CSR cheat sheet

IFRS S1 (general sustainability disclosures) and IFRS S2 (climate) were issued by the ISSB in June 2023; both use the TCFD architecture of governance, strategy, risk management, and metrics and targets.

IFRS S1 requires disclosure of material information about sustainability-related risks and opportunities that could affect enterprise value, including industry-based metrics derived from the SASB Standards.

GRI Standards are impact-focused and multi-stakeholder; GRI 1, GRI 2 (general disclosures), and GRI 3 (material topics) form the universal set applied before topic-specific standards.

The CDP questionnaire is scored on disclosure, awareness, management, and leadership levels; a submitted response is not the same as third-party assurance of the data.

TCFD recommendations are structured around four pillars and eleven recommended disclosures; the framework was disbanded in 2023 with monitoring transferred to the ISSB.

Integrated reporting under the IFRS Integrated Reporting Framework is organized around six capitals and the value creation process over the short, medium, and long term.

Double materiality distinguishes financial materiality (impacts on the company) from impact materiality (company effects on people and environment); the EU CSRD adopts both.

SASB industry standards provide financially material, industry-specific metrics; they were folded into the ISSB's industry-based guidance rather than maintained as a standalone board.

Materiality is a threshold, not a topic list: a matter is material if omitting or misstating it could influence decisions of primary users of the report.

A documented materiality process typically includes identification, prioritization (scoring likelihood and magnitude of impact), validation, and periodic review.

Stakeholder engagement should record who was engaged, the method, the date, and how input changed the reported topics; undocumented engagement is hard to defend in assurance.

Double materiality scoring combines an impact axis (scale, scope, irremediability) with a financial axis (likelihood and magnitude of financial effect).

The AA1000 Stakeholder Engagement Standard (AA1000SES) sets principles of inclusivity, materiality, responsiveness, and impact for engagement quality.

Materiality thresholds should be revisited annually and whenever strategy, regulation, or the business portfolio changes materially.

Value-chain materiality requires screening upstream suppliers and downstream use-phase impacts, not only owned operations.

A materiality matrix plots topics by stakeholder importance against business impact; the axes and scoring method must be disclosed to be meaningful.

ISAE 3000 (Revised) governs assurance of non-financial information; limited assurance yields a negative-form conclusion ('nothing has come to our attention'), reasonable assurance yields a positive opinion.

The GHG Protocol Corporate Standard sets the operational boundary concepts: equity share, financial control, and operational control approaches.

Data quality hierarchies rank metered/measured data above calculated data above supplier-estimated or spend-based estimates.

A robust control environment for ESG data includes source documentation, reconciliation to the general ledger, segregation of duties, and an audit trail of changes.

Assurance readiness requires a defined reporting boundary, documented methodologies, and evidence retained at the level at which the metric is aggregated.

Unit-of-measure errors are a leading cause of restatements; conversion factors and their sources should be version-controlled and disclosed.

Restatements of prior-period ESG metrics should be disclosed with the reason and the restated figure, mirroring financial reporting practice.

The internal audit function or a qualified internal reviewer can perform readiness reviews, but independence rules mean the assurance provider should not prepare the data it assures.

Scope 1 covers direct emissions from owned or controlled sources; Scope 2 covers purchased electricity, steam, heat, and cooling; Scope 3 covers all other value-chain emissions across 15 categories.

Scope 2 has two methods: location-based (grid average emission factor) and market-based (contractual instruments such as RECs, GOs, and PPAs).

The GHG Protocol requires reporting all seven Kyoto gases or a CO2-equivalent aggregate using GWP values from the applicable IPCC Assessment Report, stated explicitly.

Scope 3 Category 1 (purchased goods and services) and Category 11 (use of sold products) are frequently the largest categories for many sectors.

The GHG Protocol Corporate Standard uses the equity share or control approach for consolidation; the chosen approach must be applied consistently.

IFRS S2 requires Scope 1, Scope 2, and (where material) Scope 3 GHG emissions, plus intensity metrics and climate-related targets and progress.

The GHG Protocol Scope 3 Standard sets the minimum boundary: companies must include all relevant categories and justify exclusions.

Climate scenario analysis under TCFD/IFRS S2 uses at least a 2°C-or-lower scenario and a business-as-usual scenario to test strategy resilience.

A sustainability report should disclose the reporting period, boundary, reporting standards used, and any restatements of prior data.

Balanced reporting requires disclosing unfavorable performance alongside favorable results; selective disclosure undermines credibility.

Comparability requires at least three years of trend data for key metrics where available, with consistent methodology and disclosed changes.

The GRI content index maps each disclosed standard to the report location, ensuring completeness and traceability.

Narrative quality depends on specific, quantified claims; vague statements such as 'committed to sustainability' without targets or baselines add little.

Assurance statements should identify the standard used (e.g., ISAE 3000), the scope, the level of assurance, and the metrics covered.

Targets should state the baseline year, target year, metric, and boundary; SBTi-aligned targets typically require near-term (5–10 year) and net-zero (by 2050) commitments.

Forward-looking statements should be labeled as such and accompanied by the assumptions and uncertainties underlying them.

The EU Corporate Sustainability Reporting Directive (CSRD) applies in phases from FY2024, with the first wave covering large public-interest entities with over 500 employees.

The European Sustainability Reporting Standards (ESRS) comprise cross-cutting standards (ESRS 1, ESRS 2) and topical standards (E1–E5 environmental, S1–S4 social, G1 governance).

The EU Corporate Sustainability Due Diligence Directive (CSDDD) imposes human rights and environmental due diligence obligations on in-scope companies and their value chains.

The UK's Companies (Strategic Report) (Climate-related Financial Disclosure) Regulations 2022 require TCFD-aligned disclosure for qualifying companies.

California's SB 253 (Climate Corporate Data Accountability Act) requires large companies doing business in California to report Scope 1, 2, and 3 emissions; SB 261 requires climate-related financial risk disclosure.

The EU Taxonomy Regulation defines environmentally sustainable economic activities via substantial contribution, do-no-significant-harm, and minimum social safeguards criteria.

The SFDR requires financial market participants to classify products as Article 6, 8, or 9 based on sustainability characteristics and objectives.

The CSRD requires limited assurance of sustainability information, with a pathway to reasonable assurance, and digital tagging of reported data in XBRL.

XBRL (eXtensible Business Reporting Language) is the standard format for structured digital reporting; the IFRS Sustainability Disclosure Taxonomy enables tagging of ISSB-aligned disclosures.

The EU requires digital tagging of CSRD sustainability statements using the ESEF/ESRS XBRL taxonomy, with block tagging and detailed tagging of narrative and numeric facts.

A taxonomy defines concepts, labels, and relationships; an instance document contains the tagged facts and their contexts (entity, period, unit).

Inline XBRL (iXBRL) embeds tags in an HTML document, allowing a single human-readable and machine-readable file.

The LEI (Legal Entity Identifier) is the standard identifier for reporting entities in digital filings; it disambiguates legal entities across jurisdictions.

Data quality in digital reporting depends on consistent use of contexts, units (e.g., tCO2e), and dimensions; incorrect contexts are a common tagging error.

The IFRS Foundation's ISSB taxonomy and the ESRS taxonomy are distinct; filers must apply the taxonomy mandated by their jurisdiction.

Open data formats and APIs improve comparability and enable automated extraction, but comparability depends on consistent concept definitions across taxonomies.

Independence: the assurance provider should not have provided consultancy that creates a self-review threat over the same subject matter.

Objectivity requires disclosing conflicts of interest, including commercial relationships with the reporting entity or its stakeholders.

Confidentiality obligations apply to non-public ESG data, but professional standards permit disclosure where required by law or regulation.

Greenwashing risk arises from unsubstantiated claims, selective disclosure, or misalignment between reported targets and capital allocation.

Board oversight of sustainability should be documented through committee charters, meeting minutes, and defined accountability for ESG data.

Whistleblowing and grievance mechanisms should be accessible, confidential, and reported on with metrics such as cases received and resolved.

Professional competence requires staying current with evolving frameworks and standards; outdated methodology is a conduct issue, not just a technical one.

The 'comply or explain' principle applies to some codes and standards; explanations for non-compliance must be substantive and specific.