ESG, Digital Governance and the Future of Company Law

Introduction and Context

Company law has traditionally focused on incorporation, capital, directors’ duties, shareholder rights, accountability and the protection of creditors. Contemporary companies, however, operate within ecological, technological and social systems that can materially affect their legal duties, financial performance and legitimacy. Climate change, human-rights risks in global supply chains, cyberattacks, artificial intelligence and digital decision-making have therefore become company-law concerns rather than merely matters of corporate social responsibility.

Environmental, social and governance (ESG) governance concerns how a company identifies, manages, measures and reports its effects and risks. Digital governance concerns the rules, controls and accountability mechanisms governing technology, data and digitally enabled corporate processes. The two fields increasingly overlap. For example, a company may use artificial intelligence to monitor supply-chain emissions, but must also address data quality, privacy, explainability and responsibility for erroneous decisions.

The central legal question is not whether directors must pursue an abstract social good. It is whether directors have properly considered material risks, complied with applicable duties and exercised informed, honest and rational judgment in the interests of the company, while respecting mandatory statutory, regulatory and human-rights obligations. The answer depends on jurisdiction, company type, sector and the applicable legal framework.

Learning Objectives

By the end of this chapter, students should be able to:

• explain ESG, sustainability and climate governance in company-law terms;
• distinguish shareholder primacy, enlightened shareholder value and stakeholder-oriented approaches;
• analyse human-rights and environmental due diligence;
• evaluate purpose-driven companies and integrated reporting;
• identify legal and governance risks associated with cybersecurity, virtual meetings, digital filings and smart contracts;
• assess accountability, bias, privacy and assurance issues in AI-assisted governance; and
• recommend practical governance controls for a contemporary company.

1. ESG as a Company-Law Concern

1.1 Meaning of ESG

ESG is an organising framework rather than a single legal rule.

ESG must not be reduced to a score or public-relations exercise. A high rating may coexist with serious unreported impacts, inconsistent methodologies or weak controls. Directors should distinguish between (1) risks ESG factors pose to enterprise value and (2) impacts the company has on people and the environment. The first is often called financial materiality; the second is impact materiality. Some modern reporting regimes use a double-materiality approach, requiring both perspectives.

1.2 Directors’ duties and sustainability

Common directors’ duties include acting within powers, exercising independent judgment, avoiding conflicts, exercising reasonable care, skill and diligence, and acting in the interests of the company. ESG issues enter these duties when they are relevant to the company’s strategy, resilience, legal compliance, reputation, workforce, financing or long-term prospects.

A board need not predict every future event. It should, however, establish a reasonable process for identifying material risks, obtain appropriate information, challenge management and document its deliberations. A board that ignores an evident climate exposure, known forced-labour allegation or serious cyber vulnerability may face claims based on breach of duty, misleading disclosure, regulatory enforcement or failure of risk oversight.

The business-judgment principle, where recognised, generally protects good-faith decisions made on an informed basis and without improper purpose. It does not protect fraud, conflicts of interest, unlawful conduct or a decision-making process that is irrationally uninformed. Sustainability governance is therefore primarily a question of disciplined process, evidence and accountability.

2. Climate Governance and Sustainability Strategy

2.1 Climate risk categories

Climate-related risks are commonly divided into:

• Physical risks: direct effects such as floods, heat, storms, drought and sea-level rise.
• Transition risks: effects of policy, technology, litigation, consumer preferences and changing markets during movement toward a lower-carbon economy.
• Liability and litigation risks: claims concerning pollution, misleading climate statements, failure to disclose material risks or alleged harm to affected communities.

Climate governance should connect these risks to corporate planning. A board should ask whether assets may become stranded, whether insurance remains available, whether suppliers can operate under changing conditions, and whether public transition claims are supported by credible plans.

2.2 Governance architecture

Effective climate governance normally allocates responsibilities across the board, committees, executives, risk functions, internal audit and external assurance providers. The board may approve a transition strategy, while management implements targets, capital expenditure and operational controls. The allocation must be documented in a committee charter or governance policy.

Useful board questions include:

1. Which climate assumptions are embedded in budgets and valuations?
2. What baseline, boundary and methodology support reported emissions?
3. Are targets absolute or intensity-based, and are offsets being confused with reductions?
4. What happens if the company misses a target?
5. Are executive incentives connected to reliable and controllable sustainability outcomes?

An intensity target measures emissions relative to an output such as revenue or production. It may improve efficiency while total emissions increase. Absolute targets measure total emissions and may provide a clearer picture of aggregate impact. Neither is automatically superior; the choice must fit the business and be clearly explained.

2.3 Greenwashing and assurance

Greenwashing occurs when environmental claims create a materially misleading impression. Risk increases when statements use vague terms such as “green,” “sustainable” or “net zero” without scope, baseline, timeframe or evidence. Claims should be specific, balanced and supported by records. Marketing, investor-relations and legal teams should review claims consistently.

Assurance can increase credibility, but assurance is not a substitute for internal controls. The board should understand the level of assurance, the subject matter covered, materiality thresholds, estimation uncertainty and any qualifications. Sustainability data should have an audit trail comparable, where practicable, to financial data.

3. Human-Rights and Environmental Due Diligence

3.1 From philanthropy to responsibility

Human-rights due diligence is a continuing management process through which a company identifies, prevents, mitigates and accounts for actual and potential adverse impacts. It differs from charitable giving. Relevant risks may include forced labour, child labour, unsafe workplaces, discrimination, land displacement, privacy violations and harms caused by contractors or digital systems.

A robust process usually includes:

1. Policy commitment: board-approved standards aligned with applicable law and recognised international principles.
2. Risk identification: mapping operations, subsidiaries, suppliers, products, customers and affected groups.
3. Prevention and mitigation: contractual requirements, training, redesign, purchasing changes and remediation.
4. Tracking: measurable indicators, audits, worker interviews and incident monitoring.
5. Communication: accurate public reporting and internal escalation.
6. Remediation: accessible grievance channels and appropriate remedy where the company caused or contributed to harm.

Due diligence is risk-based, not merely document-based. A supplier certificate may be evidence but does not prove safe conditions. Audits can miss informal workers, retaliation or subcontracting. Companies should combine documentary review with worker voice, local expertise and credible grievance mechanisms.

3.2 Legal significance

Some jurisdictions impose mandatory due-diligence, modern-slavery, supply-chain, environmental or reporting requirements. Elsewhere, due diligence may arise indirectly through directors’ duties, securities disclosure, consumer-protection rules, procurement conditions, tort principles or contractual obligations. Students must check the law applicable to the company’s jurisdiction and operations rather than assume that a voluntary framework is legally binding.

A company should identify whether it caused, contributed to or is directly linked to an adverse impact. These distinctions influence the appropriate response. Terminating a supplier may sometimes reduce exposure, but it may also abandon workers and worsen harm. Responsible disengagement, remediation and leverage may be more appropriate.

4. Purpose-Driven Companies and Stakeholder Governance

4.1 Competing models

Three broad approaches are useful for analysis:

• Shareholder primacy: directors primarily pursue shareholder interests, subject to law and recognised duties.
• Enlightened shareholder value: directors pursue long-term company success while considering employees, suppliers, customers, communities and the environment.
• Stakeholder or purpose orientation: the company treats a broader set of interests, or an expressly stated social or environmental purpose, as central to its identity and decision-making.

These models are not identical. A company may consider stakeholders because doing so supports long-term value, or because its constitutional documents and legislation make stakeholder interests independently relevant.

4.2 Embedding purpose

Purpose is credible only when embedded in governance. Relevant mechanisms include constitutional objects, benefit-company or community-interest forms where available, a purpose statement approved by the board, stakeholder engagement, impact metrics, remuneration design and reporting. The board should define how purpose affects difficult trade-offs, such as plant closure, product safety, data monetisation or withdrawal from a high-risk market.

Purpose does not eliminate legal accountability. Directors remain subject to statutory duties, insolvency constraints, fiduciary standards and disclosure rules. A purpose statement that promises outcomes beyond the company’s control may create litigation and reputational risk.

5. Integrated Reporting and Accountability

Integrated reporting seeks to explain how an organisation’s strategy, governance, performance and prospects create, preserve or erode value over time. It connects financial information with material non-financial information rather than placing them in separate, disconnected reports.

A useful integrated report explains:

• the business model and resources on which it depends;
• material risks and opportunities;
• strategy and allocation of capital;
• governance and oversight;
• performance against objectives;
• future outlook, assumptions and uncertainties; and
• the basis and boundaries of reported data.

The concept of multiple capitals—such as financial, manufactured, intellectual, human, social and relationship, and natural capital—helps illustrate dependencies. It is a reporting lens, not a licence to assign precise monetary values to every social or ecological effect.

The board is accountable for the integrity of reporting. Management owns preparation; internal control functions test processes; independent assurance may test selected information. Directors should avoid “selective connectivity,” in which positive sustainability achievements are highlighted while adverse information is omitted.

6. Digital Governance and Cybersecurity

6.1 Digital governance

Digital governance is the system by which the board directs and supervises technology, data and digital transformation. It includes strategy, risk appetite, architecture, procurement, resilience, data governance, ethics, compliance and accountability.

The board need not be technically expert in every field, but it must possess or obtain sufficient competence to challenge management. A technology committee may assist, yet delegation does not remove ultimate oversight responsibility.

6.2 Cybersecurity as a governance duty

Cybersecurity is an enterprise risk, not solely an information-technology problem. Threats include ransomware, phishing, credential theft, insider misuse, supply-chain compromise and denial-of-service attacks. Consequences may include operational interruption, privacy liability, regulatory penalties, market loss and harm to customers.

A mature governance programme includes:

• asset inventories and data classification;
• identity and access management, including least privilege and multifactor authentication;
• secure development and change control;
• patching, vulnerability management and monitoring;
• backups tested for restoration, not merely existence;
• incident-response plans with legal, communications and board escalation;
• supplier and cloud-service controls;
• staff training and simulated exercises; and
• post-incident learning and independent review.

The board should know the company’s most important systems, recovery priorities, residual risk and reporting obligations. Concealing a material incident can create greater legal exposure than the incident itself.

6.3 Privacy and data governance

Privacy governance requires lawful purpose, proportionality, transparency, security, retention discipline and respect for data-subject rights, subject to applicable law. Data minimisation is particularly important when companies deploy AI or behavioural analytics. A company should not collect unlimited personal data merely because future uses are conceivable.

Privacy impact assessments, access logs, retention schedules, vendor controls and breach procedures should be integrated into product and governance processes. Cross-border data transfers and employee monitoring may require additional safeguards.

7. Virtual Meetings and Digital Filings

Virtual and hybrid shareholder and board meetings can improve access, reduce cost and support participation. They may also create exclusion, authentication, secrecy and technical-failure risks. The company’s constitution and applicable legislation determine whether fully virtual meetings are permitted and what participation rights must be preserved.

Good practice includes:

• reliable identity verification and voting controls;
• accessible notice, agendas and meeting materials;
• real-time opportunity to ask questions;
• procedures for interruptions and adjournment;
• secure recording and minute retention;
• protection against unauthorised access; and
• equal treatment of remote and physically present participants.

Digital filings improve speed and transparency but create risks of incorrect data, unauthorised submissions, system outages and permanent public disclosure. Filing responsibility should be assigned clearly, with maker-checker review, authentication, deadline calendars and evidence of submission. Automation should not remove human verification of legally significant information.

8. Smart Contracts and Distributed Ledgers

A smart contract is code that automatically performs specified actions when programmed conditions are met. It is not necessarily a legally valid contract. Legal enforceability still depends on agreement, intention, authority, consideration where relevant, legality, certainty and applicable electronic-transactions law.

Distributed-ledger systems may improve traceability and reduce reconciliation, but immutability can conflict with correction, privacy and deletion rights. Code may execute an outcome that is technically correct but legally unjust or commercially unintended. Oracles—systems that feed external facts into code—create a point at which inaccurate data can trigger an automated result.

Before deployment, companies should identify:

• the legally binding text and its relationship to the code;
• parties, authority and applicable law;
• oracle responsibility and data-verification procedures;
• pause, upgrade and dispute-resolution mechanisms;
• cybersecurity and key-management controls; and
• treatment of errors, insolvency and regulatory change.

The phrase “code is law” is a technical description of automatic execution, not a legal conclusion that code replaces law.

9. AI-Assisted Governance

9.1 Uses and benefits

AI may assist with board-paper analysis, scenario modelling, anomaly detection, contract review, regulatory horizon scanning, cyber monitoring and stakeholder-data analysis. It can improve speed and identify patterns that human reviewers miss.

AI should support, not replace, accountable corporate judgment. A board cannot defend an unlawful or harmful decision simply by stating that an algorithm recommended it.

9.2 Accountability and bias

AI accountability requires a named owner, documented purpose, approved data sources, testing, monitoring, escalation and a process for human review. Bias may arise from unrepresentative training data, proxy variables, historical discrimination, measurement choices or unequal error rates. A model that appears accurate overall may perform poorly for a vulnerable group.

A governance review should ask:

1. What decision is being automated or assisted?
2. Who may be harmed by error?
3. Is the use necessary and proportionate?
4. Can the result be explained to affected persons and regulators?
5. What human override and appeal mechanisms exist?
6. How will drift, security compromise and performance change be detected?

9.3 Privacy, intellectual property and confidentiality

Generative AI may expose confidential board papers, personal data or trade secrets to an external provider. It may produce fabricated authorities, inaccurate summaries or output that infringes third-party rights. Corporate policies should restrict sensitive inputs, require approved tools, preserve source verification and prohibit unreviewed use in legal, financial or employment decisions.

AI-assisted minutes and board materials should be checked against primary records. The company should retain sufficient documentation to show what system was used, what data informed the output, who reviewed it and what decision was ultimately made.

9.4 Emerging regulation

AI regulation is developing through risk-based legislation, data-protection law, consumer law, employment regulation, sectoral rules, procurement standards and voluntary frameworks. Some regimes impose duties concerning high-risk systems, transparency, human oversight, impact assessment, incident reporting or prohibited practices. Because obligations differ by jurisdiction and application, a company should maintain a regulatory inventory and conduct change monitoring.

10. An Integrated Governance Framework

A practical framework can connect ESG and digital governance through six stages:

1. Map: identify stakeholders, assets, data, dependencies, impacts and legal obligations.
2. Assess: rank financial, impact, cyber, privacy, human-rights and climate risks by severity, likelihood and vulnerability.
3. Assign: allocate responsibility to the board, committees, executives, control functions and suppliers.
4. Act: implement policies, controls, targets, remediation and resilience measures.
5. Assure: test data, controls and outcomes through internal audit, independent assurance and stakeholder feedback.
6. Disclose and learn: report accurately, correct errors, investigate incidents and update strategy.

This is a governance cycle rather than a one-time compliance project. Risk assessment should be refreshed when the company enters a new market, acquires a business, launches an AI system, changes suppliers or experiences an incident.

Applied Case: Meridian Foods plc (Illustrative)

Background

Meridian Foods plc, a fictional multinational food producer, publishes a “net-zero and ethical sourcing” statement. It uses a cloud platform to collect supplier emissions data and an AI tool to identify high-risk suppliers. Its board meets quarterly through a hybrid format.

Problem

A journalist reports that a tier-two supplier may be using forced labour. At the same time, the AI system has classified the supplier as low risk because the supplier’s digital records were complete. A ransomware attack then disrupts Meridian’s supplier portal. The company’s annual report contains a net-zero target but does not explain its baseline or the role of offsets.

Analysis

The incident raises interconnected issues. First, complete digital records are not proof of ethical conditions; the model may reproduce a documentation bias. Second, Meridian may be directly linked to human-rights harm through its supply chain and must investigate, engage affected workers and consider remediation. Third, the ransomware event tests cybersecurity controls, incident reporting and business continuity. Fourth, the climate statement may be misleading if the target is not measurable or if offsets obscure actual reductions. Finally, directors must show that they received adequate information and challenged management rather than relying mechanically on the AI output.

Approach and solution

The board establishes an independent incident committee and preserves relevant evidence. It instructs management to suspend reliance on the supplier score, commission worker-centred due diligence and protect whistleblowers. It assesses whether Meridian caused, contributed to or is linked to the alleged harm, and develops a remediation plan rather than automatically terminating the supplier.

The company isolates affected systems, activates its response plan, informs legal advisers and assesses notification duties. It resets privileged credentials, restores from tested backups and commissions an independent review. The AI system is subjected to bias and performance testing, with a human escalation rule for high-severity allegations regardless of model score.

Meridian revises its climate disclosure by stating the baseline year, organisational boundary, target scope, reduction pathway, uncertainties and use of offsets. It assigns board oversight to a sustainability and technology committee, introduces maker-checker controls for disclosures and links executive incentives to verified, controllable indicators rather than unverified publicity claims.

Outcome

The fictional company improves its evidence base, reports the cyber incident where legally required, begins remediation with affected workers and publishes a more qualified climate statement. It cannot eliminate all risk, but it can demonstrate a defensible process, clearer accountability and better alignment between purpose, technology and law.

Learning points

• Digital evidence must be tested against lived conditions.
• AI recommendations do not transfer legal responsibility from directors.
• Human-rights due diligence requires remediation and stakeholder voice.
• Cybersecurity, ESG disclosure and supply-chain governance may form one connected risk.
• Credible reporting depends on boundaries, evidence, controls and balanced disclosure.

Challenges and Limitations

ESG and digital governance face several limitations. Standards may differ, making comparison difficult. Non-financial data may be estimated and assurance may cover only selected indicators. Boards may experience information overload or rely on consultants without developing internal competence. Stakeholder interests can conflict, and purpose statements may be too vague to guide decisions. Technology can create an illusion of objectivity, while algorithms may conceal value judgments. Excessive disclosure can also create boilerplate reporting that obscures rather than improves accountability.

Legal fragmentation is another challenge. A company may face different disclosure, privacy, supply-chain and AI obligations across jurisdictions. Directors should therefore maintain a legal-risk register, identify the strictest applicable requirements where appropriate, and obtain local advice for material operations.

Best-Practice Checklist

A company seeking mature governance should:

• place material ESG and technology risks on the board agenda;
• define responsibilities in charters and delegations;
• link strategy, risk appetite, capital allocation and remuneration;
• maintain reliable data lineage and disclosure controls;
• conduct risk-based human-rights and environmental due diligence;
• test cyber resilience and incident-response arrangements;
• protect privacy and confidential information in AI use;
• require human oversight for high-impact automated decisions;
• preserve accessible participation in virtual meetings;
• document smart-contract authority, correction and dispute mechanisms; and
• disclose targets, assumptions, uncertainty and adverse information honestly.

Chapter Summary

ESG and digital governance have become central to company law because environmental impacts, human-rights harms and technology failures can affect legal compliance, corporate value and stakeholder welfare. Directors must exercise informed, careful and accountable judgment rather than treat sustainability or technology as matters delegated entirely to specialists.

Climate governance requires identification of physical, transition and liability risks, credible targets, reliable data and controls against greenwashing. Human-rights and environmental due diligence is a continuing cycle of identifying impacts, preventing and mitigating harm, tracking results, communicating accurately and providing remedy. Purpose-driven companies can embed broader objectives, but purpose does not displace statutory duties.

Integrated reporting connects strategy, governance, performance and future prospects, while assurance and internal controls support credibility. Digital governance covers cybersecurity, privacy, virtual meetings, electronic filings, smart contracts and AI. Automation may improve efficiency, but accountability remains human and organisational. Bias, privacy, explainability, security and regulatory change must be addressed through risk-based controls.

The future of company law is therefore not a choice between financial governance and social or technological governance. It is the development of integrated systems in which directors can demonstrate lawful purpose, reliable evidence, meaningful oversight and responsible decision-making.

Key Terms

ESG: Environmental, social and governance factors relevant to corporate impact, risk and accountability.

Sustainability: The capacity to pursue present objectives without undermining long-term ecological, social or economic conditions.

Climate governance: Board and management processes for identifying and managing climate-related risks and opportunities.

Physical risk: Climate risk arising from direct events or long-term environmental changes.

Transition risk: Risk arising from changes toward a lower-carbon economy.

Greenwashing: A materially misleading impression about environmental performance or benefits.

Human-rights due diligence: A continuing process of identifying, preventing, mitigating, tracking and accounting for human-rights impacts.

Remediation: Measures taken to repair or address harm suffered by affected persons.

Purpose-driven company: A company whose governance expressly incorporates a broader social or environmental purpose.

Stakeholder governance: Decision-making that recognises interests beyond shareholders.

Integrated reporting: Reporting that connects strategy, governance, performance and prospects across financial and non-financial matters.

Cybersecurity: Protection of information systems, networks and data against unauthorised or harmful activity.

Privacy by design: Embedding privacy safeguards into systems and processes from the beginning.

Smart contract: Code designed to execute actions automatically when programmed conditions occur.

Oracle: A mechanism that supplies external information to a digital or smart-contract system.

Artificial intelligence: Computational systems capable of performing tasks commonly associated with human intelligence.

Algorithmic bias: Systematic unfairness arising from data, design, variables or deployment.

Explainability: The ability to provide understandable reasons for an automated system’s output.

Double materiality: Assessment of both the effects of sustainability matters on the company and the company’s impacts on people and the environment.

Review Questions

Short Answer Questions

1. Distinguish financial materiality from impact materiality.
2. Identify three categories of climate-related risk.
3. What are the principal stages of human-rights due diligence?
4. Why does a smart contract not automatically constitute a legally enforceable contract?
5. State two governance risks associated with AI-assisted decision-making.

Long Answer Questions

1. Explain how directors’ duties may require consideration of climate and human-rights risks.
2. Compare shareholder primacy, enlightened shareholder value and stakeholder-oriented governance.
3. Discuss the role of integrated reporting, internal controls and assurance in preventing misleading ESG disclosure.
4. Evaluate the principal governance controls required for a company’s cybersecurity programme.
5. Explain how a company can embed purpose without eliminating legal accountability.

Analytical / Application Questions

1. A company’s AI system rates a supplier as low risk because all required documents are present, but workers allege forced labour. Analyse the company’s due-diligence, AI accountability and remediation responsibilities.
2. A board approves a net-zero statement that gives no baseline, timeframe or explanation of offsets. Advise the board on greenwashing, disclosure controls and governance improvements.
3. A ransomware attack interrupts a virtual shareholder meeting and exposes personal data. Prepare an immediate governance response addressing business continuity, privacy, communication, evidence preservation and board accountability.

Multiple Choice Questions with Answers

Question 1

Which statement best describes double materiality?

A. It measures only the effect of sustainability matters on share price.

B. It considers both how sustainability matters affect the company and how the company affects people and the environment.

C. It requires every social impact to be assigned a precise monetary value.

D. It applies only to cybersecurity disclosures.

Correct Answer: B. It considers both how sustainability matters affect the company and how the company affects people and the environment.

Question 2

Which is a transition risk?

A. Damage to a factory caused by flooding

B. A heatwave affecting worker safety

C. Loss of market access because regulation changes toward low-carbon products

D. Sea-level rise affecting coastal assets

Correct Answer: C. Loss of market access because regulation changes toward low-carbon products

Question 3

What is a central feature of human-rights due diligence?

A. It is performed once at incorporation.

B. It relies exclusively on supplier certificates.

C. It identifies, prevents, mitigates, tracks and accounts for adverse impacts.

D. It automatically requires terminating every high-risk supplier.

Correct Answer: C. It identifies, prevents, mitigates, tracks and accounts for adverse impacts.

Question 4

Why may an environmental claim create greenwashing risk?

A. It contains a specific baseline and methodology.

B. It uses vague language without explaining scope, evidence or timeframe.

C. It is reviewed by the board.

D. It reports an adverse result.

Correct Answer: B. It uses vague language without explaining scope, evidence or timeframe.

Question 5

Which control is most directly associated with reducing unauthorised access to corporate systems?

A. Multifactor authentication

B. A purpose statement

C. Integrated reporting

D. A shareholder resolution

Correct Answer: A. Multifactor authentication

Question 6

What is an oracle in a smart-contract system?

A. A shareholder voting right

B. A system that supplies external information to the code

C. A statutory auditor

D. A method of encrypting board minutes

Correct Answer: B. A system that supplies external information to the code

Question 7

Which statement about AI-assisted governance is most accurate?

A. Directors transfer legal responsibility to the AI provider.

B. An accurate overall model cannot be biased.

C. AI should operate with accountability, testing, monitoring and appropriate human oversight.

D. AI output is automatically confidential and accurate.

Correct Answer: C. AI should operate with accountability, testing, monitoring and appropriate human oversight.

Question 8

What is a key requirement for a fair virtual shareholder meeting?

A. Remote participants must be prevented from asking questions.

B. Only physically present votes may be counted.

C. Remote participants should have meaningful access and participation rights.

D. The meeting must never be recorded.

Correct Answer: C. Remote participants should have meaningful access and participation rights.

Question 9

Which practice best supports reliable digital filings?

A. Allowing one unreviewed person to submit all filings

B. Using maker-checker review, authentication and evidence of submission

C. Deleting filing records after submission

D. Relying solely on automated text generation

Correct Answer: B. Using maker-checker review, authentication and evidence of submission

Question 10

Why is a complete supplier record insufficient proof that human-rights conditions are acceptable?

A. Digital records can never be used in due diligence.

B. Documentation may conceal conditions, subcontracting or worker retaliation.

C. Human rights are unrelated to supply chains.

D. Only financial statements can provide evidence.

Correct Answer: B. Documentation may conceal conditions, subcontracting or worker retaliation.