What internal controls does ESG data need?

QuestionsCategory: ESGWhat internal controls does ESG data need?
1 Answers
Best Answer
Team GreenSutra Staff answered 17 hours ago
Flat editorial night illustration: Two faceless figures stand on separate raised platforms separated by a narrow gap of night.

ESG data needs the same control types long applied to financial data: completeness, accuracy, cut-off, authorisation and consolidation. Maker-checker review is the baseline expectation, meaning whoever compiles a figure is not the person who approves it. Controls have to be documented, evidenced and repeatable, so an assurer can test them instead of rebuilding every calculation.

Sustainability figures are being brought under assurance regimes built on the same expectations as financial reporting, which means the control environment behind a number is tested, not only the number. The control types are not new ones invented for sustainability. They are ordinary reporting controls applied to metered quantities, supplier records and survey responses.

The five control types, with an ESG example each

Diagram, Two hands on every ESG figure. Maker-checker in practice (The person who compiles a figure never approves it). Preparer records: The value; Source document reference; Any conversion applied.
Two hands on every ESG figure
Control type Question it answers ESG failure it catches
Completeness Is every in-scope site, entity and month present? A leased warehouse left out because the landlord pays its electricity bill
Accuracy Does the recorded value match the source document? A meter reading in kilowatt hours entered into a field expecting megawatt hours
Cut-off Does the value belong to the reporting period? An invoice raised in April for March consumption booked into the wrong year
Authorisation Did a named person approve the figure and the method? An emission factor swapped mid-year with no recorded approval
Consolidation Is each entity counted once, at the stated boundary? A joint venture included in full under operational control and again by equity share

Cut-off and consolidation are boundary questions rather than measurement questions, which is why they fail quietly. A quantity can be measured correctly and still sit in the wrong period or the wrong reporting entity.

Maker-checker as the baseline

The baseline control on any single ESG data point is separation between the person who prepares it and the person who approves it. Applied to one metric, that looks like:

1. The preparer records the value, the source document reference and any conversion applied. 2. A second named person checks the value against that source and signs the check with a date. 3. Later corrections are made as a new version with the reason recorded, never as an overwrite.

Where headcount makes full separation impossible, a compensating control is required, and that control is documentation. A written method note per metric lets a reviewer outside the process re-perform the calculation from evidence alone, which is what an assurance team asks for first. GreenSutra structures that evidence file and the control documentation. Independent accredited third parties assure the result.

Sources: IAASB, International Standard on Sustainability Assurance 5000, 2024, SEBI BRSR Core circular, 2023

ESG advisory services covers control design, evidence structuring and assurance readiness for sustainability data. The ESG guide sets out how disclosure data is scoped and governed before an assurer is appointed.