How to Organise ESG Evidence for Faster Questionnaire Responses

The answers to most ESG questionnaires are not the hard part. The hard part is finding the evidence. You know your business has an environmental policy. You know someone renewed the ISO 14001 certificate. But when a deadline is three days away and you need the actual documents, that knowledge turns into a scavenger hunt across shared drives, email attachments, and colleagues' desktops.

Organising your ESG evidence is the single highest-leverage thing you can do to cut questionnaire response time. It takes about half a day to set up. After that, it turns a 3-day scramble into a 2-hour task.

What counts as ESG evidence?

Evidence is any document that supports a claim in a questionnaire response. It falls into six types:

Policies. Environmental policy, health and safety policy, anti-bribery policy, modern slavery statement, data protection policy, supplier code of conduct. Under the Bribery Act 2010 and UK GDPR, some are legally required regardless of questionnaires.

Certificates. ISO 14001, ISO 9001, ISO 45001, Cyber Essentials, B Corp — third-party certifications with defined validity periods. These are your strongest evidence.

Quantitative data. Carbon emissions, energy consumption, waste tonnage, accident rates (RIDDOR-reportable incidents), diversity statistics, training hours. Sources include utility bills, waste transfer notes, and HR system exports.

Audit reports. SMETA audit reports, ISO surveillance audits, internal H&S inspections, fire risk assessments.

Plans and targets. Carbon reduction plan (required under PPN 06/20 for major government contracts), net zero commitment, diversity strategy.

Legal and registration documents. Companies House certificate, ICO registration, employers' liability insurance (required under the Employers' Liability (Compulsory Insurance) Act 1969), professional indemnity insurance.

A folder structure that works

A well-structured shared drive folder, mapped to the five standard ESG categories, means you always know where to look.

ESG-Evidence/
├── 01-Environment/
│   ├── Policies/
│   ├── Certificates/
│   ├── Data/
│   └── Audit-Reports/
├── 02-Social/
│   ├── Policies/
│   ├── Certificates/
│   ├── Data/
│   └── Audit-Reports/
├── 03-Governance/
│   ├── Policies/
│   ├── Certificates/
│   └── Data/
├── 04-Supply-Chain/
│   ├── Policies/
│   └── Assessments/
├── 05-Company-Overview/
│   ├── Registration/
│   ├── Insurance/
│   └── Certifications/
└── _Evidence-Register.xlsx

The numbered prefixes keep folders in order. The _Evidence-Register.xlsx (underscore pushes it to the top) is your master tracking document.

Naming conventions

Use this format:

[Category]-[Type]-[Description]-[Version]-[ExpiryDate].[ext]

Examples:

• ENV-CERT-ISO14001-v1-2027-03-15.pdf
• SOC-POLICY-HealthAndSafety-v3-2026-09-01.pdf
• GOV-POLICY-AntiBribery-v2-2027-01-15.pdf
• ENV-DATA-CarbonEmissions-FY2024-25.xlsx

The expiry date in the filename lets you see at a glance which documents need renewal without opening them.

The evidence register

The master list of every document in your evidence pack, with these columns:

Column	Purpose
Document name	Full filename including version
Category	Environment / Social / Governance / Supply Chain / Company Overview
Evidence type	Policy / Certificate / Data / Audit Report / Plan / Legal
File location	Folder path or link
Expires	Date it needs renewing
Owner	Person responsible for keeping it current
Last checked	Date someone verified it was still current

Sort by expiry date. Set a quarterly reminder to review. A typical SME evidence pack contains 25 to 40 documents — entirely manageable. The VSME data checklist covers the specific data points that VSME-aligned questionnaires are likely to request.

Expiry tracking

Certificates and policies have finite lifespans. ISO certificates run for 3 years with annual surveillance audits. Insurance renews annually. Policies should be reviewed at least annually — and buyers check the review date.

When a customer finds an expired certificate or a policy last reviewed in 2023, it undermines the credibility of your entire submission.

Track expiry dates in two places: in the filename and in the evidence register. Set calendar reminders 90 days before each expiry — enough time to arrange renewal audits or update policies without deadline-driven panic.

Version control

Three rules prevent the common problem of submitting outdated documents:

One location per document. Each document lives in one folder. No duplicates. If someone needs it, they access it from the canonical location.

Version numbers in filenames. When you update a policy, increment the version. Keep previous versions in an _Archive subfolder — never delete old versions, as you may need to demonstrate change history to an auditor.

The register is the single source of truth. If it says the environmental policy is v3, that is the version you attach to questionnaires.

Evidence by category

Here is what to collect for each area — covering 80%+ of questionnaire requirements.

Environment: Environmental policy (dated, signed), ISO 14001 certificate, annual carbon emissions (Scope 1 and 2, using GHG Protocol), energy data (kWh), waste data (tonnes and recycling rate), carbon reduction plan, renewable energy contract or REGO certificates.

Social: H&S policy, accident records (RIDDOR reports, lost-time injury rate), modern slavery statement (mandatory for £36M+ turnover under the Modern Slavery Act 2015 s.54, voluntary for others), diversity data, training records.

Governance: Anti-bribery policy (Bribery Act 2010), whistleblowing policy, data protection policy and ICO registration, Cyber Essentials certificate, code of conduct.

Supply chain: Supplier code of conduct, supplier assessment documentation, key supplier audit reports.

Company overview: Companies House certificate, employers' liability insurance, organisational chart, certifications held.

The half-day setup

Hour 1: Create the folder structure and evidence register. Agree the naming convention.

Hour 2: Collect all policies. Rename, file, and log them. Note which are missing or need updating.

Hour 3: Collect certificates, insurance, and registration documents. Check expiry dates.

Hour 4: Collect quantitative data — emissions, energy, waste, accident rates. Note gaps (you will need utility bills from your energy supplier and waste transfer notes from your waste contractor).

At the end, you know what you have, what is missing, and when each document expires. For a structured approach to handling the questionnaire itself, see the step-by-step response guide.

---

AnswerVault is being built with evidence management at its core — document storage linked directly to facts, expiry tracking with automated reminders, and evidence bundled into questionnaire exports. Join the waitlist to be notified when it launches.