Investor ESG due diligence pack (for fundraising and pre-IPO)

Structure (7 sections)

1. 1. Data room structure, access control and version control

   Build the structure before filling it: create a top-level folder per section of this template, and keep three file types in each — a one-page summary (conclusion and current state), the supporting material, and a note on open items. Grant access in stages: summaries only at screening, supporting material once exclusivity begins, with separate permissions, watermarking and access logs for anything involving personal data, customer lists or pending litigation detail. On version control, every externally released figure must come from one set of workpapers (see tmpl-ghg-inventory-workpaper and the annual report), and keep a released-figures register of who received which version and when — different investors holding different numbers is the most common and least recoverable trust failure.

   Evidence to attach

   • · Data room folder structure and file naming convention
   • · Permission matrix (role, stage, visible folders) and access logs
   • · Released-figures register (figure, version, recipient, date, source workpaper)
   • · Watermarking and download control configuration note

   Common pitfalls

   • · Carbon figures and headcount that differ between rounds, prompting an explanation request after cross-checking
   • · Uploading material containing customer names and breaching confidentiality obligations to those customers
   • · Maintaining the pack only during diligence, so everything is stale by the next round

2. 2. Governance and compliance base: organisation, policies and accountable people

   Provide: the corporate governance structure and board composition, oversight arrangements for ESG and compliance, the policy register (data protection, information security, AI governance, anti-corruption, whistleblowing, conflicts of interest, supplier management) with approval dates and latest revisions, the compliance owners and their reporting lines, and the compliance budget and headcount. What investors assess here is whether the governance base can carry growth, so a policy list matters less than "policy plus a recent execution record": one piece of evidence per policy — a training session, an audit, a case handled — builds more confidence than ten unexercised policies.

   Evidence to attach

   • · Governance chart and board/committee composition
   • · Policy register (name, approval date, latest revision, owner) with the policy texts
   • · Most recent execution evidence for each policy
   • · Compliance team headcount, budget and external adviser arrangements
   • · Whistleblowing channel and aggregated handling statistics for the last three years

   Common pitfalls

   • · Policy approval dates clustered in the week after diligence started, which investors spot immediately
   • · Compliance owned by the CTO as a side duty with no dedicated headcount, read as governance that cannot support scaling
   • · A whistleblowing channel with zero cases in three years, which raises doubts about whether it works

3. 3. AI and data compliance: filings, assessments, training data and cross-border transfers

   This is the section where AI company diligence most often goes wrong and where valuation gaps open up. Provide: the AI system and model inventory; the PRC compliance artefacts (security assessment and algorithm filing for generative AI services, the state of content labelling); the training data provenance and rights register; the personal information protection impact assessment and compliance audit conclusions; the cross-border transfer mechanism relied on and its filing status; the EU role determination and the state of the technical documentation; and summaries of model evaluation and red team testing. The investor’s core concern is whether the rights in the data and model assets are clean and whether they could be overturned at IPO or on entering overseas markets — the integrity of the rights chain matters more than the number of compliance documents.

   Evidence to attach

   • · AI system and model inventory (in-house or third party, version, purpose, launch date)
   • · Security assessment and algorithm filing evidence, and the content labelling implementation note
   • · Training data provenance and rights register (authorisations, licence scope, use restrictions)
   • · Personal information protection impact assessment and compliance audit conclusions
   • · Cross-border transfer mechanism documents and filing status
   • · Model evaluation and red team testing summaries
   • · Export control classification assessment where hardware or model weights are involved

   Common pitfalls

   • · A broken rights chain in training data (scraped data without authorisation, third-party datasets whose licence excludes commercial use)
   • · The filing entity differing from the financing entity, with nobody checking whether the filing survives the restructuring
   • · Claiming a fully in-house model when diligence reveals a third-party open-source base with restrictive licence terms
   • · Cross-border transfers running for years without a supporting mechanism, becoming a substantive obstacle at IPO review

4. 4. Carbon and environment: inventory, targets and data reliability

   Provide: greenhouse gas inventories for the last two to three years by scope (with both location-based and market-based figures for Scope 2), the methodology note and factor sources, the boundary and consolidation approach, targets and progress, and energy and water data. Where reduction targets exist, state the basis, base year, coverage and whether they have been externally validated. Where no inventory exists yet, do not evade — set out the current state (what data exists, what is missing) and the plan to close the gap, which is far safer than producing a figure of unclear origin: investors accept "under construction" but rarely accept numbers that do not reconcile and cannot be explained. Hardware and embodied-AI companies should also cover e-waste disposal, hazardous substance restrictions and product compliance (energy efficiency and materials requirements in the applicable markets).

   Evidence to attach

   • · GHG inventory summaries for the last two to three years by scope and basis
   • · Methodology note and emission factor source list
   • · Target documents and progress calculations, with external validation material where held
   • · Energy and water data ledgers
   • · E-waste and hazardous substance compliance material for hardware companies
   • · Data gap list and remediation plan

   Common pitfalls

   • · Disclosing only the market-based Scope 2 to look better, then producing a much higher location-based figure when asked
   • · Carbon figures that contradict each other across financing rounds
   • · Claiming a carbon neutrality commitment with no base year, no coverage and no interim target

5. 5. People and labour: employment compliance, diversity and key person dependency

   Provide: workforce composition (by function, level, region and employment type), pay and social insurance compliance, labour dispute and litigation records, occupational health and safety data, diversity and inclusion data and policies, training and development investment, and key person dependency with retention arrangements (options, non-competes, handover plans). AI companies should additionally describe the scale, compliance arrangements and management of outsourced and crowdsourced labour in data labelling and content moderation — investors now routinely include this in diligence, and avoiding it reads as a risk signal. The ILPA Due Diligence Questionnaire and Diversity Metrics Template are among the de facto standards in private markets, so where an investor works from them you can anticipate the structure of the questions.

   Evidence to attach

   • · Workforce composition and turnover data broken down by dimension
   • · Pay and social insurance compliance checks, and the labour dispute and litigation list
   • · Occupational health and safety data and incident records
   • · Diversity and inclusion policy and metric data
   • · Key person list, retention and non-compete arrangements, and handover plans
   • · Scale and compliance arrangements for outsourced and crowdsourced labour

   Common pitfalls

   • · Historical social insurance or individual tax shortfalls left undisclosed, which hit valuation and closing conditions once found
   • · An outsourced workforce far larger than the payroll headcount, never mentioned in the materials
   • · Extreme key person dependency with no retention arrangement, leading to earn-outs or conditions precedent

6. 6. Supply chain, litigation, penalties and regulatory interactions

   Provide: the key supplier list with dependency analysis, the supply chain diligence policy and its execution records (the outputs of tmpl-supplier-esg-security-ddq), and single-source risk with alternatives; plus the litigation and dispute list, administrative penalties and remediation records, regulatory meetings and correspondence, and any listing on a restricted or control list. On disclosure strategy, list both closed and open matters, with a one-page note for significant ones (facts, current status, potential impact, measures taken). Deliberate omission is the highest-risk choice — investor counsel typically runs independent searches, and an omission that surfaces puts not just that risk but your overall credibility back under review.

   Evidence to attach

   • · Key supplier list with dependency and alternative sourcing analysis
   • · Supply chain diligence policy and recent execution records
   • · Litigation and dispute list (status, amounts, counsel opinion)
   • · Administrative penalty decisions and evidence that remediation completed
   • · Records of regulatory meetings or enquiries and the responses given
   • · Restricted list screening conclusions for the company and key affiliates

   Common pitfalls

   • · Disclosing closed matters only, with open cases found by opposing counsel before closing
   • · A penalty remediated but without completion evidence, so investors treat it as outstanding
   • · A single supplier with an outsized share and no alternative, which becomes leverage in the closing conditions

7. 7. Commitments, remediation plan and post-investment ESG arrangements

   Diligence typically concludes with a remediation and improvement plan both sides accept. Write it so it can be executed: for each item, the current state, target state, milestones, owner, budget and acceptance criteria, separating conditions precedent to closing from post-investment improvements. Also describe the post-investment ESG reporting arrangement: what data the investor receives, how often, and who signs it — many institutional investors have their own annual ESG data requests, and mapping those to your existing ledgers in advance avoids rebuilding the sheets every year. Honesty beats perfection: listing known gaps together with the plan usually closes faster than claiming full compliance, which simply prompts the other side to widen its checks.

   Evidence to attach

   • · Remediation and improvement plan (item, current state, target, milestones, owner, budget, acceptance criteria)
   • · Conditions precedent list with completion evidence
   • · Post-investment ESG reporting arrangement (data items, frequency, signatory, template)
   • · Mapping to the investor’s annual data request
   • · Board approval of the remediation plan

   Common pitfalls

   • · A remediation plan with no budget or owner, untouched a year after investment and damaging the next round
   • · Conditions precedent drafted so broadly that satisfaction cannot be judged
   • · Post-investment ESG data requests on a different basis from your ledgers, forcing quarterly re-compilation