September 09, 2026
Corporate Governance and Integrity Programs that Structure ESG Risk Management in Organizations
Clarice Sabatine Collavitti; João Valsecchi Ribeiro de Souza
DOI: 10.22167/2675-6528-202602196
Article derived from a Final Course Work (TCC), with content based on the student’s original work and adapted to the editorial format of the Revista E&S with the support of the ResumeAI tool, an artificial intelligence solution developed by the Pecege Institute for textual synthesis and organization.
Abstract
The global climate and social crisis demanded a revolution in organizational processes and the adoption of ESG policies to confront unprecedented humanitarian and economic challenges. The study aimed to investigate how the structuring of integrity programs and corporate governance mechanisms acted in risk management and in ensuring institutional perpetuity. The research used a qualitative and exploratory approach, based on bibliographic and documentary analysis of the Brazilian normative framework, with emphasis on Decrees No. 11.129/2022 and No. 12.304/2024, Regulatory Standard No. 1, and Law No. 9.605/1998. The results demonstrated that legislative evolution integrated sustainability criteria and human rights into compliance programs, requiring the creation of multidisciplinary bodies and structured risk matrices for the mitigation of operational and reputational damages. It was identified that the incorporation of psychosocial and environmental risks into internal controls strengthened transparency and organizational ethical culture in the face of uncertainty and corporate fraud scenarios. The convergence between regulatory compliance and governance strategy has consolidated as the determining factor for the generation of sustainable value and longevity of organizations in the contemporary scenario.
Keywords: Regulatory compliance; Compliance; Organizational ethics; Socio-environmental responsibility; Sustainability.
1. Introduction
The global climate and social crisis has imposed a profound restructuring on organizational processes and the adoption of ESG (Environmental, Social, and Governance) policies as an imperative for addressing unprecedented humanitarian and economic challenges. This scenario demands a transformation in how organizations operate, requiring the integration of sustainability and responsibility criteria into their strategies and operations.
The urgency of this transformation is evidenced by recent events of great loss of human lives, such as the 184 deaths from floods in Rio Grande do Sul, the almost one hundred deaths in Texas due to intense rains, and the 192 deaths from heatwaves in India in June 2024. Such events lay bare the human cost of the climate crisis and the need for a fundamental rethinking of the relationships between innovation, capitalism, and humanity. Innovation, in this context, must serve humanity, mitigating the effects of global warming, promoting the responsible exploration of resources, and redesigning fairer labor relations.
The contemporary climate crisis imposes unprecedented challenges, demanding coordinated responses between the public and private sectors. According to the Intergovernmental Panel on Climate Change (IPCC, 2023), the impacts of climate change are already widespread, affecting ecosystems, economies, and vulnerable populations, with a tendency to worsen. The Stern Review (2007) had already shown that the costs of inaction outweigh investments in mitigation, warning of severe global economic impacts. Complementarily, Cardoso (2017), citing Naomi Klein, argues that the climate crisis requires a profound transformation of the current economic model.
In this context, the rise of artificial intelligence is also a relevant topic, which should be used ethically, sustainably, and humanely, without representing a threat to mass employment. The literature suggests that the private sector, with its innovative power, should lead this transformation, with the public sector acting as a firm and efficient regulator. The urgency of the topic echoes transformative moments in history, such as the Industrial Revolution, and the advancement of sustainable development requires overcoming excessive theorization in favor of pragmatic actions (Mazzucato, 2014).
Corporate governance and integrity programs emerge as essential pillars for organizations to respond to these challenges. Sectoral engagement is critical for establishing clear and rigorous standards in attracting investments based on ESG criteria, especially considering the influence of global asset managers. However, contemporary authors warn of the risk of “greenwashing” and the need to improve internal processes and communication to ensure that ESG is effectively incorporated as an instrument for risk management and systemic responsibility (Koch and Denner, 2025; Moodaley and Telukdarie, 2023).
In Brazil, regulatory evolution has sought to strengthen corporate integrity and accountability. The Anti-Corruption Law (Law No. 12.846/2013) and its regulations, such as Decree No. 11.129/2022, detail mechanisms for accountability and compliance effectiveness. Cases like Wirecard (Sancak and Loew, 2022) and Lojas Americanas (Costa, 2023) highlight gaps in corporate governance and the asymmetry between institutional discourse and actual practice. Disasters such as Mariana (2015) and Brumadinho (2019) reinforce the importance of robust governance and transparency mechanisms, demanding the institutionalization of stricter obligations.
Decree No. 12.304/2024 represents an advancement by expanding integrity requirements for companies contracting with the public sector and by introducing mechanisms related to ESG practices, including respect for human rights, labor rights, and sustainability. Regulatory Standard No. 1 (NR-1) was updated to include the mapping and management of psychosocial risks in the workplace, aligning with the social pillar of ESG and the growing relevance of the topic, as demonstrated by data on benefits granted by Social Security for mental disorders (Brazil, 2025). Law No. 9.605/1998 (Environmental Crimes Law) is inserted as a central element for environmental risk management, providing for the direct liability of legal entities (Totoli, 2024).
Thus, the need for effective governance mechanisms and integrity programs is crucial for organizations not only to comply with regulations but also to proactively manage ESG risks, ensuring their sustainability and contributing to social and environmental well-being. Given this scenario, the present work aimed to investigate how the structuring of integrity programs and corporate governance mechanisms have acted in risk management and in ensuring institutional sustainability.
2. Material and Methods
The present study adopted a qualitative approach, of an exploratory and descriptive nature, based on bibliographic and documentary research. The investigation focused on the analysis of the Brazilian normative framework regarding integrity programs, with an emphasis on Decrees No. 11.129/2022 and No. 12.304/2024, and on Regulatory Standard No. 1 (NR-1), especially after its update to include psychosocial risks in the workplace.
The analysis was conducted from an evolutionary perspective, seeking to identify the improvement of normative instruments in promoting integrity, corporate governance, and the incorporation of ESG criteria. To this end, the structuring of integrity programs under Decree No. 11,129/2022 was sequentially examined; the normative advances of Decree No. 12,304/2024, related to the objectivity of criteria and the inclusion of environmental, social, and governance aspects; and the update of NR-1, focusing on the inclusion of psychosocial risks in the Risk Management Program (PGR) and its relationship with integrity mechanisms.
As a technique of analysis, systematic interpretation of norms was employed, complemented by a review of specialized literature on corporate governance, compliance, and ESG, and by the use of secondary data for empirical contextualization. The notion of a risk matrix was adopted as a central analytical category to examine the structuring of mechanisms for risk identification, assessment, and mitigation, including psychosocial risks. Furthermore, criteria for evaluating integrity programs, based on qualitative and quantitative indicators, were considered to verify their effectiveness.
The methodology allowed for normative analysis and the articulation between legal instruments and their practical application, enabling the identification of advances, limitations, and challenges in the implementation of integrity programs in Brazil.
3. Results and Discussion
Recent regulatory advances highlight the importance of the conscious implementation of integrity programs in the corporate environment, going beyond mere legal compliance to promote an ethical and sustainable organizational culture. State action, according to Mazzucato (2014), is crucial as an inducer of strategic innovation in the formulation of public policies for complex challenges such as the climate crisis. The Anti-Corruption Law (Law nº 12.846/2013), driven by protests in 2013, marked a paradigm shift, requiring strategic attention and resource allocation for compliance.
Cases like the collapse of Wirecard in 2020, due to accounting fraud and “governance-washing” (Sancak & Loew, 2022), and the accounting inconsistencies of Lojas Americanas in 2023, totaling R$ 20 billion, highlight gaps in the implementation of corporate governance and the asymmetry between discourse and practice. These events reinforce the need for fraud prevention mechanisms and integrity programs that permeate all organizational levels, including controlling shareholders, and for an effective “tone at the top”. The study was based on Decrees No. 11.129/2022 and No. 12.304/2024, Regulatory Standard No. 1 (NR-1), and Law No. 9.605/1998 to investigate these mechanisms.
Decree No. 11,129/2022 and the definition of parameters for the implementation of integrity programs
Decree No. 11.129/2022, which regulates the Anti-Corruption Law, details the criteria for the administrative and civil liability of legal entities and for the evaluation of integrity programs. Chapter V defines the integrity program as a set of internal mechanisms for preventing, detecting, and remediating illicit practices, such as fraud and corruption. Although Articles 56 and 57 offer specificity, practical implementation still requires further development, considering the particularities of each organization.
The development and application of a Code of Conduct are fundamental guidelines, which should cover partners, board members, directors, employees, suppliers, and other stakeholders (IBGC, 2023). The need for a formal code of conduct extends to public institutions, such as the Supreme Federal Court, indicating a social demand for transparency and accountability (Rittner, 2026). Disasters like those in Mariana (2015) and Brumadinho (2019) reinforce that voluntary disclosure of information is insufficient, requiring stricter obligations for transparency and traceability. Although it is an advancement, Decree No. 11.129/2022 still presents gaps in the standardization of decision-making processes and accountability.
Decree No. 12.304/2024 and the normative incorporation of ESG themes
Decree No. 12.304/2024 sought to provide greater objectivity to integrity programs, especially for organizations that contract with the Public Administration. It represents an advance over Decree No. 11.129/2022 by detailing the requirements for structuring programs, responding to practical difficulties. However, gaps in governance and traceability of decision-making processes still persist.
One point of innovation is the expansion of integrity requirements for large-scale public procurement contracts (Art. 1, item I). Additionally, Art. 3, item IX, introduces the requirement for mechanisms related to ESG practices, including respect for human rights, labor rights, and sustainability. Although symbolic, the generic wording of this provision raises questions about its capacity to induce concrete structural changes. Effectiveness will depend on the organizations’ ability to translate these guidelines into measurable and auditable practices, such as periodic reports with ESG indicators, specific contractual clauses, internal audits, and third-party due diligence.
Regulatory Standard No. 1 (NR-1) and the new wording that includes the mapping of psychosocial risks
The update to Regulatory Standard No. 1 (NR-1) introduces the need for mapping and managing psychosocial risks in the workplace, expanding the scope of the Risk Management Program (PGR). In addition to physical, chemical, or biological agents, NR-1 now covers psychosocial factors such as moral harassment, workload, and occupational stress. This expansion aligns with the ESG agenda, on the social (“S”) axis, by integrating workers’ mental health and well-being as central elements of risk management.
Empirical data from the Ministry of Social Security (Brazil, 2025) indicate that, in 2025, 546,254 benefits were granted for mental and behavioral disorders, highlighting a public health challenge and a significant economic impact. The inclusion of psychosocial risks reinforces the need to improve risk matrices to contemplate variables from the organizational environment and corporate culture. The evaluation of these programs must evolve to include qualitative and quantitative indicators, such as policies for preventing harassment, effective reporting channels, and organizational climate surveys. The effectiveness of NR-1 will depend on the conversion of regulatory requirements into concrete practices and an interdisciplinary approach.
Law No. 9.605/1998 and the parameters of governance mechanisms for the implementation of internal controls regarding environmental matters
Law No. 9.605/1998 (Environmental Crimes Law) is central to environmental risk management, providing for the direct liability of legal entities and sanctions that may include the partial cessation of activities (Totoli, 2024). This legal regime increases organizations’ exposure to legal, operational, and reputational risks, requiring the systematic integration of the environmental dimension into integrity programs.
The risk matrix assumes a strategic role, and must expressly include environmental risks, such as potential impacts, probability of damage, and their legal, financial, and reputational consequences. The assessment of environmental integrity programs must go beyond the formal verification of licenses, incorporating continuous monitoring and oversight, such as periodic environmental audits, traceability of polluting processes, environmental due diligence of suppliers, and reporting channels. The integration between integrity, ESG, and environmental risk management broadens the concept of compliance to encompass the responsible management of socio-environmental impacts.
Strategic positioning of organizations in relation to ESG issues, considering their integration into decision-making processes, risk management, and the generation of sustainable long-term value.
Events such as Enel’s power outage in October 2024, which affected millions of consumers and was attributed to extreme weather events, illustrate the urgency of integrating environmental risks into contractual instruments and organizational strategies. Research from the Butantan Institute (2025) on changes in the distribution of climate-sensitive species, such as scorpions in hot regions, reinforces the understanding of the multidimensional impacts of climate change.
The Brazilian Corporate Governance Best Practices Code (IBGC, 2023) included sustainability as the fifth fundamental principle, defining it as essential for the longevity of organizations. Sustainability implies ensuring economic-financial viability, reducing negative externalities and increasing positive ones, considering all capitals (financial, human, natural, etc.) and the interdependence with social, economic, and environmental ecosystems (IBGC, 2023). The incorporation of sustainability requires concrete instruments and practices.
Creation of a governance instance for integrated ESG risk management
Given the intensification of extreme climate events, it is fundamental that organizations evolve towards formal and permanent structures for ESG risk governance. The creation of a multidisciplinary sustainability and risk committee is recommended, with strategic and cross-cutting action, composed of representatives from various areas. Its responsibilities include the continuous mapping of ESG risks and opportunities based on international standards, such as the guidelines of the Global Reporting Initiative (GRI). The committee must monitor physical and transition risks related to climate change, as well as social dynamics that affect the social license to operate. This body should be connected to senior management to integrate ESG risks into corporate strategy and sustainable value generation.
Creation of a risk matrix for distributing responsibilities between the organization and third parties
Law No. 14.133/2021 innovated by making the risk matrix a mandatory contractual instrument in bidding processes, aiming for greater rationality and predictability in the allocation of responsibilities. This mechanism seeks to overcome legal uncertainty and frequent contractual rebalancing, promoting efficiency, transparency, and stability. The matrix must identify supervening events, define each party’s responsibility, and assign financial burdens, materializing preventive management.
From an ESG perspective, the risk matrix allows mapping and distributing environmental, social, and governance risks, such as environmental liabilities and labor violations in the supply chain, encouraging responsible practices. It contributes to contractual governance, aligning expectations and strengthening controls, stimulating diligent behaviors committed to sustainable standards.
Mapping of present and future demands for the generation of sustainable value in the long term
The development of the dengue vaccine by the Butantan Institute, with approval in 2025 and vaccination in 2026, exemplifies how climate change, which favors the reproduction of the Aedes aegypti mosquito, generates new public health demands. The worsening of the dengue crisis, with a record number of deaths in 2024 (Brazil, 2024), highlights the influence of climatic factors.
Public governance plays a central role in strategic planning and interinstitutional articulation to combat dengue, which is integrated into the environmental and social dimensions of ESG. Risk anticipation and the incorporation of environmental variables into strategic planning are determining factors for the financial viability and longevity of organizations. Institutions will need to continuously adapt their business models in the face of environmental, social, and economic transformations, generating sustainable value by integrating ESG factors into decision-making processes, increasing adaptability, and contributing to the preservation of natural resources.
In summary, the analysis of the Brazilian normative framework, including Decrees No. 11,129/2022 and No. 12,304/2024, NR-1, and Law No. 9,605/1998, revealed a significant evolution in the structuring of integrity programs and ESG risk management. It was identified that legislation has progressively incorporated sustainability and human rights criteria, requiring the creation of multidisciplinary bodies and robust risk matrices to mitigate operational and reputational damage. The integration of psychosocial and environmental risks into internal controls strengthens organizational transparency and ethical culture, with the convergence between regulatory compliance and governance strategy being a determining factor for the generation of sustainable value and the longevity of organizations in the contemporary scenario, demanding the conversion of guidelines into concrete and measurable practices.
4. Conclusion
The study aimed to investigate how the structuring of integrity programs and corporate governance mechanisms acted in risk management and in ensuring institutional longevity. It was verified that the Brazilian legislative evolution, with emphasis on Decrees nº 11.129/2022 and nº 12.304/2024, on Regulatory Standard nº 1 and on Law nº 9.605/1998, progressively integrated sustainability and human rights criteria into compliance programs. It was identified that this integration required the creation of multidisciplinary bodies and structured risk matrices for the mitigation of operational and reputational damages. The incorporation of psychosocial and environmental risks into internal controls strengthened transparency and organizational ethical culture, especially in the face of scenarios of uncertainty and corporate fraud, such as the cases of Wirecard and Lojas Americanas. It was observed that mere formal compliance is insufficient, with the effective internalization of these guidelines into concrete practices being crucial to mitigate damages, as evidenced by the Mariana and Brumadinho disasters.
The study’s main contribution lies in demonstrating that the convergence between regulatory compliance and a proactive governance strategy is the determining factor for generating sustainable value and the longevity of organizations in the contemporary scenario. The creation of a multidisciplinary sustainability and risk committee and the implementation of responsibility distribution risk matrices between the organization and third parties were proposed, aiming for more integrated and preventive ESG risk management. However, it was found that the effectiveness of regulatory innovations still depends on the organizations’ ability to translate generic guidelines into measurable and auditable practices, which represents a limitation in the current implementation of the framework. It is suggested that future studies investigate the practical application and concrete results of these mechanisms, as well as the continuous improvement of the regulatory framework to ensure greater objectivity and traceability in decision-making processes. Anticipating future demands, such as those generated by climate change and its impacts on public health, is essential for the continuous adaptation of business models and the generation of long-term sustainable value.
Bibliographic References
BRASIL. 2024. Decreto nº 12.304, de 9 de dezembro de 2024. Diário Oficial da União, Brasília, DF, 10 dez. 2024. Seção 1, p. 9-10.
Cardoso, Pedro Miguel. 2017. Klein, Naomi (2016), Tudo pode mudar: capitalismo vs. clima. Tradução de Ana Cristina Pais. Disponível em: Acesso em: 21 abr. 2026.
Costa, Roberto Teixeira da; Pahim JR., Fabio. 2023. Crises financeiras: Brasil e mundo (1929-2023). 1ª ed. Portfolio-Penguin. São Paulo, São Paulo, Brasil.
Instituto Brasileiro de Governança Corporativa [IBGC]. 2023. Código das melhores práticas de governança corporativa. 6. ed. São Paulo: IBGC. Disponível em: . Acesso em: 19 abr. 2026.
Instituto Butantan, 2025 [Referência completa não encontrada no documento original]
Intergovernamental Panel on Climate Change [IPCC]. 2023. Climate Change 2023: Synthesis Report. Disponível em: . Acesso em: 19 abr. 2026.
Koch, C.; Denner, N. 2025. Greenwashing and ESG disclosure: a systematic literature review. Journal of Corporate Social Responsibility, v. 10, n. 1. Disponível em: . Acesso em: 21 abr. 2026.
Mazzucato, Mariana. 2014. O Estado empreendedor. 1. ed. Portfolio-Penguin, São Paulo, SP, Brasil.
Moodaley, K.; Telukdarie, A. 2023. The impact of greenwashing on sustainability reporting. Sustainability, v. 15, n. 2, p. 1481, Disponível em: . Acesso em: 21 abr. 2026.
Rittiner, D. 2026. Entidades lançam manifesto por código de conduta no STF. Brasília, 1 fev. 2026. Disponível
https://www.cnnbrasil.com.br/politica/entidades-lancam-manifesto-por-codigo-deconduta-no-stf/. Acesso em: 19 abr. 2026.
Sancak, I. E., & Loew, E. 2022. Revisiting corporate governance with wirecard in the post-Enron era. Disponível em: . Acesso em: 19 abr.2026.
Stern, Nicholas. 2007. The Economics of Climate Change: The Stern Review. Cambridge University Press, Cambridge, Reino Unido.
Totoli, Stella Soutto Mayor. 2024. Análise jurídico-penal da Lei n. 9.605/1998 e a proteção do meio ambiente. 1. ed. Lumen Juris. Rio de Janeiro – RJ. Brasil.
Article originating from the Final Course Work of the Specialization in Compliance and ESG from MBA USP/Esalq
To learn more about the course, click here and access the MBX Academy platform