INCUBATION / INSIGHT
Define what is worth testing
Research the need, compare alternatives, retain contradictory evidence and establish the entity, activity and measurement boundary.
AMNAYA / POLICY & OPERATING FRAMEWORK
Principles that
become practice.
Sixteen proposed policies connect venture building, responsible conduct and evidence-led reporting. Every principle has an owner, a routine, a record and a review.
Proposed policy framework. These are original Amnaya drafts for review and entity-by-entity adoption. Clauses describe what would apply after lawful adoption; they do not describe a verified current operating state. Reconcile the Founder Governance Code, constitutional documents, actual local law and sector requirements before approval.
A REFERENCE, NOT A REPLICA
Rocket-inspired.
Built for Amnaya.
Rocket Internet’s public approach combines incubation, investment and operational support. Amnaya adapts those broad ideas into a shared-services and evidence-gate model. The detailed controls below are original proposals; Rocket’s private policies and proprietary processes are not reproduced.
Rocket Internet’s public operating approach ↗INVESTMENT / CHALLENGE
Earn the next commitment
Expose cash needs, downside, conflicts and permissions. Reserve material capital and risk decisions to lawful authority.
OPERATIONAL SUPPORT / CAPABILITY
Make delivery repeatable
Share competent finance, technology, procurement and people support while retaining project-specific responsibility, IP and quality controls.
THE PROPOSED POLICY REGISTER
Read the rule.
Inspect the practice.
Expand a policy to see clauses, owners, routines, evidence, proposed indicators, critical holds and primary references. Internal targets are configurable Amnaya proposals, not numbers mandated by international standards.
16 proposed policies
P01 / Governance & capitalGovernance, authority and independent challengePROPOSED · NOT ADOPTED
Keep legal authority, owner decisions and independent scrutiny clear across a small team and a multi-project group.
Proposed owner: Entity governing body / policy coordinator
Review: Annual and after material change; quarterly implementation review
Effective date: not set
Proposed policy clauses
- The lawful governing body approves entity strategy, risk appetite, capital commitments and adoption of this manual. An advisory council or working committee cannot replace statutory directors, shareholder rights or local law.
- Adopt an entity-specific delegation schedule naming roles, monetary limits, currencies, aggregation periods and reserved matters. A draft role label grants no authority; no new commitment is permitted solely because it appears in a planning tool.
- Reserve equity/debt issuance, guarantees, entity formation, related-party arrangements, material acquisitions/disposals, major litigation settlements and exceptions to approved risk appetite to the authorised governing body.
- Require a preparer and a separate reviewer for commitments, payment releases and material claims. Where a small team cannot segregate duties, engage a disinterested external reviewer and document the compensating control.
- Disclose actual/potential conflicts before deliberation; record recusals, quorum, dissent, conditions and decision expiry. No interested person approves their own transaction or investigates a complaint about themselves.
Operating practices
- Before Day 7: map legal entities, appoint accountable persons and independent challenge, and record which proposed roles remain vacant.
- Weekly: venture leads review delivery and exceptions. Monthly: management reviews cash, policy gaps and material risks. Quarterly: the governing body reviews capital, sustainability and control failures.
- Within 2 business days of a decision: file minutes, evidence-pack version, authority and conditions. Reconfirm delegations annually and on personnel/entity changes.
Evidence to retain
- Entity and ownership map; signed delegation and reserved-matters schedule
- Decision/conflict/recusal register; committee terms of reference
- Policy adoption resolution; quarterly oversight minutes
Proposed indicators
- 100% of material decisions have an authority and evidence reference
- 100% of declared conflicts have an independent disposition
- Overdue conditions: count and age, reviewed monthly
Critical holds
- No valid authority or quorum
- Unmanaged conflict or self-approval
- Unlawful instructions, regardless of founder or commercial support
Alignment and limits
Inspired by public governance and oversight themes; Amnaya roles and reserved matters are proposed, not copied from Rocket Internet. S1/S2 governance disclosures may draw on these records when material and applicable.
Target mappings are contribution hypotheses, not verified achievements or UN indicators.
P02 / Governance & capitalVenture creation, investment and portfolio disciplinePROPOSED · NOT ADOPTED
Build repeatable ventures with operational support, evidence gates and bounded capital at risk.
Proposed owner: Investment decision owner / venture lead
Review: Annual and after material change; quarterly implementation review
Effective date: not set
Proposed policy clauses
- Use the Data Centres, Centre of Excellence and Venture Laboratory as evidence, review and execution workstreams. Every project needs an accountable sponsor, problem statement, customers/beneficiaries and a defined operating entity.
- Separate origination, feasibility, preparation, authorised pilot, scale and exit/hold decisions. Apply Amnaya gates on Days 7/21/42/56/70/84/100; these dates are Amnaya planning conventions, not an attributed Rocket policy.
- Approve only the next bounded commitment, with runway, sources/uses, downside and stop criteria. Record portfolio concentration by sector, territory, counterparty, currency and correlated exposure.
- Assess unit economics appropriate to the model: customer acquisition and cohort retention for platforms; contracted output, utilisation and lifecycle costs for assets; quality, safety and service outcomes for healthcare. Do not impose a universal software growth KPI on all sectors.
- Shared finance, technology, hiring and procurement support require a service scope, charge basis and conflict review. Preserve IP, competition rules, patient/worker safety and customer trust when adapting a business model.
Operating practices
- Before Gate 21: retain at least eight sources, segment evidence, alternatives and disconfirming findings; replace illustrative quotas with an approved sampling plan.
- Before Gates 42 and 56: review three economic scenarios, technical design, territory/sector applicability, permission evidence and an instrumented measurement contract.
- Monthly: refresh the portfolio register and liquidity forecast. Trigger an owner review at >10% scope-adjusted budget variance, a breached runway floor or any critical hold; these are proposed internal triggers, not automatic stop/approval rules.
Evidence to retain
- Investment memo with scenario model, source quotes and exit/hold case
- Gate decisions and authorised pilot scope; shared-service agreements
- Portfolio exposure table and 13-week cash forecast
Proposed indicators
- 100% of live pilots have a recorded permission decision
- 100% of proposed commitments show downside and funding source
- Track approved versus actual cost, runway and evidenced outcomes separately
Critical holds
- Critical licence, safety or participant permission unresolved
- Funding gap for the authorised work package
- Material evidence misrepresentation or unsupported scale decision
Alignment and limits
Rocket reference is limited to incubation, investment and operational support. The evidence tests, allocation limits and 100-day schedule are original Amnaya proposals. Target-level SDG contributions require project evidence.
Target mappings are contribution hypotheses, not verified achievements or UN indicators.
P03 / Governance & capitalIntegrity, anti-bribery, conflicts and fair competitionPROPOSED · NOT ADOPTED
Make commercial conduct honest, competition fair and improper influence unacceptable.
Proposed owner: Compliance lead / independent reviewer
Review: Annual and after material change; quarterly implementation review
Effective date: not set
Proposed policy clauses
- Prohibit bribery, kickbacks, facilitation payments, extortion arrangements, falsified records and retaliation for refusal. A political-risk allowance or local custom cannot legitimise an improper payment.
- Review agents, beneficial ownership, public-official connections, success fees and payment destinations before engagement. Pay only against documented lawful services to a verified authorised account.
- Maintain gifts/hospitality and conflict registers. Cash, cash-equivalents, quid-pro-quo benefits and benefits during a live procurement/approval decision are prohibited; other thresholds require an adopted local schedule and pre-approval.
- Compete independently. Do not share competitively sensitive pricing, allocate markets, rig tenders or misuse another firm's confidential information. Seek specialist review before joint bidding or competitor collaboration.
- Record donations, sponsorships and lobbying transparently with lawful authority; no political or charitable payment may disguise a commercial inducement. Preserve evidence and cooperate with lawful investigation.
Operating practices
- Before onboarding and renewal: perform risk-based counterparty checks, conflict declarations, written terms and account verification independent of emailed change requests.
- Quarterly: review high-risk agent fees, gifts, public-sector interfaces and unresolved red flags; train relevant staff at induction and annually.
- Immediately: stop suspect payment or conduct, preserve records and notify the designated independent reviewer; assess reporting obligations without promising an automatic legal conclusion.
Evidence to retain
- Counterparty/beneficial ownership and red-flag review
- Gifts, conflicts, sponsorship and agent register
- Training attestations; investigation/approval record
Proposed indicators
- 100% of high-risk counterparties reviewed before engagement
- 100% of gifts/conflicts recorded within the adopted reporting window
- Track substantiated cases, remediation and retaliation separately; zero reports is not proof of integrity
Critical holds
- Bribe, facilitation payment or unlawful inducement
- Unresolved ownership/payment red flag
- Bid-rigging, concealed conflict or falsified service evidence
Alignment and limits
UNGC anti-corruption and OECD business-integrity/competition references inform the baseline. Amnaya screening workflows and monitoring targets are proposed controls, not regulator certifications.
Target mappings are contribution hypotheses, not verified achievements or UN indicators.
P04 / People & responsibilityHuman rights, decent work and inclusive employmentPROPOSED · NOT ADOPTED
Respect people in own operations and value chains, with fair work, safety and access to remedy.
Proposed owner: People lead / site safety lead
Review: Annual and after material change; quarterly implementation review
Effective date: not set
Proposed policy clauses
- Prohibit forced labour, trafficking, child labour, harassment and unlawful discrimination. Apply the applicable minimum-age and hazardous-work rules and credible age checks; prevent recruitment fees or retention of identity documents.
- Respect freedom of association, collective bargaining and safe/healthy work. Provide understandable contracts, lawful pay/hours/leave, worker representation and safe reporting without retaliation.
- Assess salient human-rights risks by severity and affected people, not only financial exposure. Consult workers, vulnerable groups and relevant communities in accessible languages and formats.
- Use fair, documented recruitment and pay criteria. Review equal-pay and accessibility issues with lawful, proportionate data handling; do not publish identifiable employee data or treat demographic targets as quotas overriding fair treatment.
- Prevent and mitigate adverse impacts, use leverage with suppliers and provide/cooperate in remedy where appropriate to the relationship. Child-labour remediation protects the child rather than simply terminating access to income without a safe plan.
Operating practices
- Before site/vendor approval: perform labour and safety risk screening and confirm recruitment arrangements, emergency provisions and a usable complaint route.
- Monthly: inspect high-risk work and contractor conditions; reconcile wage/hour evidence using appropriate sampling and worker consultation.
- Quarterly: review recruitment, pay, accessibility, training and unresolved rights impacts. Immediate danger triggers stop-work and local emergency escalation.
Evidence to retain
- Human-rights/salient-impact assessment; worker consultation record
- Employment/recruitment and safety documentation with restricted access
- Remedy plan, training and contractor corrective actions
Proposed indicators
- 100% of high-risk activities have an assigned safety/rights owner
- Training completion and corrective-action ageing, disaggregated only where lawful and safe
- Track worker injuries, near misses and verified remedy; do not reward under-reporting
Critical holds
- Forced labour, child endangerment or retaliation
- Uncontrolled serious safety hazard
- Unlawful discriminatory decision or denial of lawful worker rights
Alignment and limits
ILO fundamental rights include safety/health following the 2022 amendment. SDG targets are impact references; internal workforce metrics do not substitute for national SDG indicators.
Target mappings are contribution hypotheses, not verified achievements or UN indicators.
P05 / People & responsibilitySDG impact, environment and responsible resource usePROPOSED · NOT ADOPTED
Link intended benefits to measurable outcomes while preventing harm to people and ecosystems.
Proposed owner: Sustainability lead / project owner
Review: Annual and after material change; quarterly implementation review
Effective date: not set
Proposed policy clauses
- Select only materially relevant SDG targets for each project; do not claim contribution to all 17 goals by association. Record the mechanism, baseline, affected population/ecosystem, possible harm and evidence boundary.
- Keep an impact register separate from financial materiality. A human-rights or ecological harm may require action even when its near-term financial effect is small; positive impact elsewhere does not offset a serious adverse impact.
- Apply avoidance, minimisation, restoration and responsible residual-impact handling to water, waste, pollution, biodiversity and land. Verify site rights, community interests, permits and contractor disposal routes before activity.
- Set time-bound project targets only after baseline quality and delivery resources are assessed. Record absolute and intensity measures, denominators, counterfactual/attribution limits, trade-offs and external dependencies.
- Substantiate product, sustainability and SDG claims before publication. Label estimated avoided emissions separately from the company emissions inventory; no unsupported net-zero, carbon-neutral, organic or health claims.
Operating practices
- By Day 21: select 1-3 priority SDG targets as a proposed working range and map material adverse impacts; justify a different number for complex projects.
- By Day 42: approve baseline, source, target owner, measurement cost and do-no-harm safeguards; hold regulated activity until actual permissions exist.
- Quarterly: review resource use, incidents, community feedback and target progress; correct claims when scope or evidence changes.
Evidence to retain
- Target-level SDG logic model and adverse-impact register
- Water/materials/waste/biodiversity baseline and permits
- Claim substantiation and target change log
Proposed indicators
- 100% of material public impact claims have scoped source evidence
- Waste/water/material intensity and absolute quantities with defined boundaries
- Progress toward approved project targets; no invented group reduction percentage
Critical holds
- Critical environmental permission or community-rights issue unresolved
- Uncontrolled pollution or serious irreversible harm risk
- Unsupported sustainability claim presented as achieved
Alignment and limits
Target-level UN SDG contribution mapping is proposed and distinct from IFRS financial materiality. National/global SDG indicators may be unsuitable as direct company KPIs; each internal proxy is labelled.
Target mappings are contribution hypotheses, not verified achievements or UN indicators.
P06 / People & responsibilityClimate, emissions and transition resiliencePROPOSED · NOT ADOPTED
Measure material climate exposures and develop a credible, financed response.
Proposed owner: Climate data owner / finance lead
Review: Annual and after material change; quarterly implementation review
Effective date: not set
Proposed policy clauses
- Establish entity and measurement boundaries and an activity-data inventory. Categorise Scope 1 direct sources, Scope 2 purchased-energy emissions and relevant Scope 3 value-chain categories using an appropriate recognised method and current applicable requirements.
- Retain emission factors, units, factor year, conversion logic, estimates, exclusions and reviewer. Distinguish location/market-based energy information where relevant, data uncertainty and the basis for any recalculation.
- Assess physical and transition risks over explicitly defined short/medium/long horizons. Use a proportionate scenario-analysis approach and document resilience, assumptions and limitations rather than asserting precise probabilities from narrative scenarios.
- Before announcing a transition target, specify base year, scope, absolute/intensity basis, interim milestones, capital/operating requirements, dependencies and responsibility. Show gross emissions and any offsets separately.
- Connect material climate assumptions to asset lives, impairment, provisions, financing and the business plan through reviewed accounting/disclosure memos. A policy does not establish that the group has a net-zero plan or a measured inventory.
Operating practices
- Within 60 days of entity adoption: compile the initial activity-data and climate-exposure map; identify gaps and prioritise material data collection.
- Quarterly: reconcile energy/activity data, factor versions, exposure changes and target actions. Annually: review scenarios and inventory methodology before claims or reporting.
- Before a new site or major capital decision: assess climate resilience and transition dependencies with the relevant technical specialist.
Evidence to retain
- Climate risk/scenario file; GHG inventory with data-quality flags
- Transition target/finance plan if adopted; gross/offset reconciliation
- Accounting/disclosure linkage and independent review
Proposed indicators
- Coverage and quality of material activity data; estimates explicitly identified
- Absolute tCO2e and intensity only after boundary/method approval
- Track material adaptation actions and exposure, not an assumed universal reduction rate
Critical holds
- Material data gaps concealed in emissions claims
- A transition claim lacks scope, baseline or delivery basis
- Critical site climate hazard has no acceptable treatment
Alignment and limits
IFRS S2 is a climate-related financial disclosure standard, not a carbon certification. December 2025 GHG amendments become effective for periods beginning 1 January 2027; early application requires the prescribed disclosure and an applicability/version assessment.
Target mappings are contribution hypotheses, not verified achievements or UN indicators.
P07 / Reporting & assuranceFinancial reporting, treasury and capital stewardshipPROPOSED · NOT ADOPTED
Maintain reliable entity books, protected cash and a defensible reporting basis.
Proposed owner: Finance lead / governing body
Review: Annual and after material change; quarterly implementation review
Effective date: not set
Proposed policy clauses
- Document statutory reporting requirements and the chosen accounting basis per entity, including local GAAP/Ind AS where applicable and any IFRS reporting pack. Reconcile differences explicitly; IFRS alignment is not an automatic substitute for local law.
- Maintain an accounting-policy and judgement register addressing consolidation/control, financial instruments, revenue, inventory, assets/development expenditure, leases, impairment, provisions, tax, FX and related parties as relevant. Use current standards and a competent reviewer before recognition or disclosure decisions.
- Reconcile bank accounts, receivables/payables, payroll, taxes, assets and intercompany balances. Separate actuals from forecasts, restricted cash from available cash and proposal valuations from accepted measurement evidence.
- Require independently verified bank-detail changes and separate payment preparation/release. Prohibit self-approved reimbursements, undisclosed borrowing/guarantees and use of personal accounts for company funds without a lawful reviewed arrangement.
- Prepare a complete reporting package with period, currency, comparatives, notes, judgements and actual audit status. Claim IFRS compliance only if all applicable requirements are met and the authorised reporting process supports it.
Operating practices
- Weekly: update a 13-week cash forecast and funding actions. Monthly: aim to close and review management accounts by business day 10; an entity may adopt a justified different timetable.
- Quarterly: review revenue/asset recognition memos, impairment indicators, debt/covenants, taxes, related parties and differences between management and statutory accounts.
- Before the applicable reporting period: assess IFRS 18 transition, comparative restatement and management-defined performance measures; record relevant new-standard and local endorsement dates.
Evidence to retain
- Entity accounting-basis/standards register; signed close checklist
- Bank/payment and intercompany reconciliations; cash forecast
- Judgement, related-party, tax and financial-statement review files
Proposed indicators
- 100% of material balance-sheet reconciliations reviewed at each adopted close
- Track unresolved reconciliation items by value and age
- Liquidity/covenant headroom against adopted entity limits; budgets are not cash or profit
Critical holds
- Unauthorised cash release or unverifiable payee change
- Material unresolved financial misstatement
- IFRS/audit assertion unsupported by the reporting evidence
Alignment and limits
IFRS Accounting Standards address financial statements. IFRS 18 replaces IAS 1 for periods beginning on/after 1 January 2027, with early application permitted; jurisdictional endorsement and entity scope must be assessed. This manual is not a full accounting-policy textbook.
Target mappings are contribution hypotheses, not verified achievements or UN indicators.
P08 / Reporting & assuranceSustainability-related financial disclosurePROPOSED · NOT ADOPTED
Prepare decision-useful sustainability information connected to financial reporting without overstating compliance.
Proposed owner: Finance lead / sustainability lead
Review: Annual and after material change; quarterly implementation review
Effective date: not set
Proposed policy clauses
- Assess whether and when IFRS S1/S2 apply by jurisdiction, reporting entity, adoption route and period. Keep an implementation checklist including issued/effective versions, permitted reliefs and any early application.
- Under an IFRS S1 readiness assessment, identify sustainability risks/opportunities that could affect cash flows, access to finance or cost of capital over defined horizons. Evaluate material information for providers of capital and document both inclusion and omission judgements.
- Use governance, strategy, risk management and metrics/targets as connected disclosure heads. Consider relevant SASB topics/metrics and explain industry fit; considering applicability does not mean every SASB metric is mandatory.
- Align the sustainability reporting entity and reporting period with related financial statements; assess the wider value chain for relevant exposures and identify metric-specific boundaries, estimates and sources.
- Disclose significant judgements, uncertainty, comparatives and changes as required by the applicable standards. No unqualified IFRS Sustainability compliance statement until all applicable requirements are satisfied; an SDG mapping or this manual is insufficient.
Operating practices
- By Day 30 of implementation: document entity/period scope and materiality process. By Day 60: map disclosure data owners and gaps to each selected topic.
- Quarterly: reconcile financial and sustainability assumptions and review new risks, data quality and target changes. At reporting close: independent challenge, governing-body review and publication control.
- Maintain separate impact and financial-materiality assessments and explain their connections; do not mislabel IFRS S1 as automatically requiring double materiality.
Evidence to retain
- Applicability/version/relief assessment and disclosure index
- Materiality and value-chain assessment; data lineage and boundaries
- Connected-financial-assumptions review and sign-off
Proposed indicators
- 100% of material disclosures have a data owner, source and review
- Track disclosure gaps by criticality and closure evidence
- Compare reported metrics to related financial assumptions without forcing artificial consistency
Critical holds
- Material omission or misleading boundary
- Unreviewed relief or unsupported compliance statement
- Material conflict with related financial information left unexplained
Alignment and limits
Financial materiality under ISSB standards and wider SDG impacts are distinct assessments. S1/S2 are effective for annual periods beginning 1 January 2024, but actual obligations depend on jurisdiction/entity adoption. No adoption or assurance is asserted for Amnaya.
Target mappings are contribution hypotheses, not verified achievements or UN indicators.
P09 / Operations & resilienceResponsible procurement and supplier developmentPROPOSED · NOT ADOPTED
Source fairly, strengthen supplier capability and control financial, rights and delivery risks.
Proposed owner: Procurement owner / independent approver
Review: Annual and after material change; quarterly implementation review
Effective date: not set
Proposed policy clauses
- Screen suppliers proportionately for ownership, competence, conflicts, rights/safety/environment risks and the actual activity/territory. High-risk suppliers need enhanced diligence and an accountable remediation decision.
- Use comparable quotations and total lifecycle cost, not headline price alone. The working default is three quotes unless a documented sole-source/emergency justification is independently approved.
- Contracts define scope, quality, price/currency, tax, delivery, payment, data/IP, applicable supplier expectations, change control, audit/verification rights and proportionate remedies.
- Provide accessible onboarding and fair, clear payment terms for small/local suppliers without weakening safety, integrity or quality. Do not demand exclusive dependence or uncompensated technology transfer as a condition of participation.
- Monitor performance and remediation. Responsible disengagement assesses harm and continuity; do not abruptly exit a rights problem solely to remove it from a dashboard.
Operating practices
- Before order: verify the supplier, compare bids on a common scope and obtain the adopted authority; never split orders to avoid approval thresholds.
- Monthly: review on-time delivery, defects, payables ageing and critical dependencies. Quarterly: review high-risk corrective actions and supplier-development needs.
- For material bank-detail changes: verify through an independent trusted channel before payment; preserve the check and approver.
Evidence to retain
- Supplier risk and beneficial-ownership file; comparable bid analysis
- Contract/purchase order and approval; account-change verification
- Supplier scorecard, payment-ageing and remediation register
Proposed indicators
- 100% of high-risk suppliers screened before work
- On-time payment: invoices paid by agreed due date / valid invoices due
- Supplier defects and late delivery with defined denominators; local/SME spend as a contextual measure
Critical holds
- Critical safety/rights red flag without treatment
- Unverifiable supplier/payee or concealed related party
- Contract or approval absent for a material commitment
Alignment and limits
SDG 12.7 concerns public procurement; private supplier controls are an analogous contribution pathway, not a claim that a corporate KPI is the UN indicator. OECD risk-based diligence informs prioritisation.
Target mappings are contribution hypotheses, not verified achievements or UN indicators.
P10 / Operations & resiliencePrivacy, cybersecurity and controlled recordsPROPOSED · NOT ADOPTED
Protect personal, confidential and business-critical information through its lifecycle.
Proposed owner: Information owner / security lead
Review: Annual and after material change; quarterly implementation review
Effective date: not set
Proposed policy clauses
- Maintain data/asset inventories, purpose, access basis, classification and retention schedules. Minimise collection and evaluate cross-border transfers and vendor terms for each actual jurisdiction.
- Use least privilege, individual accounts, strong authentication and MFA where available. Review access quarterly and remove access promptly on role/relationship change; shared secrets are not a substitute for identity control.
- Protect sensitive data in transit and storage, patch supported systems, keep logging proportionate and preserve tested backups. Define restoration objectives through a business-impact assessment rather than assuming every system needs the same uptime.
- Separate public claims and sources from confidential contracts, financials, health/HR data and credentials. Public policy tools are not private record repositories; do not upload confidential evidence to public forms.
- Preserve records subject to legitimate retention and legal holds; securely delete only through an authorised process. Assess cyber/privacy incidents for containment, affected parties and applicable notification requirements.
Operating practices
- At onboarding/change: assign data owners and least-privilege access; document any unimplemented security control as a gap with an owner.
- Monthly: review critical patches/backups and alerts; quarterly: access review and a sampled restoration exercise. Annual: reassess recovery objectives and key vendors.
- Immediately on incident: contain and preserve evidence; use the internal 24-hour logging/48-hour cause-review targets without delaying shorter statutory notifications.
Evidence to retain
- Data/asset/access inventory; retention and transfer assessment
- Backup/restore, patch and access-review evidence
- Incident and legal-notification assessment; vendor security file
Proposed indicators
- 100% of privileged accounts reviewed each quarter; MFA coverage reported honestly
- Critical patch exceptions by age and risk
- Restore-test success versus approved recovery objectives
Critical holds
- Unapproved public exposure of confidential data
- Critical uncontained compromise
- Processing or transfer lacks a justified lawful basis or necessary safeguard
Alignment and limits
NIST CSF 2.0 provides a voluntary risk-management reference across six functions. This policy does not claim NIST certification or that MFA, malware scanning or other controls already exist on the current Amnaya platform.
Target mappings are contribution hypotheses, not verified achievements or UN indicators.
P11 / Operations & resilienceResponsible AI, innovation and intellectual propertyPROPOSED · NOT ADOPTED
Use AI and new technologies where they serve a defined need with accountable human judgement.
Proposed owner: AI/product owner / independent risk reviewer
Review: Annual and after material change; quarterly implementation review
Effective date: not set
Proposed policy clauses
- Inventory AI systems, models, vendors and intended uses. Assign an owner and risk tier; map affected people, data, foreseeable misuse, failure modes and limits before procurement or deployment.
- Test performance, bias, privacy, security, provenance and reliability using context-relevant data and independent challenge. Record uncertainty, untested uses and human override; no unvalidated autonomous clinical, employment or capital-approval decision.
- Keep confidential/personal data out of unapproved AI services; review data use/training terms, location and retention. Label material synthetic content and verify consequential facts, calculations, citations and rights.
- Respect IP, licences and trade secrets. Research into existing business models does not permit copying protected code, content, branding or confidential processes; protect ownership/permissions in shared development.
- Approve material model/version/use changes, monitor drift and incidents, and maintain rollback or human fallback. Human accountability cannot be delegated to an AI output.
Operating practices
- Before pilot: prepare a model/use-case card and risk review; use simulation for high-consequence contexts until specialist authorisation exists.
- At release and material change: rerun declared tests, obtain separate approval and confirm user disclosures and fallback.
- Monthly for active high-risk uses: review incidents, data drift and human overrides; quarterly: review vendor changes and emerging obligations.
Evidence to retain
- AI inventory/model card, intended/prohibited uses and data permissions
- Evaluation/bias/security record; IP/licensing and release review
- Monitoring, human override, incident and rollback log
Proposed indicators
- 100% of material AI uses have an owner, risk tier and approved use boundary
- Error/bias measures with subgroup/sample limitations where appropriate
- High-consequence outputs independently checked; unverified AI claims are not evidence
Critical holds
- No appropriate human oversight in a consequential use
- Unauthorised sensitive-data use or IP breach
- Material harm/bias or reliability issue lacks acceptable treatment
Alignment and limits
NIST AI RMF 1.0 is a voluntary reference, not a certificate or a claim of legal AI compliance. Local AI/product/privacy requirements need a separate applicability assessment.
Target mappings are contribution hypotheses, not verified achievements or UN indicators.
P12 / Operations & resilienceProduct quality, operational safety and sector permissionsPROPOSED · NOT ADOPTED
Prevent live activity before its quality, safety and legal basis is demonstrated.
Proposed owner: Sector technical lead / safety owner
Review: Annual and after material change; quarterly implementation review
Effective date: not set
Proposed policy clauses
- Define the product/service, intended users, activity, operating site, entity and relevant authorities. Maintain a three-layer register of company, territory and sector obligations with effective versions and renewal dates.
- Apply risk-based design review, validation, inspection/testing, change control and traceability. Safety and mandatory permissions override delivery targets or commercial pricing.
- For energy, assess grid/site/environment and operating permissions; for food/beverage, licensing, hygiene, ingredients/classification, labelling and traceability; for healthcare, professional/site permissions, ethics, participants and health-data controls; for commerce/textiles, product, chemical, consumer and digital-trade requirements.
- Establish complaint, adverse-event, recall/withdrawal and emergency procedures proportionate to the activity. A simulation must remain labelled and must not be reported as an authorised clinical or commercial operation.
- Separate quality targets from statistical control limits. Freeze approved definitions and baselines, retain failures in denominators and investigate signals without automatically claiming a cause.
Operating practices
- Before Gate 42: technical/method and territory/sector reviews. Before Gate 56: zero unresolved critical obligations and a rehearsed recovery plan.
- During authorised activity: review critical incidents immediately and reconcile quality data daily; retain test/release records and exceptions.
- At change/renewal: reassess permissions, product class and safety case; a different entity/site/activity cannot inherit an unchecked licence conclusion.
Evidence to retain
- Permission/renewal and technical safety files; traceable release record
- Protocol, test/calibration/inspection and quality data
- Complaint/adverse-event/recall and corrective-action records
Proposed indicators
- Zero unresolved critical obligations before live release
- Nonconforming units / inspected units, with rejected/missing cases explained
- Corrective-action verification and recall traceability performance
Critical holds
- Critical licence/ethics/safety permission absent or expired
- Uncontrolled serious hazard or recall failure
- Unsupported clinical, food, energy or product-performance claim
Alignment and limits
Sector annexes are applicability questions, not exhaustive legal requirements. The shared 100-day model is a review framework; no generic policy substitutes for a regulator, clinician or qualified technical reviewer.
Target mappings are contribution hypotheses, not verified achievements or UN indicators.
P13 / Operations & resilienceFair participation, trade and territorial resiliencePROPOSED · NOT ADOPTED
Translate equitable development and modern resilience into lawful, evidence-led project decisions.
Proposed owner: Territory lead / commercial and legal reviewers
Review: Annual and after material change; quarterly implementation review
Effective date: not set
Proposed policy clauses
- Treat the 1974 UN New International Economic Order as a historical state-level development framework. Draw a distinct company-level response: fair participation, local capability, transparent terms and respect for lawful sovereignty; do not claim the declaration creates a corporate certification.
- For today's economy, assess actual supply-chain, currency, logistics, sanctions/export-control, data, payment, enforceability and political exposures. Use current competent sources and independent review; nationality is not a proxy for a person's trustworthiness.
- Offer proportionate local/SME supplier development, skills transfer, accessible technology and transparent benefit arrangements. Technology sharing remains consent-based, lawful and respectful of IP and communities.
- Assess low/base/stress scenarios and diversify critical dependencies when justified. Any territorial price allowance needs a distinct loss mechanism, period, exposed capital, probability/severity, actual recovery and reviewed quote; never double-count loss, delay, financing and insurance.
- Do not use higher prices, intermediaries, opaque routing or localisation labels to evade law, exploit instability, or override human rights/safety holds. Screen actual transactions and counterparties under the applicable legal regimes.
Operating practices
- Before a territory commitment: prepare a country/site/contract risk memo and sector permission map; record who maintains legal-source updates.
- Quarterly and on a material event: reassess concentration, FX, payment/transfer and enforceability; test alternative supply/logistics and continuity.
- Before quotation or financing: reconcile territorial allowance to evidence and disclose its assumptions, scope, recovery limits and approver.
Evidence to retain
- Territory/transaction exposure and legal-screening assessment
- Local capability/benefit and responsible technology-transfer plan
- Pricing-loss bridge, diversification and contract/insurance evidence
Proposed indicators
- 100% of material territorial allowances have a reviewed loss-mechanism record
- Track concentration and supplier alternatives against adopted limits
- Local/SME participation and skills outcomes with baseline and limitations
Critical holds
- Illegal trade/payment route or unresolved applicable restriction
- Pricing used to bypass a rights, safety or permission hold
- Discriminatory territory scoring or concealed double-counted allowance
Alignment and limits
Historical NIEO aspirations and the 2024 Pact/digital cooperation context are clearly separated from binding local obligations. Proposed trade controls and economic participation metrics are Amnaya practices, not claims that international declarations bind every corporate transaction.
Target mappings are contribution hypotheses, not verified achievements or UN indicators.
P14 / People & responsibilityStakeholder engagement, speak-up and remedyPROPOSED · NOT ADOPTED
Allow concerns to be heard safely and resolved fairly, without retaliation.
Proposed owner: Independent grievance owner / governing body
Review: Annual and after material change; quarterly implementation review
Effective date: not set
Proposed policy clauses
- Before implementation, appoint a confidential intake owner and an independent alternative for complaints involving leadership. Establish accessible languages/formats and an anonymous option where lawful and feasible; do not claim anonymity until technically verified.
- Protect good-faith reporters, witnesses and affected people from retaliation. Do not require waiver of legal rights, restrict access to regulators/courts or make a private agreement the only remedy.
- Use impartial triage, appropriate confidentiality, evidence preservation, fair opportunity to respond, proportionate action and rights-respecting remedy. Restricted records are shared only on a need-to-know lawful basis.
- Acknowledge within 2 business days, triage within 5, provide updates at least every 15 calendar days and aim for a reasoned outcome in 30 calendar days or explain an extension. These are proposed service targets; urgent harm and legal deadlines take precedence.
- Allow independent review/appeal without the original conflicted decision maker. Report aggregate themes and verified remedy while avoiding identification or prejudgment. A low complaint count is not a success measure by itself.
Operating practices
- Before adoption: test the confidential intake, conflict escalation, safeguarding, record access and notification process; name an external reviewer where internal independence is insufficient.
- On receipt: assess immediate danger and required external reporting; document scope, investigator and communication plan.
- Quarterly: review ageing, retaliation risks, systemic themes and remedy effectiveness with affected stakeholders where appropriate.
Evidence to retain
- Channel/accessibility and independence test; restricted case register
- Triage, investigation, communication and remedy evidence
- Appeal decision and aggregate lessons with privacy review
Proposed indicators
- Acknowledgement/triage/update timeliness against adopted targets
- Remedy verification and appeal outcome, not only case closure
- Retaliation reports and response quality; no punishment for reporting volume
Critical holds
- Retaliation or conflicted investigator
- Immediate harm lacks safeguarding response
- Public form used as if it were a protected whistleblowing channel
Alignment and limits
UNGP effectiveness principles inform the design. The existing public website enquiry form is not a verified anonymous/confidential whistleblowing service; a dedicated channel must be configured and tested before this proposed procedure goes live.
Target mappings are contribution hypotheses, not verified achievements or UN indicators.
P15 / Operations & resilienceBusiness continuity, crisis and responsible exitPROPOSED · NOT ADOPTED
Keep essential services safe through disruption and exit responsibly when continuation is unsound.
Proposed owner: Continuity owner / incident decision owner
Review: Annual and after material change; quarterly implementation review
Effective date: not set
Proposed policy clauses
- Identify critical services, people, sites, suppliers, cash, records and technology dependencies through a business-impact assessment. Set entity-specific recovery time and recovery point objectives and minimum safe operating levels.
- Prepare incident authority, emergency contacts, stakeholder/regulator communication, alternate supply/work arrangements, backup/restore and manual fallback. Protect people before assets or reporting deadlines.
- Test realistic physical, cyber, funding, supplier and territory disruptions, including correlated risks. A successful file backup is not proof of a functioning service recovery.
- Record incident decisions, preserve evidence and assess legal/contractual reporting. Do not speculate publicly or conceal material facts; coordinate accurate updates through an authorised spokesperson.
- For hold/exit, assess staff, customers/patients, suppliers, creditors, environmental duties, data/IP and records. Use a funded orderly plan and lawful decisions rather than abandoning liabilities or transferring harm.
Operating practices
- By Day 56: rehearse the pilot rollback and escalation. By Day 84: test an adverse scenario and at least ten fresh retest cases where suitable.
- Quarterly: review contact/dependency lists and a sampled restore/fallback exercise. Annually: run a cross-functional crisis simulation and update the business-impact assessment.
- After a material incident: log within 24 hours, review causes within 48 hours and verify priority correction within 5 calendar days or retain the hold with an explicit revised plan.
Evidence to retain
- Business-impact assessment, recovery objectives and dependency map
- Exercise/restore results and incident communication log
- Responsible hold/exit plan and residual obligations
Proposed indicators
- Restore/exercise outcomes versus approved recovery objectives
- Critical dependencies with tested alternatives
- Overdue corrective actions and unresolved exit obligations
Critical holds
- Imminent harm or critical service loss without a safe fallback
- Untested recovery relied on for a material release
- Unfunded/unsafe abandonment or concealed residual obligation
Alignment and limits
Recovery objectives and exercise cadences are proposed operational controls. SDG resilience themes guide intended outcomes, not a claim that corporate exercises meet national SDG indicators.
Target mappings are contribution hypotheses, not verified achievements or UN indicators.
P16 / Reporting & assuranceEvidence, public claims, assurance and policy lifecyclePROPOSED · NOT ADOPTED
Turn policies into demonstrable practice and keep public assertions proportionate to evidence.
Proposed owner: Policy coordinator / independent assurance reviewer
Review: Annual and after material change; quarterly implementation review
Effective date: not set
Proposed policy clauses
- Maintain one controlled policy register with ID, entity scope, version, owner, reviewers, resolution/approval, effective date, local annexes, communication/training, review/expiry and superseded versions. Draft publication is not adoption.
- For every material financial, impact, operating or affiliation claim, retain exact wording, entity/period, baseline, numerator/denominator, source, uncertainty, permissions and independent review before owner publication approval.
- Classify assurance honestly: preparer check, independent internal review, external limited/reasonable assurance or audit only when actually performed under a defined scope. A control checklist, AI review or this manual is not external assurance.
- Monitor the design and operating effectiveness of controls with risk-based sampling. Management owns operations; a disinterested reviewer challenges them. Preserve failures, dissent and corrections; do not reward selective reporting.
- Exceptions require rationale, risk, compensating controls, accountable approval and expiry before action. No exception can waive law, serious rights/safety protection, falsification prohibitions or unsupported compliance claims.
Operating practices
- Within 30 days of entity adoption: communicate the policy set and role-based training; obtain acknowledgements and document unresolved controls.
- Monthly: review overdue controls/exceptions. Quarterly: test a risk-based sample including at least one high-risk commitment, one access/record control and one public claim where activity exists.
- Annually and after material change: review policies, actual outcomes, legal updates, adoption boundaries and assurance scope; approve changes and preserve the earlier version.
Evidence to retain
- Adoption/version/exception register; training and control-testing plan
- Claim/source/reviewer and correction log
- Quarterly implementation review and actual external assurance reports, if any
Proposed indicators
- 100% of material claims have scoped evidence and authorised review
- Control test pass/fail and remediation age with honest sample limitations
- 100% of active exceptions have an owner, compensating control and expiry
Critical holds
- False adoption, assurance, UN/IFRS membership or compliance claim
- Material unsupported public assertion
- Expired or prohibited exception used to justify continuation
Alignment and limits
Reference alignment does not establish UN affiliation, Global Compact participation, IFRS compliance, ISO/NIST certification or external assurance. The governance code and existing legal instruments must be reconciled before adoption; this draft does not amend them.
Target mappings are contribution hypotheses, not verified achievements or UN indicators.
No policies match these filters. Try another term, head or SDG.
INTERNATIONAL ALIGNMENT / DISTINCT LAYERS
Clear references.
Honest boundaries.
Contribution and do-no-harm
Select relevant UN SDG targets and a measurable causal pathway. Assess human rights, labour, safety, water, waste and biodiversity harms as well as intended benefits. An internal metric is not automatically a UN indicator; positive impact does not cancel serious harm elsewhere.
References: UN SDGs, UN Global Compact principles, UNGPs, ILO and OECD responsible-business guidance. No affiliation or membership is implied.
Reliable financial statements
Determine the entity’s statutory basis and any IFRS reporting obligations. Document recognition/measurement judgements, reconciliations, financial statements and actual audit status. IFRS 18 becomes effective for periods beginning 1 January 2027, subject to applicable adoption and early-application rules.
A policy manual is not an IFRS compliance statement. Local GAAP or Ind AS requirements may differ.
Financially material sustainability information
Connect governance, strategy, risk management and metrics/targets to the entity’s financial prospects. Assess reporting entity, period, value chain, relevant industry topics, data quality and current standard versions. Wider impacts and financial materiality remain separate assessments.
S1/S2 effective dates do not establish Amnaya’s obligation or compliance. December 2025 S2 GHG amendments are effective for periods beginning 1 January 2027; assess permitted early application and local rules.
Two meanings, kept distinct
1974 UN NIEO: a state-level development framework informing fair participation, local capability and transparent value-chain terms.
Today’s global economy: trade, FX, supply, finance, political, digital and technology risks assessed in the actual project context, with lawful diversification and responsible data/AI practices.
Neither creates a corporate “New World Economic Order” certification or an exemption from law.
Version and interpretation notes
IFRS S1/S2 are effective for annual periods beginning 1 January 2024; actual obligations depend on jurisdiction and adoption. IFRS 18 and December 2025 S2 GHG amendments have relevant 2027 effective dates. Each entity must record applicable versions, transition/early-application decisions and any reliefs. This is a proposed readiness framework, not a complete standards checklist.
Primary reference register · checked 5 November 2026
RI / Rocket Internet - incubation, investment and operational support ↗RIG / Rocket Internet - public leadership and governance materials ↗OECD / OECD Guidelines for Multinational Enterprises, 2023 ↗CG / G20/OECD Principles of Corporate Governance, 2023 ↗UNGC / UN Global Compact - Ten Principles ↗UNGP / OHCHR - UN Guiding Principles on Business and Human Rights ↗ILO / ILO fundamental principles and rights at work, amended 2022 ↗SDG / UN Sustainable Development Goals and target catalogue ↗S1 / IFRS S1 - General Requirements for Sustainability-related Financial Information ↗S2 / IFRS S2 - Climate-related Disclosures ↗S2A / IFRS S2 - December 2025 amendments, effective periods beginning 1 January 2027 ↗SASB / IFRS Foundation - using SASB Standards in IFRS S1 ↗IAS / IFRS Accounting Standards Navigator ↗IAS1 / IFRS Foundation - IAS 1 and compliance statements ↗IFRS18 / IFRS 18 - effective periods beginning 1 January 2027 ↗GHG / GHG Protocol - emissions scope definitions ↗AI / NIST AI Risk Management Framework 1.0 - govern, map, measure and manage ↗CYBER / NIST Cybersecurity Framework 2.0 ↗NIEO / UN General Assembly resolution 3201 (S-VI), 1 May 1974 ↗PACT / UN Pact for the Future and Global Digital Compact, 2024 ↗
FROM DRAFT TO OPERATING EVIDENCE
Adoption is a decision.
Effectiveness is evidence.
Use the seven-gate 100-day plan to assess, configure, rehearse, adopt and test. The timetable is relative to a separately authorised start. A checkbox never activates a policy.
DAYS 1-7
Establish authority and safe boundaries
Map entities and actual decision rights; appoint coordinator and independent reviewer; identify critical permissions, immediate hazards and unverified public claims.
Evidence: Scope sheet, role/delegation draft, critical-hold register
Decision boundary: Do not create a new mandate or commit funds without existing lawful authority.
DAYS 8-21
Assess the baseline
Map people, suppliers, data, assets, reporting requirements and priority SDG targets; review material risks and stakeholder impacts.
Evidence: Entity/sector/territory annex, baseline and gap register
Decision boundary: Unresolved critical rights, safety, legal or confidentiality exposures retain a hold.
DAYS 22-42
Design the controls
Review policy clauses and numeric defaults; develop finance/disclosure memos, training, grievance channel and continuity plan; cost the implementation.
Evidence: Local annexes, configured thresholds, reviewer findings and resourced plan
Decision boundary: Independent review of technical, accounting and legal applicability before adoption recommendation.
DAYS 43-56
Rehearse before adoption
Test permission evidence, sample payments, restore/fallback, confidential intake and claims review; resolve critical design gaps.
Evidence: Rehearsal results and corrected version
Decision boundary: Governing body may adopt only the reviewed entity-specific version; record resolution, scope, effective date and conditions.
DAYS 57-70
Operate only the authorised scope
Train affected people, communicate policies and execute approved controls; retain actual records and report exceptions.
Evidence: Acknowledgements, operating records and first management review
Decision boundary: Adoption is not proof of effectiveness; retain critical holds until verified.
DAYS 71-84
Test effectiveness and correct
Sample high-risk commitments, data access and claims; challenge downside/continuity and verify remedial actions.
Evidence: Independent sample tests, exception and correction log
Decision boundary: No prohibited or expired exception; significant failures require a corrective owner decision.
DAYS 85-100
Approve the next cycle
Review policy coverage, operating evidence, SDG/financial materiality distinctions and resource needs; publish only reviewed status.
Evidence: Day-100 review, residual-risk decisions and next review calendar
Decision boundary: Proceed, revise, hold or stop; no automatic claim of full standards compliance.
Confidential speak-up is a design requirement, not a current service claim. A dedicated protected intake, independent escalation and appropriate anonymity must be configured and tested before P14 is implemented. The existing public enquiry form is not a verified whistleblowing channel. Do not submit sensitive allegations through it.
PROJECT & ENTITY ANNEX
One baseline.
Context-specific controls.
Prepare a draft scope sheet for later review. This tool does not adopt policies, set an effective date, change authority or save private team records. Do not enter confidential information.
Unconfigured critical fields remain explicit: delegation limits, liquidity/runway floor, actual permissions, retention/notification clocks, recovery objectives, protected intake and materiality/reporting boundaries. A variance threshold is not an authority limit.
POLICY DOCUMENTS & EDITABLE REGISTERS
Review it.
Make it accountable.
DRAFT v0.1 · 40 PAGES
Policy and governance manual
Sixteen proposed policies with clauses, owners, practices, evidence, metrics and adoption boundaries.
DRAFT v0.1 · 10 PAGES
Policy implementation playbook
A phased 100-day adoption plan, review questions, configurable defaults and control testing.
DRAFT v0.1 · 6 PAGES
International alignment matrix
SDG target mapping, separate IFRS reporting layers and historical/current economic-order crosswalk.
The editable review pack
All three PDFs, editable policy text, the complete framework JSON, five CSV registers and an entity configuration template.