10 Things to Do for ESG/CSRD Compliance

The Corporate Sustainability Reporting Directive (CSRD) is one of the most significant expansions of mandatory corporate reporting in EU history. Large companies are required to disclose sustainability information — environmental, social, and governance — as part of their annual reports, subject to external assurance.

But CSRD's reach extends well beyond the large companies directly in scope. The value chain reporting requirements mean that if you supply to a large company that is required to report under CSRD, their data collection obligations flow downstream to you. Supplier questionnaires, data requests, and contractual obligations to provide sustainability metrics are already becoming standard.

Here is what you need to do.

1. Determine if you are directly in scope

CSRD currently applies in phases:

• Large companies (already in scope from FY2024/2025): more than 250 employees, and EUR 40M+ in net turnover or EUR 20M+ on the balance sheet
• Listed SMEs (delayed to FY2026/2027): SMEs listed on EU regulated markets, with a simpler reporting standard
• Third-country companies (FY2028/2029): non-EU companies with significant EU operations (EUR 150M+ in EU turnover and an EU subsidiary or branch)

Even if you are not directly in scope, you are likely to be drawn into CSRD through your value chain. If any of your significant customers are large companies reporting under CSRD, you should expect to receive requests for your sustainability data.

2. Conduct a double materiality assessment

The core analytical requirement of CSRD — and the concept that causes most confusion — is double materiality. You must assess sustainability topics from two perspectives simultaneously:

Impact materiality: What impacts does your business have on people, communities, and the environment? This includes both positive and negative impacts, actual and potential, across your value chain.

Financial materiality: Which sustainability-related risks and opportunities could affect your business financially — revenues, costs, access to capital, reputation, regulatory exposure?

A topic can be material from one perspective, both, or neither. The double materiality assessment drives which topics you report on under the European Sustainability Reporting Standards (ESRS). It must be documented, involve stakeholder input, and be revisited regularly.

3. Map your Scope 1 emissions

Scope 1 emissions are direct greenhouse gas emissions from sources owned or controlled by your organisation. This includes combustion in boilers, furnaces, and vehicles; company-owned vehicle fleets; and emissions from owned or controlled industrial processes.

These emissions are the most straightforward to measure because they come from your own operations. They must be quantified in tonnes of CO₂ equivalent, attributed to their sources, and documented with the methodology used. This data is the baseline from which your emission reduction targets are set.

4. Map your Scope 2 emissions

Scope 2 emissions are indirect emissions from purchased electricity, heat, steam, and cooling. When you buy electricity from the grid, the emissions associated with generating that electricity are your Scope 2 emissions.

For many businesses — particularly those without significant manufacturing operations — Scope 2 is a larger emissions source than Scope 1. If your organisation relies on cloud infrastructure, data centres, or third-party computing facilities, the emissions from those facilities' electricity consumption are your Scope 2 emissions.

Calculate these using either the location-based method (grid average emission factor) or the market-based method (specific contracts and certificates). ESRS requires disclosure of both where possible.

5. Begin mapping Scope 3 emissions across your value chain

Scope 3 emissions are all other indirect emissions across your value chain — upstream (suppliers, purchased goods and services, business travel, employee commuting) and downstream (use of your products by customers, end-of-life treatment).

For most organisations, Scope 3 represents the largest share of total emissions — often 70% or more. It is also the hardest to measure because it requires data from third parties. Most companies have little or no data for most Scope 3 categories when they start.

Begin with the categories most material to your business. Identify your highest-spend supplier categories. Estimate what you can estimate. Build data collection processes for the rest. Perfect accuracy from year one is not achievable — the expectation is that your Scope 3 data improves over time.

6. Collect your social metrics

CSRD and the ESRS require disclosure across the "S" in ESG as well. Under ESRS S1 (Own Workforce), you must report:

• Workforce headcount, broken down by contract type, gender, and geography
• Working conditions: wages relative to living wages, working hours, work-life balance policies
• Health and safety performance: injury rates, work-related illnesses, fatalities
• Equal treatment and opportunities: gender pay gap, diversity in management and governance
• Social dialogue and freedom of association

This data is typically spread across HR systems, payroll, and management reporting. Consolidating it for CSRD reporting requires building data collection processes that don't currently exist in most organisations.

7. Document your governance structure for sustainability

CSRD explicitly requires reporting on governance — how your board and senior management oversee sustainability matters, what your sustainability policies are, what targets you have committed to, and who is accountable for delivering them.

This includes: the role of the board in overseeing sustainability strategy, how sustainability risks and opportunities are integrated into decision-making, what sustainability targets the organisation has adopted, and the incentive structures that link executive compensation to sustainability performance.

"We have an ESG policy" is not sufficient. Governance disclosures must describe specific roles, responsibilities, oversight processes, and targets with measurable outcomes.

8. Align your reporting framework with ESRS

The European Sustainability Reporting Standards (ESRS) are the mandatory reporting framework for CSRD. The ESRS specify exactly what must be disclosed, how it must be presented, and in what level of detail. Generic sustainability reports, GRI-aligned reports, or internal sustainability policies do not satisfy CSRD requirements.

There are twelve ESRS standards covering: cross-cutting requirements (ESRS 1 and 2), environmental topics (climate, pollution, water, biodiversity, resource use), social topics (own workforce, workers in the value chain, affected communities, consumers), and governance (business conduct).

Reporting must follow the structure and disclosure requirements of the ESRS. Work through each relevant standard in the context of your double materiality assessment to determine what must be disclosed.

9. Prepare for external assurance

CSRD requires limited assurance on sustainability reporting from an accredited third-party auditor (with the expectation of moving to reasonable assurance in future years). This means your sustainability data must meet the same standards of traceability, consistency, and documentation that your financial data meets.

Each data point in your sustainability report must be traceable to a source. Methodologies must be documented. Estimates must be explained and justified. Gaps must be disclosed with reasons. Your auditor will review the data and the process, not just the final numbers.

Start building your data collection and documentation practices as if audit readiness is the goal from day one. Retrofitting auditability onto data that wasn't collected with assurance in mind is expensive and time-consuming.

10. Integrate sustainability reporting into your annual reporting cycle

CSRD disclosures must be included in your management report — published alongside your financial statements, not in a separate sustainability report issued at a different time. This integration requirement has significant practical implications.

The reporting process for sustainability information must be governed, scheduled, reviewed, and signed off in the same way as financial reporting. Finance, legal, operations, HR, and procurement all have data to contribute. The sustainability reporting team must work to the same calendar as the finance team.

If sustainability reporting has been an add-on exercise managed separately from financial reporting, that model needs to change. The integration of sustainability and financial reporting is a design requirement of CSRD, not an administrative preference.

Knowing the 10 steps and having them documented, monitored, and auditable are two different things.

CSRD compliance requires data collection across your entire organisation, external assurance, and integration into annual reporting. The organisations that get ahead of it now will have auditable baseline data by the time their reporting obligations begin.

This article is for informational purposes only and does not constitute legal advice. For legal advice specific to your situation, consult a qualified attorney licensed in your jurisdiction.