- An ESG policy is a commitment, not a measurement system. It states what the company promises on its material environmental, social and governance issues, who is responsible and how the board will check. The framework measures it and the report discloses it.
- Kenyan companies are already asked for one. The CMA code expects listed companies to publish their ESG policies and how they apply them, and from 2027 IFRS S2 asks how climate responsibilities appear in mandates and policies.
- Six sections do the work: purpose and scope, commitments on material issues, roles and responsibilities, expectations of suppliers and partners, monitoring and grievances, and approval and review.
- The board signs the overarching policy; management owns the rest. Topic policies and procedures sit beneath it, each approved at the level that controls the work.
- Naming an owner is the easy part. In a 2026 benchmark of 105 companies, 90% named accountable senior managers, but only 22% said how the work was resourced.
Most ESG policies fail the same test: nobody outside the sustainability team can say what the policy commits them to. An ESG policy is the document in which a company states its commitments on the environmental, social and governance issues that matter most to its business, who is responsible for each one and how the board will check that they are kept. It is short, signed at the top and specific enough that a manager, a supplier or an auditor could be held to it.
In the ESG governance work we have done with Kenyan boards since 2019, the first ESG policy is rarely written for the company itself. It is written for whoever is asking: a lender's due diligence checklist, a European buyer's supplier questionnaire or the line in the CMA code that asks listed companies to disclose their ESG policies. A policy written to satisfy a request tends to promise what the requester wants to read, and to leave out who will do the work.
That gap will soon show in public. This article explains what an ESG policy is and how it differs from a framework, why Kenyan companies need a written one before 2027, the six sections it should contain, and who should approve each layer of the policies beneath it.
What an ESG Policy Is
Three documents get called "our ESG framework", and they do different jobs:
- The ESG policy says what the company commits to on its material issues, who is responsible and how the board will oversee it. It changes rarely and is approved at the top.
- The ESG framework is the measurement system behind the policy: which issues are tracked, how each figure is defined and counted, who collects the data and what the targets are.
- The ESG report discloses what happened in the year, against the policy's commitments and the framework's measures.
The policy comes first because the other two depend on it. A framework without a policy measures things nobody has committed to, and a report without one has nothing to report against.
An ESG policy framework is the set of policies that hangs from that top document. Most companies already have several of them: a health and safety policy, an anti-bribery policy, a procurement policy, perhaps an environmental policy written for an ISO certification. The overarching ESG policy ties them together, states which issues each one covers and makes clear that they answer to the same commitments. The UN Guiding Principles on Business and Human Rights describe the same structure for human rights: a statement of policy approved at the most senior level and "reflected in operational policies and procedures necessary to embed it throughout the business enterprise".
Why Kenyan Companies Need a Written ESG Policy
For many Kenyan companies, a written ESG policy is already expected. What changes in 2027 is that the expectation moves into the annual report, where investors and auditors will read it.
- Listed companies. The Capital Markets Authority's governance code for listed companies says the board "shall ensure that the company discloses its environmental, social and governance policies and implementation thereof in its annual report and website". The code works on an apply-or-explain basis, so a company without a policy must say why.
- Public interest entities from 2027. Under ICPAK's adoption roadmap, listed companies, banks, insurers, pension schemes and other public interest entities apply IFRS S1 and S2 for periods beginning on or after 1 January 2027. IFRS S2's governance disclosures ask how responsibility for climate-related risks and opportunities is reflected in "terms of reference, mandates, role descriptions and other related policies", as ICPAK's technical bulletin sets out. The policy becomes evidence in a published report.
- Banks. The Central Bank of Kenya's climate risk guidance puts the board and senior management in charge of setting climate risk "strategies, policies, procedures, guidelines" and minimum standards.
- Companies with development finance. Lenders that follow the IFC's Performance Standards ask borrowers for an overarching environmental and social policy.
ICPAK's own data suggests some companies are closer than they think. In its 2026 readiness report, commercial banks had the highest share of entities whose ability to disclose ran ahead of their stated strategy, at 25.9%. ICPAK's advice to them was to formalize that capability "through board approved sustainability reporting policies". Some Kenyan companies are doing more than their paperwork shows, and a written policy is how they get credit for it.
The International Finance Corporation's Performance Standard 1 requires the companies it finances to set an overarching policy on environmental and social objectives. The policy must name who will ensure conformance and who will carry it out, and it must be communicated to all levels. A lender reading your policy is looking for names, not values.
6 Sections Every ESG Policy Needs
A good ESG policy fits on three or four pages. Its length matters less than whether each section commits someone to something they can be checked on.
1. Purpose and scope
Say why the policy exists and what it covers: which companies in the group, which sites, which activities and whether it extends to contractors. State which standards it is written against, such as IFRS S1 and S2 or the GRI Standards, and which laws it sits under. A group with operations in Kenya, Uganda and Tanzania should say whether one policy covers all three or each subsidiary adopts its own.
2. Commitments on your material issues
List the commitments, one per material issue, in plain language. They should come from your materiality assessment, not from a list of everything ESG can cover. "We will reduce diesel use at our plants" commits the company to something; "we are committed to environmental stewardship" does not. Compliance with the law is the floor, so a policy that only promises to obey regulations has not yet said anything.
3. Roles and responsibilities
Name the roles, not just the board. The overarching responsibility sits with the board or a board committee; the CEO is accountable for delivery; each material issue has an executive owner; a sustainability lead coordinates. The Nairobi Securities Exchange's ESG manual sets out this split for listed companies, with a board committee overseeing sustainability and a management committee chaired by the CEO. Write it down so that a new director or a new plant manager can see where they fit.
4. Expectations of suppliers and partners
State what the company expects of the businesses it buys from and works with, and what it will do to help them meet it. Most large companies have learned the first half. The World Benchmarking Alliance's latest Corporate Human Rights Benchmark found that 87% of companies build human rights expectations into supplier contracts, but only 39% commit to responsible purchasing practices, such as paying on time and agreeing realistic prices. A supplier squeezed on price and paid late cannot fund the standards its buyer's policy asks of it.
5. Monitoring, reporting and grievances
Explain how the company will know whether the commitments are being kept: which measures the framework tracks, how often management reports to the board and where the results are published. Include a route for complaints, whether from staff, communities or suppliers, and say who handles them. The CMA code asks listed companies to disclose their ESG policies "and implementation thereof", so a policy without a monitoring section leaves the second half of that disclosure blank.
6. Approval, communication and review
Record who approved the policy and when, how it will be communicated to staff and business partners, and when it will next be reviewed. This section is the shortest and the one most often missing. Without it, nobody knows whether the policy on the website is current.
The Nairobi Securities Exchange's ESG disclosures manual explains that external assurance tests reported information against suitable criteria, which can be a published standard or a publicly disclosed company policy, such as an environmental and social management policy on the company's website. A specific, public policy gives the assurer something to check your report against.
Source: Nairobi Securities Exchange, ESG Disclosures Guidance Manual (2021)
Who Should Sign the ESG Policy
The overarching ESG policy should be approved by the board. The UN Guiding Principles set "the most senior level of the business enterprise" as the standard for a policy commitment, and the NSE manual states that the board retains overall accountability for ESG performance and disclosure. A policy signed only by the sustainability manager tells staff it is the sustainability manager's project.
The board should not sign everything, though. The NSE manual gives the CEO the job of setting "policies and directives to guide management of material ESG issues". A workable split is to approve each layer at the level that controls the work:
| Document | What it sets | Who approves it | When it is reviewed |
|---|---|---|---|
| Overarching ESG policy | Commitments, scope, roles and the review cycle | The board, on the recommendation of its sustainability or strategy committee | Once a year, before the annual report |
| Topic policies | The rules for one issue, such as health and safety, anti-bribery, human rights or the supplier code | The CEO or executive committee, reported to the board | When the law, the risk or the business changes, and at least every three years |
| Procedures | How the work is done day to day | The executive who owns the issue | Whenever the work changes |
Signing, however, is the easy part. Data from the World Benchmarking Alliance's 2026 Corporate Human Rights Benchmark, which assessed 105 companies in five high-risk sectors, shows how far responsibility on paper runs ahead of responsibility in practice. Nine in ten companies named the senior managers accountable for human rights, and 94% described how day-to-day responsibility was spread across departments. Only 33% linked senior managers' incentives to their human rights commitments, and just 22% described how resources and expertise were allocated for the work in their own operations, falling to 19% for supply chains.
Human Rights Accountability Practices Disclosed by 105 Companies in High-Risk Sectors, 2026
Share of companies disclosing each practice. Source: World Benchmarking Alliance, 2026 Corporate Human Rights Benchmark, submission to the UN Working Group on Business and Human Rights
Day-to-day responsibility assigned: 94%. Senior managers named: 90%. Pay linked: 33%. Resources described for own operations: 22%, and for supply chains: 19%.
Each bar is the share of all 105 companies that disclosed that practice. A company can appear in several bars, so the bars do not add up to 100%.
The pattern holds well beyond human rights. A policy that names an owner but gives them no budget, and no reason in their pay to care, assigns blame rather than responsibility. When the board approves the policy, it should approve the resources in the same meeting.
In the World Benchmarking Alliance's 2026 benchmark, companies with formal board oversight of human rights were about 4.5 times as likely to tie pay to human rights performance. The 19 that both resourced the work and linked incentives averaged 71.9 points, against 49.6 for the rest. Oversight matters most when it reaches the budget and the bonus.
Is your ESG policy ready to be read in your 2027 annual report?
Our Strategic Planning program includes ESG governance work with boards and executive teams: setting commitments from your material issues, assigning owners and budgets, and drafting a policy the board can approve and the business can follow. Request a proposal.
From First Draft to Board Approval
The order matters more than the drafting. A policy written before the company knows its material issues has to be rewritten once it does.
- Start from the materiality assessment. The commitments in section 2 should map one to one onto the issues the assessment kept.
- Draft with the owners, not for them. Each executive who will own an issue should write or rewrite that commitment, so the policy promises only what someone has agreed to deliver.
- Test it with the people who will read it. A lender, a large customer and a group of staff from operations will each find a different gap.
- Take it through the board committee first. The committee checks the commitments against strategy and risk appetite and recommends it to the full board.
- Approve the policy and its resources together. Record the approval, the date and the next review in the policy itself.
- Publish and communicate it. Put it on the website, brief managers on what it asks of their teams and send it to key suppliers with what will change for them.
Skipping steps to meet a lender's deadline is how companies end up with the borrowed policy described below.
Three Common ESG Policy Mistakes
The borrowed policy
The company adopts a template, a peer's policy or its parent group's policy with the names changed. A Kenyan subsidiary that adopts a European parent's policy unchanged may commit itself to measures it cannot produce and miss the issues that matter most locally, such as water at a plant in Nakuru or labor conditions among smallholder suppliers. Use a template for structure, never for commitments.
The policy with owners but no budget
Every commitment has a name against it and none has money or time. The benchmark data above shows how common this is. Ask each owner, before the board approves the policy, what they need to deliver their commitment, and put the answer in the budget.
The policy nobody reviews
The policy is approved once, published and left alone while the business, the risks and the rules move. By the time a lender or an assurer reads it, it describes a company that no longer exists.
The Central Bank of Kenya's 2021 climate risk guidance expects banks to have documented policies and procedures for climate-related risks, and to review them, with the internal controls around them, regularly to keep pace with a changing environment. For a Kenyan bank, a policy approved once and never revisited already falls short of the regulator's expectation.
Source: Central Bank of Kenya, Guidance on Climate-Related Risk Management (2021)
Frequently Asked Questions
What is an ESG policy?
An ESG policy is the document in which a company states its commitments on the environmental, social and governance issues that matter most to its business, who is responsible for each one and how the board will check that they are kept. It is short, approved at the top and specific enough that managers, suppliers and auditors can be held to it.
What is the difference between an ESG policy and an ESG framework?
The policy states what the company commits to and who is responsible. The framework is the measurement system behind it: which issues are tracked, how each figure is counted, who collects the data and what the targets are. The report then discloses the year's results against both. An ESG policy framework is the overarching policy together with the topic policies, such as health and safety or anti-bribery, that sit beneath it.
Do Kenyan companies have to publish an ESG policy?
Listed companies are expected to. The CMA governance code asks the board to ensure the company discloses its ESG policies and how it applies them in the annual report and on its website, on an apply-or-explain basis. From 2027, public interest entities reporting under IFRS S2 must also explain how responsibility for climate-related risks is reflected in mandates, role descriptions and related policies.
What should an ESG policy include?
Six sections: purpose and scope; commitments on each material issue; roles and responsibilities from the board to the issue owners; expectations of suppliers and business partners; monitoring, reporting and a route for complaints; and a record of who approved the policy, how it is communicated and when it will be reviewed.
Who should approve an ESG policy?
The board should approve the overarching ESG policy, usually on the recommendation of its sustainability or strategy committee, because the UN Guiding Principles set approval at the most senior level as the standard. Topic policies can be approved by the CEO or executive committee and reported to the board, and procedures by the executive who owns each issue.
How often should an ESG policy be reviewed?
Review the overarching policy once a year, before the annual report, so the published version matches what the company is doing. Topic policies should be reviewed when the law, the risk or the business changes, and at least every three years. The Central Bank of Kenya already expects banks to review their climate risk policies regularly.
Conclusion
An ESG policy is short, and that is the point. It should say what the company promises, who delivers each promise and how the board will know. Everything else belongs in the framework and the report.
Pick any commitment in your ESG policy. Can you name the person who owns it, the budget it draws on and the date the board last checked it?
If any of the three answers is missing, our Strategic Planning program can help your board and executive team rebuild the policy before it appears in your first IFRS report. Request a proposal and we will start from the commitments you already have.
