Materiality built on the wrong question
Meridian Bank is preparing its FY2025 report. Its materiality exercise was a survey of 40 institutional investors who scored 22 topics on 'impact on enterprise value'; topics scoring below 3.0 out of 5 were excluded. Customer data privacy scored 2.4 and was dropped, despite two breach incidents in the year affecting 180,000 customers. An NGO submission about migrant workers employed by an IT contractor in the Gulf was logged as 'stakeholder feedback' and never assessed. The bank has no written process description beyond 'we conducted a materiality survey'. Management intends to report the eight highest-scoring topics and to state that the report is 'in accordance with the GRI Standards'.
1. Evaluate the materiality process against GRI 3 and identify what is missing.
Read the worked answer
GRI 3 defines material topics as those reflecting the organization's most significant impacts on the economy, environment and people, including human rights - not those that most affect enterprise value or that stakeholders consider important. The survey answers a financial-materiality question and then uses the answer as an impact-materiality decision. That is the core defect.
What GRI 3 requires the process to do:
- Understand the context - activities, business relationships, the value chain (including the IT contractor), and the sustainability context of the markets concerned.
- Identify actual and potential impacts - positive and negative, across the value chain, not a pre-set list of 22 topics inherited from a peer benchmark.
- Assess significance using severity (scale, scope, irremediable character) and likelihood; for negative human rights impacts, severity prevails over likelihood.
- Prioritize the most significant impacts for reporting.
- Involve affected stakeholders (2-29), not investors alone.
An arbitrary 3.0 cut-off, investor-only input and an unassessed NGO submission do not meet 3-1, so the 'in accordance' claim is unsupported whatever the other disclosures say.
2. Should customer data privacy and the contractor's migrant workers be treated as material? Justify with severity reasoning.
Read the worked answer
Data privacy - yes. Scale is large (180,000 customers affected by two incidents in one year), the harm to individuals (fraud, identity theft) is difficult or impossible to reverse, and the bank has leverage over the cause. High severity plus a track record of occurrence makes the impact significant regardless of the 2.4 investor score. Report 418 Customer Privacy plus 3-3.
Migrant workers - yes. The impact occurs in the value chain but Meridian is linked to it through a business relationship and may be contributing through contract terms and fee pressure. Indicators to assess: recruitment fees, passport retention, wage deductions - the classic forced-labour markers under 409, with 408, 406, 414 and 412 as the surrounding disclosures.
The reasoning to display: investor indifference is evidence about investors, not about severity. GRI 3 does not allow a severe impact to be filtered out because a stakeholder group scored it low, and it does not allow a known potential impact to go unassessed because it arrived by email rather than by survey.
3. What must be published, and how should the process be described?
Read the worked answer
Three disclosures plus the engagement disclosure:
- 3-1 Process to determine material topics - a substantive narrative: how context was analysed, how impacts were identified (sources, workshops, value-chain mapping), the severity/likelihood criteria and thresholds applied, how impacts were prioritized, who was involved internally (including the highest governance body, cf. 2-14), and how the results inform strategy and target-setting. A one-line 'we conducted a survey' fails this.
- 3-2 List of material topics - the output list, revised to include privacy and labour-rights topics.
- 3-3 Management of material topics - for each topic: policies and commitments, actions, goals and targets, responsibilities and resources, grievance mechanisms, and effectiveness monitoring.
- 2-29 Approach to stakeholder engagement - categories of stakeholders, how they were identified, and how their input - including the NGO submission - informed the materiality decision.
Where the process changes year on year, say so; a revised list without an explanation of why topics entered or left reads as manipulation, and undermines balance and comparability.