Fair Trade & Ethical Sourcing

No substantiated forced or child labour findings have been reported for the last three years (2022-2024), with zero investigations into modern slavery reports during this period

and no related whistleblowing issues in 2023. Proactive risk assessments are ongoing. Tier 1 suppliers undergo re-accreditation every 24 months.

No War, No Weapons

Morgan Sindall Group plc, a construction and regeneration company, allocated approximately 0.0378% of its £4.5bn revenue to charity in 2024, which falls under unfocused peace/disarmament grants.

The company supports the UN Guiding Principles on Business and Human Rights, with its Human Rights Policy, adopted by the Board on August 1, 2022, referencing these principles and stating continuous evaluation of operations and supply chain to identify and address human rights risks. The company's core business does not involve arms or defense contracts, dual-use technology, sales to embargoed regimes, or military AI, making these activities not applicable.

Safe & Smart Tech

The company has a maximum data retention period of 15 years.

However, it has no documented data breaches and maintains a strong security program with a preventative focus, including investment in new backup and disaster recovery capabilities, enhanced visibility of security events, and additional controls implemented in 2024. The company re-certified to ISO 27001 and the government's Cyber Essentials Plus Scheme. It trains all employees in data protection and information security, including awareness and responsibilities. There are no documented incidents of unauthorized data use, supported by excellent data governance, preventative controls, and ongoing risk assessments of digital supply chain partners following NCSC guidance. Users have industry-standard rights to access, rectify, erase, restrict processing, receive data, object to processing, and withdraw consent, with requests responded to within one month. The company follows NCSC guidance on third-party risk management and performs ongoing risk assessments, stating it takes data protection laws seriously.