Enterprise Controls Framework for the Sustainability domain — the optimised set of process controls that give effect to its technical controls.
24 process controls, grouped by sub-policy and shown in full six-level lineage with operational artifacts.
CAO-900 Sustainability
CAO-910 Code of Ethics and Conduct
CAO-900 Sustainability › CAO-910 Code of Ethics and Conduct › CAO-911 Ethics and Corporate Citizenship › CAO-9111 Govern ethics and responsible corporate citizenship › CAO-91111 Ethical conduct and responsible corporate citizenship governed across the organisation.
CAO-911111 · Examine the code of ethics and governance arrangements to confirm ethical conduct is governed.
Method: Examine · Expected evidence: Code of ethics and ethics oversight records
Operational controls: CAO-9111112 Ethics Oversight Register · CAO-9111111 Code of Ethics — template
CAO-900 Sustainability › CAO-910 Code of Ethics and Conduct › CAO-911 Ethics and Corporate Citizenship › CAO-9112 Prevent, detect and disclose corruption and bribery › CAO-91121 Anti-corruption prevention, detection, training and incident handling operated
CAO-911211 · Examine the anti-corruption programme, training coverage and incident records
Method: examine / interview · Expected evidence: training records; incident log
Operational controls: CAO-9112111 Anti-Corruption Programme Register
CAO-920 Sustainability Reporting and Disclosure
CAO-900 Sustainability › CAO-920 Sustainability Reporting and Disclosure › CAO-921 Reporting Governance and Oversight › CAO-9211 Govern sustainability reporting with defined body oversight, competence and incentives › CAO-92111 Sustainability reporting oversight roles, competence and incentive linkage documented and operated
CAO-921111 · Examine governance records to confirm body oversight, competence and incentive linkage for sustainability reporting
Method: examine / interview · Expected evidence: oversight minutes; competence matrix; incentive-scheme linkage records
Operational controls: CAO-9211111 Sustainability Governance Record
CAO-900 Sustainability › CAO-920 Sustainability Reporting and Disclosure › CAO-921 Reporting Governance and Oversight › CAO-9212 Embed sustainability due diligence in strategy and operations › CAO-92121 Sustainability due diligence embedded across strategy, business model and operations
CAO-921211 · Examine the due-diligence statement mapping to confirm coverage of the core due-diligence elements
Method: examine · Expected evidence: due-diligence statement; process records
Operational controls: CAO-9212111 Sustainability Due Diligence Record
CAO-900 Sustainability › CAO-920 Sustainability Reporting and Disclosure › CAO-921 Reporting Governance and Oversight › CAO-9213 Maintain risk management and internal controls over sustainability reporting › CAO-92131 Risk management and internal controls operated over the sustainability reporting process
CAO-921311 · Examine reporting-risk assessments and evidence of control operation over sustainability reporting
Method: examine / test · Expected evidence: reporting risk register; control test records
Operational controls: CAO-9213111 Sustainability Reporting Controls Register
CAO-900 Sustainability › CAO-920 Sustainability Reporting and Disclosure › CAO-922 Materiality and Strategy › CAO-9221 Conduct and maintain a double materiality assessment of impacts, risks and opportunities › CAO-92211 Double materiality assessment performed and maintained across own operations and the value chain
CAO-922111 · Examine the materiality assessment method, stakeholder inputs and resulting material IROs
Method: examine / interview · Expected evidence: materiality assessment record; IRO register
Operational controls: CAO-9221111 Double Materiality Assessment Register
CAO-900 Sustainability › CAO-920 Sustainability Reporting and Disclosure › CAO-922 Materiality and Strategy › CAO-9222 Disclose strategy, business model and stakeholder interests as they bear on sustainability › CAO-92221 Strategy, business-model and stakeholder-interest disclosures prepared and current
CAO-922211 · Examine strategic-context disclosures against the required elements
Method: examine · Expected evidence: strategy and stakeholder context records
Operational controls: CAO-9222111 Strategy and Stakeholder Context Record
CAO-900 Sustainability › CAO-920 Sustainability Reporting and Disclosure › CAO-923 Sustainability Statement Preparation › CAO-9231 Prepare and publish the sustainability statement, complete and comparable › CAO-92311 Sustainability statement prepared to the required structure, qualitative characteristics and time horizons
CAO-923111 · Inspect the sustainability statement for completeness, comparability and disclosure-requirement coverage
Method: examine · Expected evidence: sustainability statement; disclosure index
Operational controls: CAO-9231112 ESRS Disclosure Index · CAO-9231111 Sustainability Statement (template)
CAO-900 Sustainability › CAO-920 Sustainability Reporting and Disclosure › CAO-923 Sustainability Statement Preparation › CAO-9232 Apply minimum disclosure quality to policies, actions, metrics and targets › CAO-92321 Minimum disclosure requirements applied to policies, actions, metrics and targets for material topics
CAO-923211 · Confirm each material topic's policies, actions, metrics and targets meet the minimum disclosure content
Method: examine · Expected evidence: disclosure quality checklist
Operational controls: CAO-9232111 Disclosure Quality Checklist
CAO-930 Environmental Sustainability
CAO-900 Sustainability › CAO-930 Environmental Sustainability › CAO-931 Climate Change › CAO-9311 Manage climate change mitigation and adaptation › CAO-93111 Climate transition plan, policies, actions, targets and carbon-pricing arrangements established and resourced
CAO-931111 · Examine the transition plan, action plans and target records against the climate disclosure requirements
Method: examine · Expected evidence: policy, action and target records
Operational controls: CAO-9311111 Climate Transition Plan and Targets Register
CAO-900 Sustainability › CAO-930 Environmental Sustainability › CAO-931 Climate Change › CAO-9312 Measure and disclose climate metrics and financial effects › CAO-93121 Energy, GHG (Scopes 1, 2, 3), removals and anticipated financial effects quantified per the required methodologies
CAO-931211 · Test the GHG inventory and energy metrics for boundary and methodology conformance
Method: examine / test · Expected evidence: metric derivations and source data
Operational controls: CAO-9312111 GHG Inventory
CAO-900 Sustainability › CAO-930 Environmental Sustainability › CAO-932 Pollution › CAO-9321 Manage pollution prevention and control › CAO-93211 Pollution policies, actions and targets established and resourced
CAO-932111 · Examine pollution policies, action plans and target records
Method: examine · Expected evidence: policy, action and target records
Operational controls: CAO-9321111 Pollution Management Register
CAO-900 Sustainability › CAO-930 Environmental Sustainability › CAO-932 Pollution › CAO-9322 Measure and disclose pollution metrics and financial effects › CAO-93221 Air, water and soil emissions and substances of concern quantified and disclosed
CAO-932211 · Examine emissions data and substances-of-concern inventories
Method: examine / test · Expected evidence: metric derivations and source data
Operational controls: CAO-9322111 Emissions and Substances-of-Concern Register
CAO-900 Sustainability › CAO-930 Environmental Sustainability › CAO-933 Water and Marine Resources › CAO-9331 Manage water and marine resource use › CAO-93311 Water and marine policies, actions and targets established and resourced
CAO-933111 · Examine water policies, action plans and target records
Method: examine · Expected evidence: policy, action and target records
Operational controls: CAO-9331111 Water Resources Register
CAO-900 Sustainability › CAO-930 Environmental Sustainability › CAO-933 Water and Marine Resources › CAO-9332 Measure and disclose water metrics and financial effects › CAO-93321 Water consumption and anticipated financial effects quantified and disclosed
CAO-933211 · Test water consumption metrics for methodology conformance
Method: examine / test · Expected evidence: metric derivations and source data
Operational controls: CAO-9332111 Water Consumption Register
CAO-900 Sustainability › CAO-930 Environmental Sustainability › CAO-934 Biodiversity and Ecosystems › CAO-9341 Manage biodiversity and ecosystem impacts › CAO-93411 Biodiversity transition consideration, policies, actions and targets established and resourced
CAO-934111 · Examine biodiversity plans, action records and targets
Method: examine · Expected evidence: policy, action and target records
Operational controls: CAO-9341111 Biodiversity Action Register
CAO-900 Sustainability › CAO-930 Environmental Sustainability › CAO-934 Biodiversity and Ecosystems › CAO-9342 Measure and disclose biodiversity metrics and financial effects › CAO-93421 Biodiversity impact metrics and anticipated financial effects quantified and disclosed
CAO-934211 · Examine biodiversity impact metrics and their derivation
Method: examine / test · Expected evidence: metric derivations and source data
Operational controls: CAO-9342111 Biodiversity Impact Metrics Register
CAO-900 Sustainability › CAO-930 Environmental Sustainability › CAO-935 Resource Use and Circular Economy › CAO-9351 Manage resource use and circular economy › CAO-93511 Circular-economy policies, actions and targets established and resourced
CAO-935111 · Examine circular-economy policies, action plans and target records
Method: examine · Expected evidence: policy, action and target records
Operational controls: CAO-9351111 Circular Economy Register
CAO-900 Sustainability › CAO-930 Environmental Sustainability › CAO-935 Resource Use and Circular Economy › CAO-9352 Measure and disclose resource-flow metrics and financial effects › CAO-93521 Resource inflows, outflows and anticipated financial effects quantified and disclosed
CAO-935211 · Examine resource-flow data and derivation methods
Method: examine / test · Expected evidence: metric derivations and source data
Operational controls: CAO-9352111 Resource Flows Register
CAO-940 Social Sustainability
CAO-900 Sustainability › CAO-940 Social Sustainability › CAO-941 Own Workforce › CAO-9411 Manage own-workforce conditions, rights, engagement and remediation › CAO-94111 Own-workforce policies, engagement processes, remediation channels, actions and targets established
CAO-941111 · Examine workforce policies, engagement and remediation records
Method: examine / interview · Expected evidence: workforce policies; engagement and remediation records
Operational controls: CAO-9411111 Workforce Policies and Engagement Record
CAO-900 Sustainability › CAO-940 Social Sustainability › CAO-941 Own Workforce › CAO-9412 Measure and disclose workforce characteristics and outcomes › CAO-94121 Workforce characteristics, diversity, wages, safety and development metrics quantified and disclosed
CAO-941211 · Test workforce metrics for methodology and coverage
Method: examine / test · Expected evidence: workforce metric derivations
Operational controls: CAO-9412111 Workforce Metrics Register
CAO-900 Sustainability › CAO-940 Social Sustainability › CAO-942 Value-Chain Workers › CAO-9421 Manage and disclose value-chain worker impacts › CAO-94211 Value-chain worker policies, engagement, remediation, actions and targets established and disclosed
CAO-942111 · Examine value-chain worker impact management records
Method: examine · Expected evidence: value-chain worker impact records
Operational controls: CAO-9421111 Value-Chain Worker Impact Register
CAO-900 Sustainability › CAO-940 Social Sustainability › CAO-943 Affected Communities › CAO-9431 Manage and disclose impacts on affected communities › CAO-94311 Affected-community policies, engagement, remediation, actions and targets established and disclosed
CAO-943111 · Examine community impact management records
Method: examine · Expected evidence: community impact records
Operational controls: CAO-9431111 Community Impact Register
CAO-900 Sustainability › CAO-940 Social Sustainability › CAO-944 Consumers and End-Users › CAO-9441 Manage and disclose impacts on consumers and end-users › CAO-94411 Consumer and end-user policies, engagement, remediation, actions and targets established and disclosed
CAO-944111 · Examine consumer impact management records
Method: examine · Expected evidence: consumer impact records
Operational controls: CAO-9441111 Consumer Impact Register
