# Amnaya policies and operating practices DRAFT v0.1 - NOT ADOPTED | 5 November 2026 Effective date: not set. Entity-by-entity lawful adoption and local/sector review required. ## P01 Governance, authority and independent challenge Owner: Entity governing body / policy coordinator Keep legal authority, owner decisions and independent scrutiny clear across a small team and a multi-project group. ### Proposed clauses - The lawful governing body approves entity strategy, risk appetite, capital commitments and adoption of this manual. An advisory council or working committee cannot replace statutory directors, shareholder rights or local law. - Adopt an entity-specific delegation schedule naming roles, monetary limits, currencies, aggregation periods and reserved matters. A draft role label grants no authority; no new commitment is permitted solely because it appears in a planning tool. - Reserve equity/debt issuance, guarantees, entity formation, related-party arrangements, material acquisitions/disposals, major litigation settlements and exceptions to approved risk appetite to the authorised governing body. - Require a preparer and a separate reviewer for commitments, payment releases and material claims. Where a small team cannot segregate duties, engage a disinterested external reviewer and document the compensating control. - Disclose actual/potential conflicts before deliberation; record recusals, quorum, dissent, conditions and decision expiry. No interested person approves their own transaction or investigates a complaint about themselves. ### Practices - Before Day 7: map legal entities, appoint accountable persons and independent challenge, and record which proposed roles remain vacant. - Weekly: venture leads review delivery and exceptions. Monthly: management reviews cash, policy gaps and material risks. Quarterly: the governing body reviews capital, sustainability and control failures. - Within 2 business days of a decision: file minutes, evidence-pack version, authority and conditions. Reconfirm delegations annually and on personnel/entity changes. ### Evidence - Entity and ownership map; signed delegation and reserved-matters schedule - Decision/conflict/recusal register; committee terms of reference - Policy adoption resolution; quarterly oversight minutes ### Indicators - 100% of material decisions have an authority and evidence reference - 100% of declared conflicts have an independent disposition - Overdue conditions: count and age, reviewed monthly ### Critical holds - No valid authority or quorum - Unmanaged conflict or self-approval - Unlawful instructions, regardless of founder or commercial support ### Alignment Amnaya roles and reserved matters are proposed and require entity-specific adoption. S1/S2 governance disclosures may draw on these records when material and applicable. SDG targets: 16.6, 16.7, 17.16 Sources: CG, OECD ## P02 Venture creation, investment and portfolio discipline Owner: Investment decision owner / venture lead Build repeatable ventures with operational support, evidence gates and bounded capital at risk. ### Proposed clauses - Use the Data Centres, Centre of Excellence and Venture Laboratory as evidence, review and execution workstreams. Every project needs an accountable sponsor, problem statement, customers/beneficiaries and a defined operating entity. - Separate origination, feasibility, preparation, authorised pilot, scale and exit/hold decisions. Apply Amnaya gates on Days 7/21/42/56/70/84/100; these dates are Amnaya planning conventions. - Approve only the next bounded commitment, with runway, sources/uses, downside and stop criteria. Record portfolio concentration by sector, territory, counterparty, currency and correlated exposure. - Assess unit economics appropriate to the model: customer acquisition and cohort retention for platforms; contracted output, utilisation and lifecycle costs for assets; quality, safety and service outcomes for healthcare. Do not impose a universal software growth KPI on all sectors. - Shared finance, technology, hiring and procurement support require a service scope, charge basis and conflict review. Preserve IP, competition rules, patient/worker safety and customer trust when adapting a business model. ### Practices - Before Gate 21: retain at least eight sources, segment evidence, alternatives and disconfirming findings; replace illustrative quotas with an approved sampling plan. - Before Gates 42 and 56: review three economic scenarios, technical design, territory/sector applicability, permission evidence and an instrumented measurement contract. - Monthly: refresh the portfolio register and liquidity forecast. Trigger an owner review at >10% scope-adjusted budget variance, a breached runway floor or any critical hold; these are proposed internal triggers, not automatic stop/approval rules. ### Evidence - Investment memo with scenario model, source quotes and exit/hold case - Gate decisions and authorised pilot scope; shared-service agreements - Portfolio exposure table and 13-week cash forecast ### Indicators - 100% of live pilots have a recorded permission decision - 100% of proposed commitments show downside and funding source - Track approved versus actual cost, runway and evidenced outcomes separately ### Critical holds - Critical licence, safety or participant permission unresolved - Funding gap for the authorised work package - Material evidence misrepresentation or unsupported scale decision ### Alignment The evidence tests, allocation limits and 100-day schedule are original Amnaya proposals. Target-level SDG contributions require project evidence. SDG targets: 8.3, 9.5, 12.6 Sources: OECD, CG ## P03 Integrity, anti-bribery, conflicts and fair competition Owner: Compliance lead / independent reviewer Make commercial conduct honest, competition fair and improper influence unacceptable. ### Proposed clauses - Prohibit bribery, kickbacks, facilitation payments, extortion arrangements, falsified records and retaliation for refusal. A political-risk allowance or local custom cannot legitimise an improper payment. - Review agents, beneficial ownership, public-official connections, success fees and payment destinations before engagement. Pay only against documented lawful services to a verified authorised account. - Maintain gifts/hospitality and conflict registers. Cash, cash-equivalents, quid-pro-quo benefits and benefits during a live procurement/approval decision are prohibited; other thresholds require an adopted local schedule and pre-approval. - Compete independently. Do not share competitively sensitive pricing, allocate markets, rig tenders or misuse another firm's confidential information. Seek specialist review before joint bidding or competitor collaboration. - Record donations, sponsorships and lobbying transparently with lawful authority; no political or charitable payment may disguise a commercial inducement. Preserve evidence and cooperate with lawful investigation. ### Practices - Before onboarding and renewal: perform risk-based counterparty checks, conflict declarations, written terms and account verification independent of emailed change requests. - Quarterly: review high-risk agent fees, gifts, public-sector interfaces and unresolved red flags; train relevant staff at induction and annually. - Immediately: stop suspect payment or conduct, preserve records and notify the designated independent reviewer; assess reporting obligations without promising an automatic legal conclusion. ### Evidence - Counterparty/beneficial ownership and red-flag review - Gifts, conflicts, sponsorship and agent register - Training attestations; investigation/approval record ### Indicators - 100% of high-risk counterparties reviewed before engagement - 100% of gifts/conflicts recorded within the adopted reporting window - Track substantiated cases, remediation and retaliation separately; zero reports is not proof of integrity ### Critical holds - Bribe, facilitation payment or unlawful inducement - Unresolved ownership/payment red flag - Bid-rigging, concealed conflict or falsified service evidence ### Alignment UNGC anti-corruption and OECD business-integrity/competition references inform the baseline. Amnaya screening workflows and monitoring targets are proposed controls, not regulator certifications. SDG targets: 16.5, 16.6 Sources: UNGC, OECD ## P04 Human rights, decent work and inclusive employment Owner: People lead / site safety lead Respect people in own operations and value chains, with fair work, safety and access to remedy. ### Proposed clauses - Prohibit forced labour, trafficking, child labour, harassment and unlawful discrimination. Apply the applicable minimum-age and hazardous-work rules and credible age checks; prevent recruitment fees or retention of identity documents. - Respect freedom of association, collective bargaining and safe/healthy work. Provide understandable contracts, lawful pay/hours/leave, worker representation and safe reporting without retaliation. - Assess salient human-rights risks by severity and affected people, not only financial exposure. Consult workers, vulnerable groups and relevant communities in accessible languages and formats. - Use fair, documented recruitment and pay criteria. Review equal-pay and accessibility issues with lawful, proportionate data handling; do not publish identifiable employee data or treat demographic targets as quotas overriding fair treatment. - Prevent and mitigate adverse impacts, use leverage with suppliers and provide/cooperate in remedy where appropriate to the relationship. Child-labour remediation protects the child rather than simply terminating access to income without a safe plan. ### Practices - Before site/vendor approval: perform labour and safety risk screening and confirm recruitment arrangements, emergency provisions and a usable complaint route. - Monthly: inspect high-risk work and contractor conditions; reconcile wage/hour evidence using appropriate sampling and worker consultation. - Quarterly: review recruitment, pay, accessibility, training and unresolved rights impacts. Immediate danger triggers stop-work and local emergency escalation. ### Evidence - Human-rights/salient-impact assessment; worker consultation record - Employment/recruitment and safety documentation with restricted access - Remedy plan, training and contractor corrective actions ### Indicators - 100% of high-risk activities have an assigned safety/rights owner - Training completion and corrective-action ageing, disaggregated only where lawful and safe - Track worker injuries, near misses and verified remedy; do not reward under-reporting ### Critical holds - Forced labour, child endangerment or retaliation - Uncontrolled serious safety hazard - Unlawful discriminatory decision or denial of lawful worker rights ### Alignment ILO fundamental rights include safety/health following the 2022 amendment. SDG targets are impact references; internal workforce metrics do not substitute for national SDG indicators. SDG targets: 5.1, 8.5, 8.7, 8.8, 10.2 Sources: ILO, UNGP, UNGC ## P05 SDG impact, environment and responsible resource use Owner: Sustainability lead / project owner Link intended benefits to measurable outcomes while preventing harm to people and ecosystems. ### Proposed clauses - Select only materially relevant SDG targets for each project; do not claim contribution to all 17 goals by association. Record the mechanism, baseline, affected population/ecosystem, possible harm and evidence boundary. - Keep an impact register separate from financial materiality. A human-rights or ecological harm may require action even when its near-term financial effect is small; positive impact elsewhere does not offset a serious adverse impact. - Apply avoidance, minimisation, restoration and responsible residual-impact handling to water, waste, pollution, biodiversity and land. Verify site rights, community interests, permits and contractor disposal routes before activity. - Set time-bound project targets only after baseline quality and delivery resources are assessed. Record absolute and intensity measures, denominators, counterfactual/attribution limits, trade-offs and external dependencies. - Substantiate product, sustainability and SDG claims before publication. Label estimated avoided emissions separately from the company emissions inventory; no unsupported net-zero, carbon-neutral, organic or health claims. ### Practices - By Day 21: select 1-3 priority SDG targets as a proposed working range and map material adverse impacts; justify a different number for complex projects. - By Day 42: approve baseline, source, target owner, measurement cost and do-no-harm safeguards; hold regulated activity until actual permissions exist. - Quarterly: review resource use, incidents, community feedback and target progress; correct claims when scope or evidence changes. ### Evidence - Target-level SDG logic model and adverse-impact register - Water/materials/waste/biodiversity baseline and permits - Claim substantiation and target change log ### Indicators - 100% of material public impact claims have scoped source evidence - Waste/water/material intensity and absolute quantities with defined boundaries - Progress toward approved project targets; no invented group reduction percentage ### Critical holds - Critical environmental permission or community-rights issue unresolved - Uncontrolled pollution or serious irreversible harm risk - Unsupported sustainability claim presented as achieved ### Alignment Target-level UN SDG contribution mapping is proposed and distinct from IFRS financial materiality. National/global SDG indicators may be unsuitable as direct company KPIs; each internal proxy is labelled. SDG targets: 6.3, 6.4, 12.2, 12.3, 12.5, 12.6, 15.5 Sources: SDG, OECD, UNGC ## P06 Climate, emissions and transition resilience Owner: Climate data owner / finance lead Measure material climate exposures and develop a credible, financed response. ### Proposed clauses - Establish entity and measurement boundaries and an activity-data inventory. Categorise Scope 1 direct sources, Scope 2 purchased-energy emissions and relevant Scope 3 value-chain categories using an appropriate recognised method and current applicable requirements. - Retain emission factors, units, factor year, conversion logic, estimates, exclusions and reviewer. Distinguish location/market-based energy information where relevant, data uncertainty and the basis for any recalculation. - Assess physical and transition risks over explicitly defined short/medium/long horizons. Use a proportionate scenario-analysis approach and document resilience, assumptions and limitations rather than asserting precise probabilities from narrative scenarios. - Before announcing a transition target, specify base year, scope, absolute/intensity basis, interim milestones, capital/operating requirements, dependencies and responsibility. Show gross emissions and any offsets separately. - Connect material climate assumptions to asset lives, impairment, provisions, financing and the business plan through reviewed accounting/disclosure memos. A policy does not establish that the group has a net-zero plan or a measured inventory. ### Practices - Within 60 days of entity adoption: compile the initial activity-data and climate-exposure map; identify gaps and prioritise material data collection. - Quarterly: reconcile energy/activity data, factor versions, exposure changes and target actions. Annually: review scenarios and inventory methodology before claims or reporting. - Before a new site or major capital decision: assess climate resilience and transition dependencies with the relevant technical specialist. ### Evidence - Climate risk/scenario file; GHG inventory with data-quality flags - Transition target/finance plan if adopted; gross/offset reconciliation - Accounting/disclosure linkage and independent review ### Indicators - Coverage and quality of material activity data; estimates explicitly identified - Absolute tCO2e and intensity only after boundary/method approval - Track material adaptation actions and exposure, not an assumed universal reduction rate ### Critical holds - Material data gaps concealed in emissions claims - A transition claim lacks scope, baseline or delivery basis - Critical site climate hazard has no acceptable treatment ### Alignment IFRS S2 is a climate-related financial disclosure standard, not a carbon certification. December 2025 GHG amendments become effective for periods beginning 1 January 2027; early application requires the prescribed disclosure and an applicability/version assessment. SDG targets: 7.3, 13.2, 13.3 Sources: S2, GHG, S2A ## P07 Financial reporting, treasury and capital stewardship Owner: Finance lead / governing body Maintain reliable entity books, protected cash and a defensible reporting basis. ### Proposed clauses - Document statutory reporting requirements and the chosen accounting basis per entity, including local GAAP/Ind AS where applicable and any IFRS reporting pack. Reconcile differences explicitly; IFRS alignment is not an automatic substitute for local law. - Maintain an accounting-policy and judgement register addressing consolidation/control, financial instruments, revenue, inventory, assets/development expenditure, leases, impairment, provisions, tax, FX and related parties as relevant. Use current standards and a competent reviewer before recognition or disclosure decisions. - Reconcile bank accounts, receivables/payables, payroll, taxes, assets and intercompany balances. Separate actuals from forecasts, restricted cash from available cash and proposal valuations from accepted measurement evidence. - Require independently verified bank-detail changes and separate payment preparation/release. Prohibit self-approved reimbursements, undisclosed borrowing/guarantees and use of personal accounts for company funds without a lawful reviewed arrangement. - Prepare a complete reporting package with period, currency, comparatives, notes, judgements and actual audit status. Claim IFRS compliance only if all applicable requirements are met and the authorised reporting process supports it. ### Practices - Weekly: update a 13-week cash forecast and funding actions. Monthly: aim to close and review management accounts by business day 10; an entity may adopt a justified different timetable. - Quarterly: review revenue/asset recognition memos, impairment indicators, debt/covenants, taxes, related parties and differences between management and statutory accounts. - Before the applicable reporting period: assess IFRS 18 transition, comparative restatement and management-defined performance measures; record relevant new-standard and local endorsement dates. ### Evidence - Entity accounting-basis/standards register; signed close checklist - Bank/payment and intercompany reconciliations; cash forecast - Judgement, related-party, tax and financial-statement review files ### Indicators - 100% of material balance-sheet reconciliations reviewed at each adopted close - Track unresolved reconciliation items by value and age - Liquidity/covenant headroom against adopted entity limits; budgets are not cash or profit ### Critical holds - Unauthorised cash release or unverifiable payee change - Material unresolved financial misstatement - IFRS/audit assertion unsupported by the reporting evidence ### Alignment IFRS Accounting Standards address financial statements. IFRS 18 replaces IAS 1 for periods beginning on/after 1 January 2027, with early application permitted; jurisdictional endorsement and entity scope must be assessed. This manual is not a full accounting-policy textbook. SDG targets: 16.6, 17.1 Sources: IAS, IAS1, IFRS18, CG ## P08 Sustainability-related financial disclosure Owner: Finance lead / sustainability lead Prepare decision-useful sustainability information connected to financial reporting without overstating compliance. ### Proposed clauses - Assess whether and when IFRS S1/S2 apply by jurisdiction, reporting entity, adoption route and period. Keep an implementation checklist including issued/effective versions, permitted reliefs and any early application. - Under an IFRS S1 readiness assessment, identify sustainability risks/opportunities that could affect cash flows, access to finance or cost of capital over defined horizons. Evaluate material information for providers of capital and document both inclusion and omission judgements. - Use governance, strategy, risk management and metrics/targets as connected disclosure heads. Consider relevant SASB topics/metrics and explain industry fit; considering applicability does not mean every SASB metric is mandatory. - Align the sustainability reporting entity and reporting period with related financial statements; assess the wider value chain for relevant exposures and identify metric-specific boundaries, estimates and sources. - Disclose significant judgements, uncertainty, comparatives and changes as required by the applicable standards. No unqualified IFRS Sustainability compliance statement until all applicable requirements are satisfied; an SDG mapping or this manual is insufficient. ### Practices - By Day 30 of implementation: document entity/period scope and materiality process. By Day 60: map disclosure data owners and gaps to each selected topic. - Quarterly: reconcile financial and sustainability assumptions and review new risks, data quality and target changes. At reporting close: independent challenge, governing-body review and publication control. - Maintain separate impact and financial-materiality assessments and explain their connections; do not mislabel IFRS S1 as automatically requiring double materiality. ### Evidence - Applicability/version/relief assessment and disclosure index - Materiality and value-chain assessment; data lineage and boundaries - Connected-financial-assumptions review and sign-off ### Indicators - 100% of material disclosures have a data owner, source and review - Track disclosure gaps by criticality and closure evidence - Compare reported metrics to related financial assumptions without forcing artificial consistency ### Critical holds - Material omission or misleading boundary - Unreviewed relief or unsupported compliance statement - Material conflict with related financial information left unexplained ### Alignment Financial materiality under ISSB standards and wider SDG impacts are distinct assessments. S1/S2 are effective for annual periods beginning 1 January 2024, but actual obligations depend on jurisdiction/entity adoption. No adoption or assurance is asserted for Amnaya. SDG targets: 12.6, 16.6 Sources: S1, S2, SASB, S2A ## P09 Responsible procurement and supplier development Owner: Procurement owner / independent approver Source fairly, strengthen supplier capability and control financial, rights and delivery risks. ### Proposed clauses - Screen suppliers proportionately for ownership, competence, conflicts, rights/safety/environment risks and the actual activity/territory. High-risk suppliers need enhanced diligence and an accountable remediation decision. - Use comparable quotations and total lifecycle cost, not headline price alone. The working default is three quotes unless a documented sole-source/emergency justification is independently approved. - Contracts define scope, quality, price/currency, tax, delivery, payment, data/IP, applicable supplier expectations, change control, audit/verification rights and proportionate remedies. - Provide accessible onboarding and fair, clear payment terms for small/local suppliers without weakening safety, integrity or quality. Do not demand exclusive dependence or uncompensated technology transfer as a condition of participation. - Monitor performance and remediation. Responsible disengagement assesses harm and continuity; do not abruptly exit a rights problem solely to remove it from a dashboard. ### Practices - Before order: verify the supplier, compare bids on a common scope and obtain the adopted authority; never split orders to avoid approval thresholds. - Monthly: review on-time delivery, defects, payables ageing and critical dependencies. Quarterly: review high-risk corrective actions and supplier-development needs. - For material bank-detail changes: verify through an independent trusted channel before payment; preserve the check and approver. ### Evidence - Supplier risk and beneficial-ownership file; comparable bid analysis - Contract/purchase order and approval; account-change verification - Supplier scorecard, payment-ageing and remediation register ### Indicators - 100% of high-risk suppliers screened before work - On-time payment: invoices paid by agreed due date / valid invoices due - Supplier defects and late delivery with defined denominators; local/SME spend as a contextual measure ### Critical holds - Critical safety/rights red flag without treatment - Unverifiable supplier/payee or concealed related party - Contract or approval absent for a material commitment ### Alignment SDG 12.7 concerns public procurement; private supplier controls are an analogous contribution pathway, not a claim that a corporate KPI is the UN indicator. OECD risk-based diligence informs prioritisation. SDG targets: 8.3, 8.8, 12.7, 17.16 Sources: OECD, UNGP, UNGC ## P10 Privacy, cybersecurity and controlled records Owner: Information owner / security lead Protect personal, confidential and business-critical information through its lifecycle. ### Proposed clauses - Maintain data/asset inventories, purpose, access basis, classification and retention schedules. Minimise collection and evaluate cross-border transfers and vendor terms for each actual jurisdiction. - Use least privilege, individual accounts, strong authentication and MFA where available. Review access quarterly and remove access promptly on role/relationship change; shared secrets are not a substitute for identity control. - Protect sensitive data in transit and storage, patch supported systems, keep logging proportionate and preserve tested backups. Define restoration objectives through a business-impact assessment rather than assuming every system needs the same uptime. - Separate public claims and sources from confidential contracts, financials, health/HR data and credentials. Public policy tools are not private record repositories; do not upload confidential evidence to public forms. - Preserve records subject to legitimate retention and legal holds; securely delete only through an authorised process. Assess cyber/privacy incidents for containment, affected parties and applicable notification requirements. ### Practices - At onboarding/change: assign data owners and least-privilege access; document any unimplemented security control as a gap with an owner. - Monthly: review critical patches/backups and alerts; quarterly: access review and a sampled restoration exercise. Annual: reassess recovery objectives and key vendors. - Immediately on incident: contain and preserve evidence; use the internal 24-hour logging/48-hour cause-review targets without delaying shorter statutory notifications. ### Evidence - Data/asset/access inventory; retention and transfer assessment - Backup/restore, patch and access-review evidence - Incident and legal-notification assessment; vendor security file ### Indicators - 100% of privileged accounts reviewed each quarter; MFA coverage reported honestly - Critical patch exceptions by age and risk - Restore-test success versus approved recovery objectives ### Critical holds - Unapproved public exposure of confidential data - Critical uncontained compromise - Processing or transfer lacks a justified lawful basis or necessary safeguard ### Alignment NIST CSF 2.0 provides a voluntary risk-management reference across six functions. This policy does not claim NIST certification or that MFA, malware scanning or other controls already exist on the current Amnaya platform. SDG targets: 9.c, 16.6 Sources: CYBER, PACT, OECD ## P11 Responsible AI, innovation and intellectual property Owner: AI/product owner / independent risk reviewer Use AI and new technologies where they serve a defined need with accountable human judgement. ### Proposed clauses - Inventory AI systems, models, vendors and intended uses. Assign an owner and risk tier; map affected people, data, foreseeable misuse, failure modes and limits before procurement or deployment. - Test performance, bias, privacy, security, provenance and reliability using context-relevant data and independent challenge. Record uncertainty, untested uses and human override; no unvalidated autonomous clinical, employment or capital-approval decision. - Keep confidential/personal data out of unapproved AI services; review data use/training terms, location and retention. Label material synthetic content and verify consequential facts, calculations, citations and rights. - Respect IP, licences and trade secrets. Research into existing business models does not permit copying protected code, content, branding or confidential processes; protect ownership/permissions in shared development. - Approve material model/version/use changes, monitor drift and incidents, and maintain rollback or human fallback. Human accountability cannot be delegated to an AI output. ### Practices - Before pilot: prepare a model/use-case card and risk review; use simulation for high-consequence contexts until specialist authorisation exists. - At release and material change: rerun declared tests, obtain separate approval and confirm user disclosures and fallback. - Monthly for active high-risk uses: review incidents, data drift and human overrides; quarterly: review vendor changes and emerging obligations. ### Evidence - AI inventory/model card, intended/prohibited uses and data permissions - Evaluation/bias/security record; IP/licensing and release review - Monitoring, human override, incident and rollback log ### Indicators - 100% of material AI uses have an owner, risk tier and approved use boundary - Error/bias measures with subgroup/sample limitations where appropriate - High-consequence outputs independently checked; unverified AI claims are not evidence ### Critical holds - No appropriate human oversight in a consequential use - Unauthorised sensitive-data use or IP breach - Material harm/bias or reliability issue lacks acceptable treatment ### Alignment NIST AI RMF 1.0 is a voluntary reference, not a certificate or a claim of legal AI compliance. Local AI/product/privacy requirements need a separate applicability assessment. SDG targets: 9.5, 10.2, 16.6 Sources: AI, PACT, OECD ## P12 Product quality, operational safety and sector permissions Owner: Sector technical lead / safety owner Prevent live activity before its quality, safety and legal basis is demonstrated. ### Proposed clauses - Define the product/service, intended users, activity, operating site, entity and relevant authorities. Maintain a three-layer register of company, territory and sector obligations with effective versions and renewal dates. - Apply risk-based design review, validation, inspection/testing, change control and traceability. Safety and mandatory permissions override delivery targets or commercial pricing. - For energy, assess grid/site/environment and operating permissions; for food/beverage, licensing, hygiene, ingredients/classification, labelling and traceability; for healthcare, professional/site permissions, ethics, participants and health-data controls; for commerce/textiles, product, chemical, consumer and digital-trade requirements. - Establish complaint, adverse-event, recall/withdrawal and emergency procedures proportionate to the activity. A simulation must remain labelled and must not be reported as an authorised clinical or commercial operation. - Separate quality targets from statistical control limits. Freeze approved definitions and baselines, retain failures in denominators and investigate signals without automatically claiming a cause. ### Practices - Before Gate 42: technical/method and territory/sector reviews. Before Gate 56: zero unresolved critical obligations and a rehearsed recovery plan. - During authorised activity: review critical incidents immediately and reconcile quality data daily; retain test/release records and exceptions. - At change/renewal: reassess permissions, product class and safety case; a different entity/site/activity cannot inherit an unchecked licence conclusion. ### Evidence - Permission/renewal and technical safety files; traceable release record - Protocol, test/calibration/inspection and quality data - Complaint/adverse-event/recall and corrective-action records ### Indicators - Zero unresolved critical obligations before live release - Nonconforming units / inspected units, with rejected/missing cases explained - Corrective-action verification and recall traceability performance ### Critical holds - Critical licence/ethics/safety permission absent or expired - Uncontrolled serious hazard or recall failure - Unsupported clinical, food, energy or product-performance claim ### Alignment Sector annexes are applicability questions, not exhaustive legal requirements. The shared 100-day model is a review framework; no generic policy substitutes for a regulator, clinician or qualified technical reviewer. SDG targets: 3.9, 8.8, 9.1, 12.4 Sources: OECD, UNGP, SDG ## P13 Fair participation, trade and territorial resilience Owner: Territory lead / commercial and legal reviewers Translate equitable development and modern resilience into lawful, evidence-led project decisions. ### Proposed clauses - Treat the 1974 UN New International Economic Order as a historical state-level development framework. Draw a distinct company-level response: fair participation, local capability, transparent terms and respect for lawful sovereignty; do not claim the declaration creates a corporate certification. - For today's economy, assess actual supply-chain, currency, logistics, sanctions/export-control, data, payment, enforceability and political exposures. Use current competent sources and independent review; nationality is not a proxy for a person's trustworthiness. - Offer proportionate local/SME supplier development, skills transfer, accessible technology and transparent benefit arrangements. Technology sharing remains consent-based, lawful and respectful of IP and communities. - Assess low/base/stress scenarios and diversify critical dependencies when justified. Any territorial price allowance needs a distinct loss mechanism, period, exposed capital, probability/severity, actual recovery and reviewed quote; never double-count loss, delay, financing and insurance. - Do not use higher prices, intermediaries, opaque routing or localisation labels to evade law, exploit instability, or override human rights/safety holds. Screen actual transactions and counterparties under the applicable legal regimes. ### Practices - Before a territory commitment: prepare a country/site/contract risk memo and sector permission map; record who maintains legal-source updates. - Quarterly and on a material event: reassess concentration, FX, payment/transfer and enforceability; test alternative supply/logistics and continuity. - Before quotation or financing: reconcile territorial allowance to evidence and disclose its assumptions, scope, recovery limits and approver. ### Evidence - Territory/transaction exposure and legal-screening assessment - Local capability/benefit and responsible technology-transfer plan - Pricing-loss bridge, diversification and contract/insurance evidence ### Indicators - 100% of material territorial allowances have a reviewed loss-mechanism record - Track concentration and supplier alternatives against adopted limits - Local/SME participation and skills outcomes with baseline and limitations ### Critical holds - Illegal trade/payment route or unresolved applicable restriction - Pricing used to bypass a rights, safety or permission hold - Discriminatory territory scoring or concealed double-counted allowance ### Alignment Historical NIEO aspirations and the 2024 Pact/digital cooperation context are clearly separated from binding local obligations. Proposed trade controls and economic participation metrics are Amnaya practices, not claims that international declarations bind every corporate transaction. SDG targets: 8.3, 10.2, 17.6, 17.16 Sources: NIEO, PACT, OECD ## P14 Stakeholder engagement, speak-up and remedy Owner: Independent grievance owner / governing body Allow concerns to be heard safely and resolved fairly, without retaliation. ### Proposed clauses - Before implementation, appoint a confidential intake owner and an independent alternative for complaints involving leadership. Establish accessible languages/formats and an anonymous option where lawful and feasible; do not claim anonymity until technically verified. - Protect good-faith reporters, witnesses and affected people from retaliation. Do not require waiver of legal rights, restrict access to regulators/courts or make a private agreement the only remedy. - Use impartial triage, appropriate confidentiality, evidence preservation, fair opportunity to respond, proportionate action and rights-respecting remedy. Restricted records are shared only on a need-to-know lawful basis. - Acknowledge within 2 business days, triage within 5, provide updates at least every 15 calendar days and aim for a reasoned outcome in 30 calendar days or explain an extension. These are proposed service targets; urgent harm and legal deadlines take precedence. - Allow independent review/appeal without the original conflicted decision maker. Report aggregate themes and verified remedy while avoiding identification or prejudgment. A low complaint count is not a success measure by itself. ### Practices - Before adoption: test the confidential intake, conflict escalation, safeguarding, record access and notification process; name an external reviewer where internal independence is insufficient. - On receipt: assess immediate danger and required external reporting; document scope, investigator and communication plan. - Quarterly: review ageing, retaliation risks, systemic themes and remedy effectiveness with affected stakeholders where appropriate. ### Evidence - Channel/accessibility and independence test; restricted case register - Triage, investigation, communication and remedy evidence - Appeal decision and aggregate lessons with privacy review ### Indicators - Acknowledgement/triage/update timeliness against adopted targets - Remedy verification and appeal outcome, not only case closure - Retaliation reports and response quality; no punishment for reporting volume ### Critical holds - Retaliation or conflicted investigator - Immediate harm lacks safeguarding response - Public form used as if it were a protected whistleblowing channel ### Alignment UNGP effectiveness principles inform the design. The existing public website enquiry form is not a verified anonymous/confidential whistleblowing service; a dedicated channel must be configured and tested before this proposed procedure goes live. SDG targets: 16.3, 16.6, 16.7 Sources: UNGP, ILO, CG ## P15 Business continuity, crisis and responsible exit Owner: Continuity owner / incident decision owner Keep essential services safe through disruption and exit responsibly when continuation is unsound. ### Proposed clauses - Identify critical services, people, sites, suppliers, cash, records and technology dependencies through a business-impact assessment. Set entity-specific recovery time and recovery point objectives and minimum safe operating levels. - Prepare incident authority, emergency contacts, stakeholder/regulator communication, alternate supply/work arrangements, backup/restore and manual fallback. Protect people before assets or reporting deadlines. - Test realistic physical, cyber, funding, supplier and territory disruptions, including correlated risks. A successful file backup is not proof of a functioning service recovery. - Record incident decisions, preserve evidence and assess legal/contractual reporting. Do not speculate publicly or conceal material facts; coordinate accurate updates through an authorised spokesperson. - For hold/exit, assess staff, customers/patients, suppliers, creditors, environmental duties, data/IP and records. Use a funded orderly plan and lawful decisions rather than abandoning liabilities or transferring harm. ### Practices - By Day 56: rehearse the pilot rollback and escalation. By Day 84: test an adverse scenario and at least ten fresh retest cases where suitable. - Quarterly: review contact/dependency lists and a sampled restore/fallback exercise. Annually: run a cross-functional crisis simulation and update the business-impact assessment. - After a material incident: log within 24 hours, review causes within 48 hours and verify priority correction within 5 calendar days or retain the hold with an explicit revised plan. ### Evidence - Business-impact assessment, recovery objectives and dependency map - Exercise/restore results and incident communication log - Responsible hold/exit plan and residual obligations ### Indicators - Restore/exercise outcomes versus approved recovery objectives - Critical dependencies with tested alternatives - Overdue corrective actions and unresolved exit obligations ### Critical holds - Imminent harm or critical service loss without a safe fallback - Untested recovery relied on for a material release - Unfunded/unsafe abandonment or concealed residual obligation ### Alignment Recovery objectives and exercise cadences are proposed operational controls. SDG resilience themes guide intended outcomes, not a claim that corporate exercises meet national SDG indicators. SDG targets: 9.1, 11.b, 13.1 Sources: CYBER, OECD, PACT ## P16 Evidence, public claims, assurance and policy lifecycle Owner: Policy coordinator / independent assurance reviewer Turn policies into demonstrable practice and keep public assertions proportionate to evidence. ### Proposed clauses - Maintain one controlled policy register with ID, entity scope, version, owner, reviewers, resolution/approval, effective date, local annexes, communication/training, review/expiry and superseded versions. Draft publication is not adoption. - For every material financial, impact, operating or affiliation claim, retain exact wording, entity/period, baseline, numerator/denominator, source, uncertainty, permissions and independent review before owner publication approval. - Classify assurance honestly: preparer check, independent internal review, external limited/reasonable assurance or audit only when actually performed under a defined scope. A control checklist, AI review or this manual is not external assurance. - Monitor the design and operating effectiveness of controls with risk-based sampling. Management owns operations; a disinterested reviewer challenges them. Preserve failures, dissent and corrections; do not reward selective reporting. - Exceptions require rationale, risk, compensating controls, accountable approval and expiry before action. No exception can waive law, serious rights/safety protection, falsification prohibitions or unsupported compliance claims. ### Practices - Within 30 days of entity adoption: communicate the policy set and role-based training; obtain acknowledgements and document unresolved controls. - Monthly: review overdue controls/exceptions. Quarterly: test a risk-based sample including at least one high-risk commitment, one access/record control and one public claim where activity exists. - Annually and after material change: review policies, actual outcomes, legal updates, adoption boundaries and assurance scope; approve changes and preserve the earlier version. ### Evidence - Adoption/version/exception register; training and control-testing plan - Claim/source/reviewer and correction log - Quarterly implementation review and actual external assurance reports, if any ### Indicators - 100% of material claims have scoped evidence and authorised review - Control test pass/fail and remediation age with honest sample limitations - 100% of active exceptions have an owner, compensating control and expiry ### Critical holds - False adoption, assurance, UN/IFRS membership or compliance claim - Material unsupported public assertion - Expired or prohibited exception used to justify continuation ### Alignment Reference alignment does not establish UN affiliation, Global Compact participation, IFRS compliance, ISO/NIST certification or external assurance. The governance code and existing legal instruments must be reconciled before adoption; this draft does not amend them. SDG targets: 12.6, 16.6 Sources: CG, S1, OECD ## Sources OECD: OECD Guidelines for Multinational Enterprises, 2023 - https://www.oecd.org/en/publications/oecd-guidelines-for-multinational-enterprises-on-responsible-business-conduct_81f92357-en.html CG: G20/OECD Principles of Corporate Governance, 2023 - https://www.oecd.org/en/publications/g20-oecd-principles-of-corporate-governance-2023_ed750b30-en.html UNGC: UN Global Compact - Ten Principles - https://unglobalcompact.org/what-is-gc/mission/principles UNGP: OHCHR - UN Guiding Principles on Business and Human Rights - https://www.ohchr.org/documents/publications/guidingprinciplesbusinesshr_en.pdf ILO: ILO fundamental principles and rights at work, amended 2022 - https://www.ilo.org/topics-and-sectors/fundamental-principles-and-rights-work SDG: UN Sustainable Development Goals and target catalogue - https://sdgs.un.org/goals S1: IFRS S1 - General Requirements for Sustainability-related Financial Information - https://www.ifrs.org/issued-standards/ifrs-sustainability-standards-navigator/ifrs-s1-general-requirements/ S2: IFRS S2 - Climate-related Disclosures - https://www.ifrs.org/issued-standards/ifrs-sustainability-standards-navigator/ifrs-s2-climate-related-disclosures/ S2A: IFRS S2 - December 2025 amendments, effective periods beginning 1 January 2027 - https://www.ifrs.org/content/dam/ifrs/publications/amendments/english/2025/issb-2025-1-amendments-ifrs-s2.pdf SASB: IFRS Foundation - using SASB Standards in IFRS S1 - https://www.ifrs.org/content/dam/ifrs/supporting-implementation/ifrs-s1/using-sasb-standards-for-ifrs-s1.pdf IAS: IFRS Accounting Standards Navigator - https://www.ifrs.org/issued-standards/list-of-standards/ IAS1: IFRS Foundation - IAS 1 and compliance statements - https://www.ifrs.org/issued-standards/list-of-standards/ias-1-presentation-of-financial-statements.html/ IFRS18: IFRS 18 - effective periods beginning 1 January 2027 - https://www.ifrs.org/issued-standards/list-of-standards/ifrs-18-presentation-and-disclosure-in-financial-statements/ GHG: GHG Protocol - emissions scope definitions - https://ghgprotocol.org/sites/default/files/2022-12/FAQ_0.pdf AI: NIST AI Risk Management Framework 1.0 - govern, map, measure and manage - https://airc.nist.gov/airmf-resources/airmf/5-sec-core/ CYBER: NIST Cybersecurity Framework 2.0 - https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf NIEO: UN General Assembly resolution 3201 (S-VI), 1 May 1974 - https://digitallibrary.un.org/record/218450?ln=en PACT: UN Pact for the Future and Global Digital Compact, 2024 - https://www.un.org/sites/un2.un.org/files/sotf-pact_for_the_future_adopted.pdf