ESG due diligence document checklist for a first management review

An ESG due diligence review is more useful when its findings explain the evidence, the unanswered question and the next decision. A long document request or a single traffic-light score can leave management unsure what was actually examined.

This checklist helps a business team scope an initial review before a proposed partnership, transaction or internal decision. It is designed for an agreed document review and management discussion. It is not an exhaustive legal-compliance audit, a site-condition assessment, an investment recommendation or a conclusion that a business is free from ESG risk.

Define the decision and the limits of the review

Write down the proposed decision, the businesses and activities in scope, the review period and the people relying on the findings. Identify exclusions explicitly. A review of one operating company should not be described as a review of the entire group.

Agree the review method: documents only, management interviews, site visits or specialist testing. State whether information will be independently corroborated. Ask who owns the follow-up if an important question cannot be answered before the decision date.

The OECD's responsible-business-conduct guidance describes risk-based due diligence addressing actual and potential adverse impacts across operations and business relationships. It involves more than a one-off transaction review. The checklist here is a focused information-gathering aid; using it does not establish that the wider due diligence process has been completed.

Request context before requesting every policy

Start with the entity structure, locations, activities, principal products, workforce arrangements and significant business relationships. Ask management to identify changes during the review period, including acquisitions, closures, new processes and changes in outsourced work.

Use that context to tailor the request. A warehouse operator and a chemical manufacturer will not need identical evidence. A company with few direct employees may still rely on a substantial contracted workforce. Document the reason for excluding a topic rather than treating silence in the data room as evidence that the topic is irrelevant.

Ask for an index containing the document name, covered entity or site, period, owner and version. This makes it easier to identify an old policy presented as current or a certificate whose coverage does not match the operation under review.

Build a proportionate document request

The following categories are starting points. Select and extend them according to the agreed purpose and operating context:

• Governance: responsibility charts, relevant committee mandates, approved policies and records showing how important issues reach decision-makers

• Environment: relevant operating permissions supplied by management, monitoring records, resource-use data, waste records and unresolved environmental action items

• Health and safety: incident definitions, registers, investigations, inspection findings, corrective actions and evidence of closure

• Workforce: aggregate workforce composition, use of contractors, training coverage and the processes for working conditions and worker concerns

• Business conduct: anti-bribery arrangements, conflicts processes, reporting channels and appropriately restricted summaries of material concerns

• Supply chain: supplier criteria, review records, contractual expectations and follow-up on significant findings

• Reporting and claims: sustainability reports, emissions calculations, target definitions and support for claims made on the website or in sales materials

For each category, ask for evidence of implementation as well as the policy. Keep access proportionate. Personal complaints, medical details and investigation files may require restricted review, redaction or specialist handling. A broad data-room upload is not always the right way to examine them.

For a reusable request format and a worked example of partial or restricted replies, use the ESG due diligence document request list.

Separate evidence gaps from established findings

Use a findings register with a consistent structure:

1. Issue and affected entity, site or activity

2. Documents and interviews reviewed, including dates

3. What the evidence establishes

4. What remains unverified or disputed

5. Potential consequence and why it matters to the stated decision

6. Follow-up question or specialist work required

7. Action owner, target date and closure evidence

Avoid treating “document not provided” as proof of a breach. It can still be an important limitation, particularly where the missing evidence concerns a significant operation. Explain how that limitation affects confidence in the review.

Similarly, a management statement is useful evidence of management's position, but it may need corroboration. Distinguish a stated control from a control whose operation was examined. State the period and sample reviewed so readers do not generalise beyond the work performed.

A hypothetical finding

This example is illustrative and does not describe a Nitium client or transaction.

A company states that safety induction covers its entire workforce. The records provided show induction for direct employees at two sites. Contractor attendance records and records for a third site are unavailable.

A defensible finding would describe the coverage reviewed, identify the missing populations and request the relevant records or another suitable verification step. It would not conclude that every worker was trained, nor that untrained workers were confirmed at the unreviewed site.

The action might be assigned to the operations and HR owners, with the decision-maker told that the company-wide statement remains unsupported by the supplied evidence. Any broader concern about worker safety would require the appropriate operational or specialist assessment.

Prioritise questions that could change the decision

Agree the priority criteria before assigning ratings. Consider the potential severity of an impact, its likelihood where relevant, the strength of available evidence and the decision deadline. Keep impact severity and evidence confidence as separate fields; weak evidence does not make a potentially serious issue low priority.

Escalate matters requiring legal interpretation, environmental testing, engineering expertise or specialist labour and human-rights review to appropriately qualified professionals. Do not turn the absence of a known incident into a conclusion that no risk exists.

Present management with a short findings summary and the underlying register. Separate actions needed before the decision from improvements that can be tracked later, and identify who has authority to accept any unresolved uncertainty. The review team supplies evidence and analysis; management retains responsibility for the business decision.

Agree a useful handover

Nitium provides ESG due diligence support through agreed document reviews, evidence-based findings, follow-up questions and improvement priorities. Discuss your review with its purpose, entity scope and target date. Legal opinions, independent assurance and specialist technical assessments sit outside the advisory services described here.

For ongoing action tracking after a review, our sustainability strategy guide explains how to connect priorities with owners, evidence and measurable progress.

Reviewed 3 October 2026. This checklist is a practical scoping aid and should be adapted to the specific business and decision.