What OSH governance means in ESG
Occupational safety and health governance defines who decides, what information and resources support decisions, how risks are supervised and how performance is accounted for. Within environmental, social and governance criteria, OSH is particularly connected with working conditions and the quality of organisational decisions.
It involves more than adding an accident rate to a sustainability report. Useful governance connects policy with procurement, projects, maintenance, contracting and work organisation. It allows the organisation to check whether commitments become practical controls and whether exposed people can influence those controls. A well written policy does not by itself demonstrate that these arrangements work or that the information reaching management reflects actual conditions.
Responsibilities and decision rights
Management needs to understand significant risks and allocate resources, while operational functions implement and maintain controls within their remit. Occupational prevention specialists provide technical advice within their competence; having that support does not automatically transfer every business decision to the adviser.
It is useful to define who approves change, who can stop an operation, who checks a correction and how unresolved issues are escalated. Responsibilities need real authority and resources. In Spain, allocating functions does not remove the employer’s protective duty or make legal liability automatically inferable from an organisational chart. Liability depends on applicable rules and the facts of the case. A title alone is not a substitute for examining actual decisions and conduct.
Materiality, exposure and reporting boundaries
Analysis should identify impacts on people and relevant organisational risks or opportunities under the reporting framework being used. An activity involving few people can still present a severe potential harm; workforce size is not the only prioritisation criterion. The included sites, activities and populations should be explained.
Employees, external workers and value chain workers may need different treatment. Denominators, controls and sources should not be combined without clarification. Financial consolidation boundaries do not necessarily capture every OSH impact connected with operations. Disclosing an exclusion helps readers understand a limitation; it does not show that the excluded exposure has disappeared. Decisions about reporting coverage should therefore be distinguishable from decisions about preventive action.
Participation and escalation of problems
Information from workers and their representatives helps compare management’s view with actual tasks. Participation channels need to be accessible, enable hazard reporting and provide responses. Consultation is particularly useful before equipment, work pace or contracting arrangements change working conditions.
An escalation system defines what happens if a correction is delayed, a responsible manager disagrees or a significant risk remains. The board or senior management need not review every individual observation, but should address patterns and decisions beyond the site’s capacity. Follow up should verify resolution and effectiveness without blaming people who report problems for making indicators appear worse. Reporting volume requires interpretation rather than an automatic assumption that fewer reports mean better conditions.
Turning risk findings into resources and controls
Governance adds value when findings become decisions: withdrawing equipment, redesigning a task, improving extraction, adjusting staffing or strengthening maintenance. Each action needs an owner, deadline, resources and a verification criterion. Administrative closure of a task does not necessarily remove the exposure that prompted it.
Projects and investments should record risks prevented through design and those remaining. Controls should follow the applicable preventive priorities instead of relying exclusively on training and personal equipment. Where a proposal is postponed, interim risk control needs to be clear. Budget constraints do not automatically make conditions contrary to protective duties acceptable. Management review should test whether delayed actions remain tolerable under the actual operating conditions.
Outcome measures and preventive indicators
Work related injuries and ill health provide information about harm, but have limitations: rare events, latency, classification differences and underreporting can distort comparisons. Exposure measures, critical control performance and problem resolution can complement them. An initial rise in reports may reflect greater trust in the system rather than deteriorating conditions.
Every rate should identify its numerator, denominator, scaling factor, period and population. “Zero accidents” without working hours or contractor coverage offers limited interpretability. Preventive indicators also need quality: counting inspections does not establish that they detected risks or produced effective measures. Selection should correspond to the activity’s priority hazards rather than whichever numbers are easiest to retrieve from the database.
Sources: [2]
Data quality and confidentiality
Defensible data needs a definition, source, owner and traceability to the original record. Consolidation should detect duplicates, boundary changes, missing information and differences between sites. When a definition changes, its effect on comparisons over time should be explained and the version used in each report retained.
Clinical information requires specific protection. In Spain, individual medical data should not be indiscriminately added to management dashboards; legally appropriate preventive conclusions and suitable aggregated results are communicated instead. Small groups also require care to avoid identifying individuals. Digital records can support consistency but do not guarantee accuracy, confidentiality or compliance merely because software is used. Access and quality controls still need accountable owners.
Contractors and due diligence
Business relationship assessment should address significant OSH impacts and the ability to prevent, mitigate or contribute to remedying them according to the circumstances. A generic supplier declaration is insufficient on its own. Information about critical tasks, exchanged risk information and checks proportionate to the activity may be needed.
Due diligence and coordination of preventive activities are related but are not interchangeable and do not have identical legal scope. A corporate supplier report does not replace coordination between companies sharing a workplace. Governance should connect site findings, contracting decisions and action follow up, preventing risk from disappearing from reports when a task is outsourced. The nature of the organisation’s relationship with an impact matters when selecting a response.
GRI, ESRS and applicable obligations
GRI 403 provides a specific OSH reporting framework. ESRS form part of European sustainability reporting requirements for undertakings within scope. Using one does not automatically demonstrate compliance with the other: scope, materiality, definitions and the applicable financial year require review. Receiving a customer’s questionnaire does not automatically subject a small business to the entire reporting system.
At the review date, 8 November 2026, the 2026 European reforms require a distinction between adopted texts and applicable provisions. Delegated Regulation 2026/1563 has an effect date of 10 November 2026 and its own application and transitional rules. The legal check must be updated for the reporting year rather than presenting future requirements as already universal.
OSH measures in sustainability-linked financing
In sustainability-linked instruments, certain financial characteristics may depend on achievement of agreed objectives. ICMA’s voluntary principles for these bonds distinguish KPI selection, target calibration, instrument characteristics, reporting and verification. They are not a general legal obligation or a guarantee of access to finance.
An OSH KPI should be relevant, measurable and verifiable, with a comparable baseline and rules for boundary changes. A low accident rate can reflect hours, activity mix or underreporting and is insufficient on its own. Economic consequences, exceptions and verification conditions belong in the relevant contractual documentation reviewed by specialists. The usefulness of an indicator for internal prevention does not automatically make it an appropriate contractual financial trigger.
Sources: [4]
What investors and external reviewers can examine
A financial counterparty may request evidence about risks, responsibilities, targets and performance, but criteria vary by instrument and mandate. The company should explain the origin and limitations of its figures and the actions supporting its objectives. Financing an environmental project and linking financial terms to performance indicators should not be presented as identical structures.
External review has a defined scope: verification of a KPI does not certify all company safety arrangements or predict freedom from accidents. The reviewed period, population and methodology need to be clear. A preventive improvement alone cannot be claimed to cause cheaper capital, a better ESG rating or access to a fund; contractual conditions and other factors also influence those outcomes.
Management review example
In a hypothetical example, an industrial group sees its accident rate fall after outsourcing maintenance. Before presenting this as improvement, it reviews the boundary and discovers that contractor hours and events were not compared consistently. It reconstructs the series that can be substantiated and explains the information still missing.
Management then reviews equipment isolation, training and outstanding defects, allocating resources to specific controls. If it considers an OSH financing target, it uses the corrected baseline and requires verification rules. The example illustrates a governance decision: avoiding favourable conclusions without evidence, retaining transparency and maintaining preventive measures even when an aggregate indicator appears to improve. It is not a claim about any actual company’s financial result.
Frequently asked questions
Does a low accident rate guarantee finance?
No. Coverage, exposure, data quality and instrument terms need assessment. Financing access and pricing depend on multiple factors.
Does a GRI report demonstrate ESRS compliance?
Not automatically. Each framework has scope, requirements and definitions that need checking for the relevant financial year.
Does verifying a KPI certify all prevention?
No. Verification is limited to its defined scope, period and methodology; it does not establish the safety of every operation.
Does outsourcing remove impacts from the analysis?
Not necessarily. Coverage needs definition and significant business relationship impacts require attention under the applicable framework and responsibilities.
