Picture a board meeting where someone asks, “Do we have an ESG policy?” and the room goes quiet. If that has happened to you, take a breath. It is a common moment, and it is fixable. Most companies we speak with are doing good work on emissions, people and governance. What they lack is a single document that says so, names who is accountable and gives the board something to approve.
An ESG policy is a board-approved document that sets out how your company manages its environmental, social and governance responsibilities: what you commit to, who is accountable, and how progress is measured and reported. This guide explains what it covers, what to include, how it connects to corporate ESG reporting, what each GCC country expects, and when it makes sense to bring in an ESG reporting consultant.
What is an ESG policy?
ESG stands for environmental, social and governance. Investors, lenders, regulators and large customers use these three lenses to judge risks that a balance sheet does not show.
An ESG policy turns those lenses into commitments. It is different from an ESG strategy and an ESG report:
- The policy states what you commit to and who is accountable.
- The strategy sets targets, priorities and the roadmap to deliver on them.
- The report discloses your performance to stakeholders.
Without the policy, the strategy has no mandate and the report has nothing to be measured against.
The three pillars in plain language
Environmental
How your company uses resources and affects the planet. A policy usually covers energy use, greenhouse gas emissions (Scope 1, 2 and 3), water, waste, and how climate-related risks affect the business. It also covers where capital goes, such as investment in cleaner energy and efficiency.
Social
How your company treats the people it depends on: employees, customers, suppliers, communities and shareholders. Typical topics are health and safety, fair pay, diversity and inclusion, supplier standards and data privacy.
Governance
How your company is run. This covers board structure and independence, transparency with stakeholders, ethics and anti-corruption, risk management, and a constructive relationship with regulators. A stable, accountable board is what makes the other two pillars credible.
What a strong ESG policy includes
| Section | The question it answers | What to write |
|---|---|---|
| Purpose and scope | Why do we have this, and who does it cover? | The business reasons, and which entities, sites and suppliers are in scope. |
| Commitments | What do we promise on each pillar? | A short list per pillar, specific enough to be tested. |
| Roles and oversight | Who is accountable? | Board owner, executive sponsor and a named lead for each metric. |
| Targets and metrics | How will we know it is working? | The material metrics, baseline year and review dates. |
| Data and reporting | How do we collect and disclose? | Data owners, the reporting framework (GRI, IFRS S1 and S2, SASB or a local exchange guide) and publication timing. |
| Supplier expectations | What do we ask of partners? | Minimum standards and how you will check them. |
| Review and approval | How does it stay current? | Board approval, an annual review and a version history. |
Keep it short enough that people read it. A policy nobody opens does not change behaviour.
Why an ESG policy matters
- Lenders and investors ask for it. ESG questionnaires from banks and investors usually start with governance and policy. A clear policy shortens those conversations.
- Regulators and exchanges expect governance behind disclosure. If a company discloses ESG data, someone must own the numbers. The policy records who.
- It lowers risk. Written commitments and named owners reduce the chance that a claim in a report cannot be supported, which is the root of greenwashing exposure.
- It aligns people. Employees and customers can see what the company stands for, and managers know what they are accountable for.
From policy to corporate ESG reporting
A policy only earns its keep when it feeds the numbers. The chain is simple: the policy names the commitments, the commitments define the material metrics, the metrics need an owner and a data process, and the data process produces the report.
That is why corporate ESG reporting works best when the policy comes first. Your policy should say who owns each disclosure, and the regional section below shows what applies in your market. Our ESG reporting services page explains how the reporting side is built.
ESG policy requirements by region: GCC, UAE, Qatar, Oman, Bahrain and Saudi Arabia
There is no single GCC rulebook. Each country sets expectations through its own regulator, exchange or central bank, so a policy that works in Dubai may need an extra clause in Doha or Muscat. Rules and dates in this region have changed quickly. Treat this section as a map, and confirm the current text for your listing status and sector. Regulatory information reviewed October 2026.
GCC-wide
The GCC Exchanges Committee has published 29 voluntary ESG metrics (10 environmental, 10 social and 9 governance) as a common base for the region. IFRS S1 and S2 from the ISSB are increasingly the reference framework for regulators. A group policy that names these two anchors travels well across borders.
UAE
Listed companies disclose sustainability information under the Securities and Commodities Authority (SCA) governance framework, and ADX and DFM each publish ESG reporting guidance for issuers. Separately, Federal Decree-Law No. 11 of 2024 has applied since 30 May 2025. It requires in-scope entities, including free-zone companies, to measure, inventory and report greenhouse gas emissions, and it gave businesses one year to adjust their status.
What your policy should say: name the board owner for emissions data, state which exchange or authority guidance you follow, and commit to an annual review.
Qatar
The rule depends on your regulator. The Qatar Central Bank (QCB) requires the banks and insurers it licenses to follow ISSB-based reporting for periods starting 1 January 2026, with a phased start. The QFMA Governance Code, issued in 2025, sets sustainability reporting and ESG disclosure expectations for listed companies, with different treatment for the Main and Secondary Markets. A bank that is also listed can face both.
What your policy should say: record which regulator each entity answers to, give IFRS S2 climate data a named owner, and set the review date ahead of your reporting cycle.
Oman
Companies listed on the Muscat Stock Exchange (MSX) must publish ESG disclosures under Administrative Decision 77/2025, against 30 ESG metrics, with board approval and publication on both the MSX platform and the company website. Separately, the Financial Services Authority (FSA) has adopted IFRS S1 and S2 under Decision E/7/2026, phased in from annual periods beginning 1 January 2029, with Scope 3 emissions from 2030.
What your policy should say: name who at board level approves the annual disclosure, and state that negative information is disclosed to the same standard as positive information.
Bahrain
Bahrain Bourse updated its listing rules in November 2024. Mainboard issuers must maintain a framework for ESG reporting and submit an ESG report within six months of financial year-end, either as a stand-alone document or inside the annual report. The rules align with the Central Bank of Bahrain (CBB) ESG requirements, which also apply to CBB licensees.
What your policy should say: fix a reporting calendar that lands the ESG report inside the six-month window.
Saudi Arabia
The Saudi Exchange (Tadawul) ESG guidelines encourage listed companies to disclose voluntarily and follow the UN Sustainable Stock Exchanges model guidance. The Capital Market Authority (CMA) has set disclosure expectations for issuers of green, social, sustainability and sustainability-linked debt, and the Saudi Central Bank (SAMA) has issued ESG guidance for financial institutions. For most listed companies, sustainability reporting is largely voluntary today, while expectations are rising with ISSB alignment. Confirm the current CMA position before you plan.
What your policy should say: name the framework you will follow voluntarily, because lenders and investors will ask.
One group policy, local annexes
If you operate in more than one country, write one group policy and add a short annex for each jurisdiction that lists the regulator, framework, deadline and owner. The policy stays stable while local rules change.
When to bring in an ESG reporting consultant
You can write a first policy in house. Outside help earns its fee when the policy has to connect to a framework, a regulator or an assurance review. An ESG reporting consultant is useful when:
- You report to more than one regulator or framework and need them reconciled.
- Your data sits across teams and no one owns the whole picture.
- A lender or investor will test your numbers.
- Your team has not produced a report before and the deadline is fixed.
ESG consulting services cover a wide range, from a policy review to a full report. Match the scope to the problem you have.
How to choose an ESG advisory firm or sustainability reporting company
Ask any firm you are considering:
- Which frameworks and regulators do you work with in my market? Look for named experience with GRI, IFRS S1 and S2, SASB and the exchange or central bank rules that apply to you.
- Who does the data work, and who owns it afterwards? Avoid a report your team cannot repeat next year.
- Will the output stand up to a lender or assurance review? Ask how each number is traced to a source.
- How do you handle gaps? An honest baseline with stated gaps is worth more than polished estimates.
- What is handed over? You should keep the policy, the data templates and the method.
D1 Percent is an ESG advisory firm working with companies in the UAE, India, Qatar and the wider GCC. We start with scoping: which rules apply to you, what the policy must cover, and what to do first.
Three mistakes that weaken an ESG policy
- Copying another company’s policy. Their material issues are not yours, and reviewers can tell.
- Writing commitments you cannot measure. Every commitment should be specific and backed by a metric you can trace. Vague claims invite greenwashing scrutiny.
- Treating it as a one-off. A policy with no review date is out of date within a year.
A practical next step
If you are drafting your first ESG policy, or testing one against what a lender or regulator will ask, talk to an ESG reporting consultant at D1 Percent. We will review where you stand and tell you what to fix first.
Frequently asked questions
What is an ESG policy?
An ESG policy is a board-approved document that sets out how a company manages environmental, social and governance responsibilities, who is accountable, and how progress is measured and reported.
What is the difference between an ESG policy, an ESG strategy and an ESG report?
The policy states commitments and accountability. The strategy sets targets and the roadmap to meet them. The report discloses performance. The policy comes first because the other two depend on it.
Is an ESG policy mandatory?
No single rule makes a document called an “ESG policy” mandatory everywhere. However, exchanges, regulators, lenders and investors ask about ESG governance and policies, so most companies that report need one. Check the rules that apply to your listing status, sector and jurisdiction.
Who should write and approve an ESG policy?
A senior sustainability, finance or governance lead usually drafts it, with input from HR, operations and procurement. The board should approve it, so accountability sits at the top.
What does an ESG reporting consultant do?
An ESG reporting consultant helps you decide what to disclose, set up the data process, align the report to a framework such as GRI or IFRS S1 and S2, and prepare it for review by lenders, investors or assurance providers.
How do I choose an ESG advisory firm?
Look for named experience with the frameworks and regulators in your market, a clear answer on who owns the data after the project, a method that traces each number to a source, and a handover that lets your team repeat the work.
Do small and mid-sized companies need an ESG policy?
If a lender, investor or larger customer asks for ESG information, yes. A short policy with clear owners and a few material metrics is enough to start, and it can grow with the business.
How often should an ESG policy be reviewed?
At least once a year, and whenever your business, your regulator or your reporting framework changes. Record the review date and version in the document.
Is ESG reporting mandatory in the GCC?
It depends on the country, your listing status and your sector. Oman, Bahrain and Qatar set mandatory ESG disclosure expectations for listed companies or regulated financial institutions, the UAE combines SCA governance rules with a federal emissions-reporting law, and Saudi Arabia relies mainly on voluntary guidelines for most listed companies. Check the current text for your regulator.
Does Saudi Arabia require ESG reporting?
The Saudi Exchange ESG guidelines encourage voluntary disclosure by listed companies. The CMA sets disclosure expectations for issuers of green, social, sustainability and sustainability-linked debt, and SAMA has issued ESG guidance for financial institutions. Alignment with IFRS S1 and S2 is expected to matter more over time, so confirm the current position with the CMA.
What ESG rules apply to companies in Oman and Bahrain?
In Oman, companies listed on the Muscat Stock Exchange must publish ESG disclosures against 30 metrics under Administrative Decision 77/2025, and the FSA has adopted IFRS S1 and S2 on a phased timeline from 2029. In Bahrain, Mainboard issuers must submit an ESG report within six months of financial year-end under the Bahrain Bourse listing rules, which align with CBB requirements.
Do we need a different ESG policy in each country?
Usually no. Write one group policy and add a short annex for each country that lists the regulator, framework, deadline and owner. This keeps the policy stable while local rules change.