Templates and records · SGE 21 · Clause 6.1.6

SGE 21 environmental, social and governance risk matrix template

The environmental, social and governance risks that could affect the company, how they are categorised and what is done to mitigate them.

In one sentence

The ESG risk matrix identifies, analyses and categorises the organisation’s main environmental, social and governance risks, is reviewed every year and comes with a mitigation plan whose effectiveness is measured, as section 6.1.6 of SGE 21 requires.

Content reviewed on 17 October 2026

Where the standard requires it: SGE 21 · Clause 6.1.6 Sections are cited using the numbering of the October 2024 version of SGE 21, the one Foretica publishes on its website. The Academy groups its nine management areas into six blocks.
Type of information: Mandatory document Identification reviewed every year and a mitigation plan required (6.1.6)
Who fills it in: The system manager with each area The committee checks that the strategy mitigates the risks identified
When: Once a year And whenever the activity, structure or context changes
How long it is kept: Set by the organisation The standard sets no periods. Covering at least the three-year certification cycle, with the initial audit and two surveillance audits, lets you show progress at every visit.

What the standard requires

What SGE 21 demands and what it leaves to your judgement

The standard requires the main environmental, social and governance risks to be identified, analysed and categorised, that identification to be reviewed every year, a mitigation plan to be designed and the effectiveness of the actions to be measured.

The result feeds the sustainability strategy (6.1.5), which must rest on a materiality analysis of impacts, risks and opportunities, and is a mandatory input to the management review (6.1.12).

Read it in context: Organizational governance and ethics, in the SGE 21 Academy

Structure

Fields the template should include

Risk and category: environmental, social or governance
Management area and stakeholder group affected
Likelihood, impact and resulting level
Mitigation action, owner and deadline
Indicator for measuring effectiveness
Measurement result
Annual review date

Example

Example: three risks at the services company (fictitious company)

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Social	Accidents with chemicals at client sites · high level · training and substitution with less hazardous products
Governance	Loss of public contracts through breach of social clauses · high level · quarterly check of clauses
Environmental	Emissions from the fleet of 85 vans · medium level · replacement with electric vehicles in 2026-2028
Effectiveness	Chemical-related accidents: from 9 in 2025 to 3 up to September 2026
Review	Committee meeting of 24 June 2026

At the audit

Mistakes auditors commonly flag

Only financial or quality risks appear.
There is no record of the annual review.
There are actions, but no effectiveness indicator.
The matrix has no connection with the sustainability strategy.

In Kimobox

How this record is kept in Kimobox

1ESG risks are integrated into the same risk register as the quality system.
2Each mitigation action has an owner and a date, with an alert if it falls behind.
3Recurring nonconformities feed into the risk map.
4Effectiveness indicators are tracked on the dashboard.

Frequently asked questions

What people ask us before getting started

Can the ISO 14001 or ISO 9001 risk matrix be used?

It can be the same tool if it is extended to social and governance risks and reviewed every year, as SGE 21 requires.

How does it differ from due diligence?

The matrix looks at the risks that affect the organisation; due diligence (6.1.8) looks at the impacts the organisation has on human rights and the environment. SGE 21 requires both.

Keep your SGE 21 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring

Sources

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

SGE 21. Sistema de Gestión Ética, Sostenible y Responsable (Ethical, Sustainable and Responsible Management System) Forética · October 2024 version