Is your ESMS fit for purpose?

Social development specialist Ildiko Almasi Simsic highlights how to ensure your company has the environmental and social management systems to screen, identify, and manage operational risks

The market for environmental and social standards, legislation and codes provides thousands of options for companies to follow. The challenge remains incorporating the rules into clearly defined processes that relate to the core operations of the business. Management systems include the company’s policies, procedures and plans to identify, assess, and manage operations related environmental and social risks. In general, when we talk about ESMS (Environmental and Social Management System) we are talking about various aspects of the organisation including quality management systems, environmental management systems, health and safety management systems, risk screening and management, social management systems, knowledge management and document management systems. There could be other, industry specific plans and procedures.

It is important to emphasise that the ESMS should be more than just a collection of documents, it should be the manual by which our operations are governed following the principles of risks screening and mitigation. The overall ESMS can have other underlying plans and policies that go beyond the risk mitigation and address proactive positive impact creation through community development for instance.

Do you follow voluntary standards such as ISO standards covering environmental, quality, social or health and safety management?

Are you audited by third parties for other certifications related to environmental and social risk and impact management?

Where to begin?

You might wonder where to even begin and whether your existing set of documents are sufficient to constitute your ESMS. For new projects, the environmental and social risks are typically identified during the environmental and social impact assessments, whereas for operational facilities we can combine the impact assessment with risks screening to identify key areas that need to be addressed. Once we understand our project or operational E&S risks, we can start developing the management systems.

My observation is that clients generally get overwhelmed with the task of drafting and collating all documents required for a good ESMS. The issue of capacity (both number of people and specialist knowledge) is most likely the first obstacle. In my line of work, there is an E&S Manager that assumes the responsibility of taking charge of the ESMS, but depending on the company size and structure it might be someone else.

The ESMS doesn’t only address policies and management plans, but also capacity required for implementation and the ESMS manual generally has well defined roles and responsibilities. Here are some questions to ask:

Does your company have an operational manual that covers environmental and social risk identification and management?

Does this manual define the roles responsible for the implementation of the different policies, processes and management plans?

Do you have policies, processes and management plans for all E&S risks and impacts identified for your operations?

Good management systems are generally overwhelming to most of my clients because they require an extensively documented elaborate system that covers the topics of environmental management and monitoring, labour and working conditions management, contractor and supplier management, occupational health and safety, community health and safety, resource efficiency, biodiversity, stakeholder engagement and grievance management (both external and workforce complaints).

To add an extra layer of complexity, most of these topics are managed by different departments within the company. HR might be responsible for labour and working conditions, but it is the procurement team that deals with contractor and supplier selection and management. Coordination between the teams is essential to ensure that all our commitments are being implemented. Again, it’s important to ask certain questions, such as:

Are my management plans clearly communicated to departments that are responsible for implementing and updating them?

Is there communication between implementing departments especially for issues that require interdepartmental cooperation (human rights might be within your ESG teams but implementation is through HR (labour) and procurement (supply chain management)?

Check and double check

The ESMS might include operational permits that have expiry dates, version control for operational plans, corrective action plans and activities related to audits or labour inspections. It includes all the forms, templates and logs that are required for your operations. Even if you work in an office, you should have employment records, payroll records, overtime records, supplier audit files, employee grievance register, logs of emergency drills, schedule for life and fire safety inspections and the like. The argument I often hear from clients is that it is common sense to have these documents and they don’t feel the need to spend time (and money) to organise the various documents. The other common issue is the lack of defined procedures in writing. For instance, you might know what to do in case there is fire in your office, but the process is not described in an operational manual. Therefore, the following need to be considered:

Do you have a centralised document including all your operational permits, catalogue of logs, forms?

Do you keep records of audits and inspections including corrective actions and upcoming activities?

If you outsource any of these activities, how aware are you of the activities of your subcontractors?

The ESMS should include monitoring and reporting plans with clear indicators for each of your topics. It is not uncommon to have weekly/monthly inspections and checks for health and safety for instance, but reporting is generally semi-annual or annual. While some reports are disclosed publicly, especially those that relate to ESG or sustainability reports, others remain internal to your company. The reporting should follow the template that is included in the ESMS and provide sufficient context for the reader to assess the implementation of the management plans. This is often missing from reporting I get from clients. The purpose of ESMS implementation monitoring is not only to demonstrate how the activities follow the prescribed policies and processes, but also to highlight any new risks or impacts that might have been observed in the reporting period.

The critical item is how any gaps or corrective actions were addressed and whether the management plan was updated to reflect this. So, you’ll need to factor in the following:

How many annual reports do you prepare? Are these only for public disclosure or do you have internal reporting?

Do you record corrective actions or new risks identified?

Do you include evidence on the implementation of your ESMS? E.g. grievance log and analysis of complaints with resolution, OHS incident and accident statistics with root cause analysis, statistics on emergency drills, life and fire safety inspections.

It must be acknowledged that EU level and national legislation is largely covering minimum requirements for many of the operational E&S risks and impacts. Social topics around human rights, community impacts, community health and safety remain largely free from this governance. International best practice in social risk management provides voluntary standards and processes to capture such risks and address them through the creation of appropriate management plans.

As an example, if your business is developing renewable projects for instance, I would advise you to develop a corporate level management framework for land acquisition, physical and economic displacement, and livelihood impacts. If you think you have the risk mitigation aspects under control, you might want to investigate ways to proactively invest in the community with the aim to provide developmental benefits. This could be in the framework of a community investment plan but also as part of your corporate social responsibility initiatives.

In any case, the process should be defined in writing and should form part of your overall ESMS. Stakeholder engagement and information disclosure is the other, often misunderstood aspect. International best practice requires an ongoing two-way dialogue with your communities, especially if your operations have a significant impact on their well-being (manufacturing, industry, oil & gas, mining, agriculture). You should disclose operational environmental and social risks and explain the processes you put in place to mitigate those. This should be accompanied by a complaints mechanism where you can record feedback, questions, and complaints from your community members. It is important to differentiate customers from communities impacted directly by your operations.

Which management plans under your ESMS are legal requirements and which ones are voluntary standards? Within your management plans what are the legally required minimum standards and what are additional efforts?

Are you familiar with international best practice in stakeholder engagement and information disclosure? Are you implementing the principles of the two-way ongoing dialogue with your affected communities?

Do you have a complaints mechanism? Do you disclose its existence and record feedback systematically in the complaints register?

Seek good counsel

If you have doubts about the quality and adequacy of your ESMS, I suggest you seek professional help from environmental and social performance practitioners. They use a detailed checklist with questions to understand your operational environmental and social risks, risk screening and assessment and adequacy of existing management plans. They can help with addressing any gaps within existing management plans, as well as designing new plans to ensure you comply with the necessary standards.