ESG Reporting: How to Build Numbers You Can Defend

The sustainability team is preparing the annual report when someone from finance asks a simple question: "Where did this number come from?" The team has a figure for energy use, but the facilities manager has another. Procurement has supplier data in a separate spreadsheet, and nobody is completely sure which reporting period each figure covers.

The problem is not necessarily that the company has bad data. It is that nobody built a clear process for turning that data into a number the business can stand behind. For compliance professionals looking to strengthen their understanding of ESG reporting, disclosure requirements, and supporting evidence, the Certified Compliance Professional certification can provide a useful foundation. This post covers what ESG reporting is, which standards shape it, how to organize the underlying data, and how to produce numbers that can hold up when someone asks where they came from.

What is ESG reporting?

ESG reporting is the practice of measuring and disclosing how an organization performs on environmental, social and governance issues. Environmental topics include emissions, energy, water and waste. Social topics cover employees, health and safety, supply chain conditions and communities. Governance covers board structure, ethics, anti-corruption and how the company manages risk.

The audience is wide: investors comparing companies, lenders setting terms, regulators checking compliance, customers choosing suppliers and employees deciding where to work. Some reporting is voluntary, while a growing number of jurisdictions make parts of it mandatory. Either way, the report is a set of claims a company makes in public, and those claims need evidence behind them, the same as a financial statement.

Frameworks, standards and rules

There's no single global rulebook, and the landscape keeps shifting. Most companies work with a mix of voluntary frameworks and legal requirements:

• the Global Reporting Initiative (GRI) standards, which focus on a company's impact on the economy, environment and people

• the ISSB standards, IFRS S1 and S2, which focus on sustainability information that matters to investors

• the EU's Corporate Sustainability Reporting Directive and its reporting standards, which apply a double materiality view

• CDP, a disclosure platform where companies report on climate, water and forests

National and regional rules add another layer. Several jurisdictions have adopted or are moving toward ISSB-based requirements, while others have their own regimes. Scope, thresholds and timelines in some of these rules have been revised or delayed in recent years, so it pays to check where your company currently sits rather than relying on last year's assumptions. Whichever framework applies, pick one primary standard, map your data to it and be clear in the report about which one you followed.

Materiality: deciding what belongs in the report

Reporting on everything produces a long document nobody reads. Materiality is how you decide what matters. Under an investor-focused view, a topic is material if it could affect the company's value or prospects. Under a double materiality view, used in the EU approach, a topic also counts if the company has a significant impact on people or the environment, whether or not it affects the bottom line.

A credible assessment follows a process: build a long list of possible topics, consult employees, customers, investors and other stakeholders, score each topic for impact and likelihood, and have leadership review the results. Write down who was asked, what they said and why topics were included or left out. Regulators and assurance providers increasingly ask to see that trail, and it stops the report from drifting toward whatever sounds best.

From reporting to targets

Reporting shouldn't be a standalone exercise. Set targets tied to the material topics, assign each to an executive, and report progress against them year on year, including misses. Consistency and candor usually build more trust than polish, and a target missed with an honest explanation reads better than one quietly dropped. Link some executive incentives to the targets only where the metrics are reliable.

Collecting data you can trust

ESG data comes from everywhere: utility bills, HR systems, supplier surveys, safety logs, board records. Each figure needs a clear definition, a named owner and evidence behind it. Typical metrics include:

• environmental: greenhouse gas emissions, energy use, water withdrawal and waste

• social: workplace injuries, employee turnover, training hours and pay data

• governance: board composition, ethics reports and their outcomes, and policy training completion

Treat the process like financial reporting. Agree definitions before collection starts, use the same boundary and baseline year throughout, reconcile totals and keep the source files. Spreadsheets emailed between teams are where numbers go missing, so many companies move to dedicated software that links data sources and controls who can change what. Finance, sustainability and IT need enough shared vocabulary to design that system, and the Tech Certifications from Global Tech Council are one way to build it.

Why Scope 3 is the hard part

Emissions are usually grouped into three scopes under the Greenhouse Gas Protocol. Scope 1 covers direct emissions from sources the company owns, Scope 2 covers purchased energy and Scope 3 covers everything else in the value chain, from suppliers to product use. Scope 3 is often the largest share and the hardest to measure, because the data sits with other companies. Start with estimates based on spend or average factors, be open about the method and improve the data over time.

Telling the story without greenwashing

Once the numbers exist, the temptation is to make them sound as good as possible. Vague phrases like "eco-friendly" or "planet-positive" and claims that rest on a favorable baseline year invite challenge, and advertising and consumer protection regulators in many regions have been paying closer attention to environmental claims. A claim should be specific, measurable and backed by evidence you could hand over tomorrow. If the reduction came from selling a factory, say so.

This is a marketing question as much as a reporting one. The people who write campaign copy, product pages and social posts need to know what the report actually says and which claims have been checked. A review step before anything goes public saves awkward corrections later. Marketers who understand how audiences, messaging and measurement work are better placed to tell an honest sustainability story, and the Digital Marketing Course from Universal Business Council is one place to build that grounding.

Assurance and the audit trail

Investors and regulators trust ESG data more when someone independent has checked it. Assurance comes in two levels: limited assurance, where the provider does enough work to say nothing appears to be wrong, and reasonable assurance, a deeper examination closer to a financial audit. Rules in some regions are phasing in requirements for one or both, so companies benefit from getting ready early.

Whatever level applies, the checker will ask how each figure was produced. That means keeping the source data, the calculation, the assumptions and the approvals in one traceable place. Time-stamped logs and version history make it easy to show what changed and when. Blockchain-based records are one way to make sustainability data and supplier evidence tamper-evident, and the Deep Tech Certifications are a good place to see how that works in practice. Whatever the tool, the rule is simple: if you can't show where a number came from, don't publish it.

Two companies, one sustainability report

Two manufacturers publish a report claiming a 20 percent drop in energy use per unit. Company A keeps a data dictionary, meter readings from each site, a documented boundary and a sign-off log. Company B collected numbers by email and pasted them into a slide. A journalist asks both how the figure was calculated. Company A answers within a day and its assurance provider signs off without changes. Company B discovers that one site was left out and two months of readings were counted twice, and it has to issue a correction.

Who owns ESG reporting?

ESG reporting touches finance, sustainability, HR, operations, procurement, legal and communications, which makes it easy for nobody to own the whole thing. Give the process a named owner and a cross-functional working group, with sign-off from a senior executive and oversight from the board or its audit committee. The owner keeps the calendar, chases data, manages the materiality process, tracks rule changes and makes sure claims in marketing match the report. The Certified Compliance Professional certification from Universal Business Council is aimed at practitioners who build and run this kind of program.

A reporting cycle from start to finish

A steady calendar prevents the year-end rush. A workable cycle:

1. Confirm which standards and rules apply, and refresh the materiality assessment.

2. Set data definitions, owners and deadlines for each metric.

3. Collect data through the year, reconciling quarterly rather than once.

4. Draft the report, then have legal, finance and marketing check every claim.

5. Arrange assurance and answer the provider's questions.

6. Publish, gather feedback and record what to improve next year.

Conclusion

ESG reporting turns a company's environmental, social and governance performance into public claims, and those claims are only as good as the process behind them. That process starts with knowing which standards and rules apply, choosing what's material and setting targets tied to those topics. It depends on data with clear definitions and owners, controls like those used in financial reporting and honest handling of hard areas like Scope 3.

Add care in how the story is told, so marketing copy matches the report and vague green claims stay out. Prepare for assurance by keeping a traceable trail for every figure, name one owner with board oversight and follow a steady yearly cycle. Do that, and when an investor asks how a number was calculated, the answer is a file, not a scramble.

FAQs

1. What is ESG reporting?

Measuring and disclosing how an organization performs on environmental, social and governance issues.

2. Who uses ESG reports?

Investors, lenders, regulators, customers, employees and other stakeholders.

3. Is ESG reporting mandatory?

It depends on the jurisdiction, company size and sector. Some regimes require it, and others treat it as voluntary.

4. What does ESG stand for?

Environmental, social and governance.

5. What are the main ESG reporting frameworks?

Commonly used ones include GRI, the ISSB standards, the EU's CSRD reporting standards and CDP.

6. What is materiality in ESG reporting?

A test for deciding which topics matter enough to report, based on financial effect, impact on people and the environment, or both.

7. What is double materiality?

A view that counts both how sustainability issues affect the company and how the company affects people and the environment.

8. What are Scope 1, 2 and 3 emissions?

Scope 1 is direct emissions, Scope 2 is purchased energy and Scope 3 is everything else in the value chain.

9. Why is Scope 3 so hard to measure?

Most of the data sits with suppliers and customers, so companies often start with estimates.

10. What social metrics are typically reported?

Health and safety, employee turnover, training, diversity and pay data, and supply chain conditions.

11. What governance topics are covered?

Board structure, ethics, anti-corruption, risk management and policy oversight.

12. What is greenwashing?

Making environmental claims that are vague, exaggerated or unsupported by evidence.

13. What is ESG assurance?

Independent checking of reported ESG data, at a limited or reasonable level.

14. What is the difference between limited and reasonable assurance?

Limited assurance involves less work and gives a lower level of comfort, while reasonable assurance is closer to a financial audit.

15. Who should own ESG reporting?

A named owner leading a cross-functional group, with sign-off from senior leadership and oversight from the board or audit committee.

16. How is ESG data controlled?

With clear definitions, named owners, evidence, reconciliations and restricted access, as with financial data.

17. Should companies set ESG targets?

Yes, tied to material topics and reported against each year, including misses.

18. How often should ESG data be collected?

Ideally through the year with quarterly reconciliation, not in a single year-end rush.

19. What should marketing teams know about ESG claims?

Every public claim should match the report and be specific, measurable and backed by evidence.

20. Where should a company start?

Confirm which rules apply, run a materiality assessment and set definitions and owners for the key metrics.