A questionnaire asks "Do you have an environmental policy?" and the honest answer is no — or there is a paragraph in a 2018 employee handbook that nobody has read since.
Before writing anything, establish what the customer is checking for: that a policy exists, that it is signed, that it is current, and that it describes what you actually do. Length is not on the list.
| First question | Short answer |
|---|---|
| Do I need a policy manual? | No. One to four pages per topic, in plain language, signed by senior management. |
| Which policies will I be asked for? | Environmental, health and safety, code of conduct, supplier code of conduct, and sometimes a separate anti-corruption policy. |
| What makes a policy credible? | Specific commitments, a signature, a date, a review cycle, and evidence that it is followed. |
| Can I answer "no" for now? | Yes. "No formal policy; we plan to adopt one by [date]" is a legitimate answer. Claiming a policy you do not have is not. |
| Is there a template? | Yes. The environmental policy is provided below as a Word document. The supplier code of conduct has its own. |
When informal practice is enough
If you have fewer than 20 employees and direct management oversight, many ESG practices can stay informal. Managers know how things work and issues are handled as they arise.
Written policies become necessary when:
- You have more than one site
- You employ more than 50 people
- Customers are asking for policy documents
- You operate in a regulated sector (chemicals, manufacturing, construction)
- Your operations carry significant environmental impact or workforce risk
- You are pursuing a certification (ISO 14001, ISO 45001, B Corp)
For most SMEs in the 50–250 employee range this means documented policies without a management system. One to four pages per topic, written in plain language, signed, and followed.
What assessors check
Customers and assessment platforms judge policies on the same criteria.
Scope. Does it address the relevant topics? An environmental policy covers more than recycling. A safety policy covers more than fire exits.
Specificity. Does it commit to anything? "We are committed to sustainability" commits to nothing. "We track our energy consumption monthly and report emissions annually" commits to two things that can be checked.
Fit. Is it sized for your operations? A 30-person service company does not need a 3,000-person manufacturer's policy, and assessors recognize a copied one.
Currency. When was it last reviewed? A 2017 date suggests neglect. A visible annual review date shows management.
Authorization. Is it signed by leadership? An unsigned document reads as something produced for the questionnaire.
Implementation. Does reality match it? A policy claiming zero tolerance for safety violations is contradicted by the incident log.
The five policies customers ask for
Write them in this order.
1. Environmental policy
Commitment to environmental responsibility and legal compliance; energy and emissions; waste; pollution prevention; who is responsible; how it is reviewed. One to two pages. Template below.
2. Health and safety policy
Leadership commitment; legal framework; responsibilities of management, supervisors, and employees; risk assessment, training, incident reporting and investigation, emergency preparedness; review cycle. If you already have one for regulatory reasons, reference it. Do not write a second one.
3. Code of conduct / ethics policy
Honest and lawful business conduct; anti-bribery and anti-corruption; conflicts of interest; fair dealing with customers, suppliers, and competitors; confidentiality and data protection (GDPR where it applies); how concerns are reported without retaliation; consequences of violations. One to two pages.
4. Supplier code of conduct
Your expectations of your own suppliers: labor standards, health and safety, environment, ethics, compliance, right to assess. The supplier code of conduct template is ready to fill in.
5. Anti-corruption / anti-bribery policy
Usually folded into the code of conduct for an SME. Some platforms ask for it separately: prohibited conduct, gifts and hospitality thresholds, facilitation payments, third-party due diligence, reporting and investigation, consequences, training.
Social and labor commitments — fair wages and hours, no child or forced labor, freedom of association, non-discrimination, a grievance route — are normally covered between the health and safety policy and the code of conduct. If a questionnaire asks for a standalone "human rights" or "people" policy, a two-page document collecting those commitments answers it. Reference the safety policy rather than repeating it.
Do not write a policy for a topic that does not touch your operations. A biodiversity policy for an office-based service firm scores nothing and invites questions.
The template: environmental policy
Customers ask for the environmental policy first, so that is the one provided as a ready document. Placeholders are highlighted in yellow. Replace them, delete any commitment you cannot honestly make, remove the highlighting, sign. If your operations have specific aspects — chemical handling, a vehicle fleet, refrigerants — add one sentence for each. Do not add commitments to impress a questionnaire.
Environmental Policy template for SMEs (.docx)
Commitment, scope, eight concrete commitments, responsibilities, review cycle, signature block, plus a one-page how-to-use note. One to two pages when filled in. Free, no email required.
The commitments section covers legal compliance and permits; measuring electricity, gas, fuel, water, and waste; calculating Scope 1 and 2 emissions annually to the GHG Protocol; named reduction actions; waste separation and licensed hazardous-waste disposal; pollution prevention; purchasing; and employee awareness.
Two notes. The measurement commitments only hold if you measure. If you do not have an emissions figure yet, the free carbon calculator produces a first Scope 1 and 2 number from your utility and fuel bills, so the commitment is true from the day you sign. And the reduction clause should name real actions — "LED lighting replacement across the warehouse, completed 2025; forklift fleet moving to electric by 2027" — not a general aspiration.
Referencing international standards
Questionnaires often ask whether your policies reference the UN Global Compact, the ILO core conventions, the OECD Guidelines for Multinational Enterprises, or the Universal Declaration of Human Rights.
A single sentence is enough. In the code of conduct or people policy: "We are committed to upholding the core labor standards set out by the International Labour Organization." You do not need to list conventions unless you are pursuing a certification. The reference shows you know the norms. It does not claim certification against them.
Writing the rest in a day
Morning. Fill in the downloaded environmental policy. Then health and safety: if one exists for regulatory reasons, check its date, its signature, and whether it still describes what you do; if not, draft it.
Midday. Draft the code of conduct from how you actually handle ethics, conflicts, and concerns. Fold anti-corruption in unless a customer needs it separately.
Afternoon. Fill in the supplier code of conduct template.
End of day. Senior management reviews with one question — is any of this untrue? — then signs. Add version numbers and dates. Save as PDF.
Not required: legal review for basic operational policies (unless a policy creates contractual obligations); board approval where there is no board — owner or MD sign-off is sufficient; a consultant; perfection. A policy that exists and is true beats a perfect one that is never written. Improve it next year.
Policy versus practice
Assessors distinguish three states:
- Policy only. The document exists; implementation is unclear. Some points, limited.
- Policy plus practice. The document exists and evidence shows it is followed. Scores well.
- Practice without policy. You do the right things and have not documented them. Scores poorly, because it cannot be verified.
Expect follow-up questions and have the answers ready.
How is it communicated? "All employees receive the policy at onboarding and it is on our internal system."
How is compliance monitored? "Management reviews energy, waste, and incident figures quarterly and investigates reported concerns."
When was it last reviewed? The date on the document.
What evidence exists? The monthly consumption log, the emissions figure, the training record, the incident register. If the policy commits to tracking energy, the log is the evidence. If it commits to an emissions figure, the calculation is.
Where you have good practice and no policy, write down what you already do. It is faster than drafting aspirations and it is true on day one.
Common mistakes
Copying a generic template without adapting it. A manufacturing environmental policy does not fit a consulting firm. Assessors read enough policies to recognize the source.
Committing to things you do not do. "All employees receive annual safety training" when they do not is audit risk you created.
Undated, unversioned, unsigned. Each costs credibility. All three together read as a document written for the questionnaire.
Policies for their own sake. Write policies only for topics that touch your operations.
Never updating. Put the annual review in the calendar when you sign.
Storing and sharing
Once written, the policies go to employees (handbook, intranet, notice board), to customers on request, and into ESG questionnaires — usually the same five PDFs, many times a year. Review them annually.
ESG Passport keeps them alongside your other evidence and attaches the current version wherever a questionnaire asks, so no customer receives the 2023 file. If you would rather not start from the template, its guided policy builder assembles first drafts from questions about your own practices.
Official References
- ILO Declaration on Fundamental Principles and Rights at Work
- UN Global Compact — the Ten Principles
- OECD responsible business conduct guidance
- ISO 14001 environmental management