements. Control: evidence file, claims register, and legal review.
• Conflicts of interest, medium: advisory work for a firm that also audits or sells to the client. Control: independence declaration and recusal.

4Preventive Controls and Safe Working Practices

Before any site visit, the lead obtains the host's written safety rules, confirms emergency assembly points, identifies any permit-to-work requirement, and agrees a visit plan that limits time in hazardous areas. Staff wear the host's required personal protective equipment, which usually includes safety footwear, high-visibility clothing, and eye protection. If the host requires respiratory protection or fall protection, staff stay out of the area unless trained and fitted by the host or a qualified provider.

Every number used in a deliverable must trace to a source document, an approved data provider, or a documented estimate with its method and uncertainty. A second person checks emissions factors, energy intensity, and workforce statistics using a recorded method. Estimates are labeled as estimates, and any assumption that changes a conclusion is disclosed to the client.

Interviews require consent and care. Interviewers explain the purpose, how notes will be stored, and whether quotes may be attributed. Staff must not pressure employees or community members to disclose matters that could expose them to reprisal, and they must use any whistleblowing channel the client has established.

• Mandatory: no unpublished client financial, pricing, or strategic information may appear in a public or marketing deliverable.
• Mandatory: every quantitative claim has a traceable source or is labeled as an estimate.
• Mandatory: a second reviewer checks every figure in a board paper or public disclosure draft.
• Mandatory: stop work and report any unsafe condition the host has not addressed.
• Recommended: use a site arrival checklist covering exits, first aid location, and emergency contacts.
• Recommended: avoid working alone during remote or after-hours site visits.

5Equipment, Environment, Information, and Protective Safeguards

Equipment in ESG work includes laptops, data collection tools, cameras, mobile devices, and sometimes client-owned meters or sensors. Client instruments may be used only after the owner provides calibration records, operating instructions, and permission. Staff never operate plant equipment, valves, electrical panels, or process controls during a visit. Gas detectors, noise meters, and air quality monitors are used only by trained personnel following the manufacturer's instructions, and the coordinator verifies that those instructions are the current versions.

Store client files only on approved, encrypted systems with role-based access. Remove personal data not needed for the analysis. Do not send client material to unapproved AI tools, personal email, or personal cloud storage. Lock screens when away and avoid discussing confidential findings in public places. Data protection duties depend on jurisdiction and contract, so the security officer confirms the applicable requirements for each engagement.

Ergonomic safeguards matter for long analysis sessions. Follow the firm's workstation guidance, take regular breaks from screens, and use adjustable seating and suitable lighting. This document does not provide medical advice. Staff with health conditions should consult their own health provider and inform the coordinator of any adjustments needed while travelling.

• Mandatory: only approved devices and encrypted storage may hold client data.
• Mandatory: client equipment is used only with documented permission and training.
• Recommended: carry a first aid kit and a charged phone in every vehicle used for site travel.
• Recommended: use privacy screens in open-plan offices and during transit.

6Incident Reporting, Emergency Response, and Escalation

Report any injury, near miss, security incident, unplanned disclosure, unsafe condition, or publication error to the safety coordinator and engagement lead the same working day. Reports are factual and written without blame. They describe what happened, who was involved, immediate actions taken, and potential harm. Near misses are reported because they show where controls are weak.

In a medical emergency, fire, chemical release, vehicle crash, or threat to personal safety, the first priority is to call local emergency services and move people to safety. Follow the host's emergency instructions and assembly point. Do not enter a hazardous area to rescue someone unless trained and equipped to do so. Verify local emergency numbers with the relevant authorities before travel.

Information incidents follow a separate path. If confidential data goes to the wrong recipient, is stored insecurely, or is accessed without authority, stop further sharing, attempt to recall the message, and notify the security officer immediately. Legal counsel decides whether any notification duty applies and what it requires under the law that applies.

• Mandatory: report all injuries and near misses to the safety coordinator.
• Mandatory: if an inaccurate public statement is found, notify compliance immediately and stop further distribution.
• Mandatory: staff who raise a concern in good faith must not face retaliation.
• Recommended: run a tabletop exercise covering a site emergency and a data breach at each engagement cycle.

7Records, Training, Inspection, and Review

Records prove that controls were in place and make learning possible. Keep site induction records, risk assessments, travel plans, training logs, source files, calculation workpapers, claims registers, incident reports, and approval records for the periods required by firm policy and applicable law. Retention periods vary by jurisdiction and contract, so verify them with qualified professionals before disposing of any record.

Training is role-based and refreshed when processes change. Core modules cover these norms, site visit procedures, information classification, conflict declarations, and sustainability claims review. Specialist topics, such as hazardous material handling or engineering assessment, require formal training from qualified providers and are outside this document.

Monitoring is continuous and periodic. The safety coordinator reviews incident trends and site observations, the security officer reviews access logs, and compliance samples published claims against their evidence. Findings lead to corrective actions with an owner and proof of effectiveness. Review these norms whenever a new service line, jurisdiction, or site type is introduced and whenever applicable laws, disclosure standards, or professional rules change.

• Mandatory: maintain a current training log for every person authorized to work on engagements.
• Mandatory: close every corrective action only with evidence that it worked.
• Recommended: share anonymized lessons learned with all staff.

Implementation checklist

• Confirm engagement scope, roles, and authorized signatories in writing.
• Complete a documented risk assessment and assign a control owner for each high rating.
• Obtain host site rules and written permission before any visit.
• Trace every figure and claim to a source, and label all estimates.
• Store client data only on approved, encrypted systems with need-to-know access.
• Declare conflicts of interest and recuse where independence could be affected.
• Report injuries, near misses, and information incidents the same working day.
• Verify emergency numbers, assembly points, and escalation contacts before travel.
• Route public statements through compliance and legal review before release.
• Confirm applicable laws and standards with qualified professionals before relying on them.