Home › Blog › CSR

How to Build a CSR Strategy That Is More Than a Page on Your Website

How to build a CSR strategy comes down to one discipline: choosing a few issues where your business genuinely affects people or the environment, and committing to measurable change on those, rather than listing every good cause you have ever supported. Corporate social responsibility is broad, and that breadth is the trap. This page gives a six-step method that works for an SME or a larger company, uses the seven core subjects of ISO 26000 as a checklist, and shows how the result should connect to legal duties and any ESG reporting you already do.

First, what a CSR strategy is for

A CSR strategy is a plan for how the business will manage its effects on society and the environment, beyond what the law strictly requires. It is not the same as philanthropy, although donations can be part of it, and it is narrower than a full ESG framework built for investors. Our explainer on what CSR is covers the definitions, and ESG vs CSR vs sustainability covers where the terms overlap.

A good strategy does three jobs. It focuses effort on the issues that matter most to the business and the people it affects. It gives staff, customers and suppliers something concrete to hold the company to. And it protects the company from the reputational damage of vague claims it cannot back up.

Step 1: audit what you already do

Most businesses already have CSR activity; it is just scattered. Before planning anything new, list what exists: the volunteering scheme, the recycling contract, the supplier code, the apprenticeship programme, the charity partner, the flexible working policy. Note who owns each, what it costs and whether anyone measures its effect. The gaps and duplication you find are the starting point.

Step 2: ask stakeholders what matters

A CSR strategy built only from the boardroom tends to reflect the directors' interests. Talk to the people affected: employees, customers, key suppliers, the local community, and investors or lenders if you have them. A short survey plus a handful of conversations is enough for a small business. For a larger one, a formal materiality assessment ranks issues by how much they matter to stakeholders and how much they affect the business.

ISO 26000, the international guidance standard on social responsibility, is a useful checklist here. It groups the field into seven core subjects:

ISO 26000 is guidance, not a certifiable standard, so nobody can be "ISO 26000 certified". Its value is as a map that stops you missing an area where you have real impact.

Step 3: pick three to five priorities

This is the step most CSR plans skip. Choose the issues where two things overlap: the business has a significant effect, and it has the ability to change that effect. A haulage firm's priorities will be emissions and driver welfare, not ocean plastics. A software company's might be data ethics, diversity in hiring and energy use in data centres. A retailer's will usually start in its supply chain.

Three to five priorities is enough. Everything else can continue, but it is not part of the strategy and should not be presented as if it were.

Step 4: set targets and owners

Each priority needs a target that can be checked, a date and a named person responsible. "Reduce our environmental impact" is not a target. "Cut Scope 1 and 2 emissions by 30% against our 2025 baseline by 2030" is. "Support the local community" is not a target. "Fill 20% of apprenticeship places from the three local postcodes by 2028" is.

Where you need a baseline first, the target for year one can be to measure. Our guide on measuring a carbon footprint covers the environmental side.

Step 5: budget for it and build it into the business

A strategy without money or management time is a statement of hope. Put the cost of each priority into the annual budget, and put the targets into the objectives of the people who own them. Then build the priorities into the normal processes they touch: supplier selection, recruitment, product design, capital spending decisions. That is the difference between CSR as a department and CSR as the way the company operates.

Policies make it stick. Depending on the priorities, you may need a supplier code of conduct, an anti-bribery policy or a whistleblowing channel; our guides to writing a code of conduct and sustainable supply chain management cover the common ones.

Step 6: measure and report honestly

Report progress against every target at least once a year, including the ones you missed. A short annual CSR update on your website is enough for a small firm. Larger companies will fold it into their strategic report or sustainability reporting.

Honesty matters for legal reasons too. The Competition and Markets Authority's Green Claims Code and the consumer protection rules it applies require environmental claims to be truthful, clear and substantiated, and the CMA can now fine businesses directly for breaches of consumer law. Our guide on making green claims explains what that means in practice.

Where CSR meets the law

For UK companies, CSR is not purely voluntary. Section 172 of the Companies Act 2006 requires directors to promote the success of the company having regard to, among other things, the interests of employees, relationships with suppliers and customers, the impact on the community and the environment, and the desirability of maintaining a reputation for high standards of business conduct. Large companies must explain in their strategic report how the directors have done that. Our page on directors' duties covers section 172 in full.

Other duties overlap with typical CSR priorities: the Modern Slavery Act 2015 statement for organisations with turnover of £36 million or more, gender pay gap reporting for employers with 250 or more staff, and the Bribery Act 2010. A CSR strategy that ignores these is building on sand.

Common mistakes

• Too many priorities. Twelve commitments means none of them gets the money or attention it needs.
• Charity instead of change. Donating to a good cause is welcome, but it does not offset a problem in your own operations.
• No baseline. Without a starting figure, no one can tell whether the target was met.
• Marketing first. Announcing the strategy before the targets and budget exist invites accusations of greenwashing.
• No board oversight. If the directors never see the results, the strategy will drift.

If you want independent verification of the whole approach, B Corp certification is the best-known route, and the ESG strategy guide covers the investor-facing version. For more, see the e-Business Ethics homepage.