ESG Risk Assessment Tool
A free exposure register for Indian companies and exporters. Four answers name the environmental, social and governance areas where exposure concentrates, put them in the order they warrant attention, and name the specific gap inside each one. The register issues no score, no rating and no grade, because a single blended number hides the one thing a company can act on, which is the named gap.
Reviewed by Team GreenSutra · Updated 4 August 2026
Build the ESG risk register
Four answers, named areas and named gaps, no score
Operations, the markets served, the pressure already received and the governance already in place decide where environmental, social and governance exposure concentrates. The register names the areas in the order they warrant attention and names the gap inside each one.
This register names where environmental, social and governance exposure concentrates for a given operating profile, and the specific gap inside each area. The full register is listed below. A readiness review works through each area against the source records.
Each area resolves into one of the following named bands, in fixed order: Close first, Close next, Keep under watch. No area is scored and nothing is summed across areas.
- Environment
Greenhouse gas and energy data
Buyer questionnaires, lender screens and border carbon mechanisms all open with Scope 1 and Scope 2 figures on a stated boundary and a stated method. Energy intensive production, or goods reaching the European Union, puts this area at the head of the register, because the request arrives with a deadline attached rather than as an enquiry.
- Organisational and operational boundary not fixed in writing
- Scope 1 and Scope 2 not compiled on the GHG Protocol Corporate Accounting and Reporting Standard
- No emission intensity stated against turnover or physical output
- No named owner inside the business for the emissions figure
- Meter, invoice and fuel records not retained as an evidence trail
- Environment
Water, waste and resource use
Process industries are asked for water consumption by source, discharge by destination and treatment level, and waste by type with the recovery route for each. Consumption is usually metered because it is billed. Discharge and recovery are usually not, which is where the register opens.
- Water discharge not resolved by destination and level of treatment
- Waste not separated by type, so the recovery route cannot be evidenced
- Intensity denominator not aligned with the one used for emissions
- No documented aggregation from site records to an entity total
- Social
Workforce conditions and safety records
Site based operations carrying contract and agency labour concentrate the social exposure that customer audits examine first. The two things asked for are the incident record on a stated basis, and whether contracted workers sit inside or outside the reporting boundary. An unclear boundary is read as an unmanaged one.
- Injury record not expressed as a rate on a stated basis
- Contract and agency workers outside the safety reporting boundary
- No documented grievance channel with a recorded closure trail
- Safety and human rights training not recorded against named roles
- Social
Supplier and value chain conditions
Where a buyer code or a due diligence expectation reaches upstream, value chain claims rest on evidence rather than assertion. The OECD due diligence framework treats this as a repeating cycle rather than a one off audit, so a single completed questionnaire does not close it.
- Suppliers not segmented by spend, criticality, country and sector
- No supplier code, or a code with no audit trail behind it
- No corrective action route, so a finding has nowhere to go
- Visibility stops at direct suppliers, with no cascade requirement beyond
- Governance
Board oversight of sustainability
Investor and lender diligence looks for the mandate before it looks for the numbers. Where no board committee holds sustainability and no policy set is approved at board level, the governance record is the first thing a diligence process finds missing, and the environmental and social data behind it is then read with less confidence. For listed entities within scope, SEBI places sustainability and ESG risk expressly inside the risk management committee mandate.
- No board committee holds the sustainability mandate
- Policy set not approved at board level or not published
- No minute trail evidencing that oversight actually occurred
- No stated reporting basis such as GRI, SASB, TCFD or CDP
- Governance
Sustainability data controls
Sustainability figures are increasingly read by parties who test them, and a number with no control behind it cannot survive that reading. The minimum is that the person who generates a figure is not the person who signs it off, and that every disclosed figure traces back to a source document.
- No separation between the role that prepares a figure and the role that approves it
- No audit trail from source document through calculation to disclosed figure
- No version or access control over the workbook the figures are built in
- No stated recalculation policy, so a corrected prior year cannot be explained
- Environment
Greenhouse gas and energy data
Close firstClose nextKeep under watchBuyer questionnaires, lender screens and border carbon mechanisms all open with Scope 1 and Scope 2 figures on a stated boundary and a stated method. Energy intensive production, or goods reaching the European Union, puts this area at the head of the register, because the request arrives with a deadline attached rather than as an enquiry.
Fuel and electricity records exist for cost control but have not been converted into an emissions inventory on a recognised method. The gap surfaces the first time a customer, lender or platform asks for a figure with a boundary attached, and the answer then has to be assembled under time pressure.
Neither the operations nor the markets served put immediate pressure on emissions data. The area stays on the register because a single export contract, a listed customer or a lending covenant moves it without notice.
- Organisational and operational boundary not fixed in writing
- Scope 1 and Scope 2 not compiled on the GHG Protocol Corporate Accounting and Reporting Standard
- No emission intensity stated against turnover or physical output
- No named owner inside the business for the emissions figure
- Meter, invoice and fuel records not retained as an evidence trail
- Environment
Water, waste and resource use
Close firstClose nextKeep under watchProcess industries are asked for water consumption by source, discharge by destination and treatment level, and waste by type with the recovery route for each. Consumption is usually metered because it is billed. Discharge and recovery are usually not, which is where the register opens.
Site totals exist but are not resolved by source, destination or waste stream, and the denominator used for intensity does not match the one used for emissions. Alignment across the environmental metrics is what makes the set readable to an external party.
The operating profile keeps water and waste below the immediate exposure of the areas above. It stays on the register because a new site, a new process or a customer packaging requirement changes what is asked for.
- Water discharge not resolved by destination and level of treatment
- Waste not separated by type, so the recovery route cannot be evidenced
- Intensity denominator not aligned with the one used for emissions
- No documented aggregation from site records to an entity total
- Social
Workforce conditions and safety records
Close firstClose nextKeep under watchSite based operations carrying contract and agency labour concentrate the social exposure that customer audits examine first. The two things asked for are the incident record on a stated basis, and whether contracted workers sit inside or outside the reporting boundary. An unclear boundary is read as an unmanaged one.
Statutory registers are maintained, but the safety record is not expressed as a rate a customer audit can compare, and the coverage of contracted workers is not stated. The information exists. The shape it is held in does not answer the question.
The workforce profile keeps this area below the immediate exposure of the areas above. It remains on the register because a single reportable incident, or the addition of a site based contract, changes what a buyer asks for.
- Injury record not expressed as a rate on a stated basis
- Contract and agency workers outside the safety reporting boundary
- No documented grievance channel with a recorded closure trail
- Safety and human rights training not recorded against named roles
- Social
Supplier and value chain conditions
Close firstClose nextKeep under watchWhere a buyer code or a due diligence expectation reaches upstream, value chain claims rest on evidence rather than assertion. The OECD due diligence framework treats this as a repeating cycle rather than a one off audit, so a single completed questionnaire does not close it.
Suppliers have signed an undertaking, but nothing behind it records what was checked, when, or what happened to a finding. Coverage cannot be evidenced when a customer asks which suppliers were assessed and on what basis.
The supply profile keeps this area below the immediate exposure of the areas above. It stays on the register because supplier concentration, a new sourcing country or a customer cascade clause moves it quickly.
- Suppliers not segmented by spend, criticality, country and sector
- No supplier code, or a code with no audit trail behind it
- No corrective action route, so a finding has nowhere to go
- Visibility stops at direct suppliers, with no cascade requirement beyond
- Governance
Board oversight of sustainability
Close firstClose nextKeep under watchInvestor and lender diligence looks for the mandate before it looks for the numbers. Where no board committee holds sustainability and no policy set is approved at board level, the governance record is the first thing a diligence process finds missing, and the environmental and social data behind it is then read with less confidence. For listed entities within scope, SEBI places sustainability and ESG risk expressly inside the risk management committee mandate.
Some oversight exists in practice but is not evidenced in a form an external reader can test: a mandate without minutes, or policies without board approval and publication. The distance between practice and record is the exposure.
A committee, an approved policy set and a named data owner are already in place. The area stays on the register because oversight has to be evidenced each year, and because adopting a reporting basis such as GRI, SASB, TCFD or CDP adds obligations the existing mandate may not yet cover.
- No board committee holds the sustainability mandate
- Policy set not approved at board level or not published
- No minute trail evidencing that oversight actually occurred
- No stated reporting basis such as GRI, SASB, TCFD or CDP
- Governance
Sustainability data controls
Close firstClose nextKeep under watchSustainability figures are increasingly read by parties who test them, and a number with no control behind it cannot survive that reading. The minimum is that the person who generates a figure is not the person who signs it off, and that every disclosed figure traces back to a source document.
Figures are compiled once a year in a spreadsheet assembled for the purpose, with no version control, no access control and no attachment of the underlying evidence. It produces a number. It does not produce a number anyone can retrace.
Ownership and a published report are already in place. The area stays on the register because controls are tested only when someone external follows a figure back to its source, which is usually the first year assurance readiness is attempted.
- No separation between the role that prepares a figure and the role that approves it
- No audit trail from source document through calculation to disclosed figure
- No version or access control over the workbook the figures are built in
- No stated recalculation policy, so a corrected prior year cannot be explained
No exposure area in this register is named by the answers given. That is an unusual result, and it usually means the questions were answered for a narrower entity than the one that actually carries the obligations. It is worth running the register again for the whole reporting boundary.
Answers stay in this browser. Nothing is transmitted, stored or collected, and no contact detail is asked for.
How the register is built
Four inputs, named areas, named gaps
Sector and operations decide which environmental and social areas carry weight before anything else is considered.
The markets served and the requests already received decide how soon an area has to be closed.
What already exists is credited, so the register names what is missing rather than what is present.
Each area resolves independently into a named band, with the specific gaps inside it named separately.
What the register names, and what it deliberately does not
Named categories, never a score
An ESG risk assessment is the step that turns a general sense of exposure into a list a business can act on. This register does that in a deliberately narrow way. It names the environmental, social and governance areas where exposure concentrates for a given operating profile, puts them in the order they warrant attention, and names the specific gap inside each one.
It issues no score, no rating and no grade. That is a design decision, not a limitation. A single blended number is the one output a company cannot act on: it compresses an evidence gap, a governance gap and a measurement gap into one figure, and hides which of the three is actually the problem. Ranking here is ordinal over named categories, so the words carry the meaning and nothing is summed.
Each area resolves on its own. There is no aggregation across areas, no total and no average, which means an area that is genuinely well managed does not mask one that is not. Rating providers issue ratings and platforms issue scores; this register does neither, and is not a substitute for either.
A worked example
An energy intensive exporter with no governance in place
Consider a textile processor with energy intensive operations, exporting to the European Union, that has already received a buyer sustainability questionnaire and has none of the listed governance in place.
| Area | Band | Why it lands there |
|---|---|---|
| Greenhouse gas and energy data | Close first | Energy intensive operations and EU market access, either of which alone would place it here |
| Water, waste and resource use | Close first | Energy intensive processing carries metered consumption but rarely resolved discharge |
| Workforce conditions and safety | Close first | Energy intensive sites concentrate the exposure customer audits examine first |
| Supplier and value chain conditions | Close first | EU market access with no supplier code and no audit trail behind it |
| Board oversight of sustainability | Close first | No governance selected at all, so the mandate is absent rather than merely unevidenced |
| Sustainability data controls | Close next | No named data owner, though no investor or platform request has arrived yet |
Five areas land in the first band and one in the second. The register does not say the company scores poorly, because it issues no score. It says which six things are missing and which five of them a buyer is most likely to ask about first, which is a list somebody can start on.
Why a register rather than a score
What each choice buys
A gap can be closed
A named gap points at one piece of work. A score points at nothing, because it does not say which component moved it.
Areas do not mask each other
Nothing is aggregated, so a well managed area cannot offset one that is not. Both appear on their own terms.
Order carries the urgency
Named bands say what to close first without implying a measurement that was never taken.
Nothing is collected
The register runs in the browser. No email is asked for and no answer leaves the page.
ESG risk assessment questions, answered
Q·01Does this tool give an ESG score?
Q·02How are the areas ranked if nothing is scored?
Q·03Is this an ESG rating or an assessment by GreenSutra?
Q·04What does the register actually use to decide?
Q·05Is any of the information submitted or stored?
Q·06Does this replace a materiality assessment?
Q·07How does this relate to BRSR reporting?
Q·08What happens after the register is built?
Primary sources
What the register relies on
Request an ESG readiness review
A short conversation about the named gaps, the frameworks that apply and the disclosure ahead turns the register into a scoped plan. Schedule a call directly or send a written brief.
Pick the service and a slot; a practitioner takes the call.
Related services
Maintained by GreenSutra · Last reviewed August 2026