ESG reporting controls are the policies, procedures and checks that make sustainability data accurate, complete and traceable before it reaches a disclosure. To build them, assess which disclosures carry the most misstatement risk, assign an owner to each control, document and test the controls, and keep evidence an assurance provider can follow. This guide walks through that sequence, using guidance from IFAC, COSO and the Institute of Internal Auditors.
TL;DR
- ESG reporting controls apply the discipline of financial reporting to sustainability data: defined owners, documented procedures, review and evidence.
- Start with material and high-risk disclosures, such as Scope 1, 2 and 3 emissions, and extend existing ICFR processes instead of building a parallel system.
- Clear roles matter as much as the controls: management performs them, specialist functions challenge, internal audit assures, and the governing body oversees.
- Document controls in a risk and control matrix, test them, classify deficiencies and remediate. Keep original or traceable evidence for assurance.
- Training is part of the control environment, and it reaches beyond the finance team.
Table of Contents
- What ESG reporting controls are and why they matter
- Who owns what: governance roles in an ESG control system
- The control environment: five COSO principles
- Designing controls around material risks
- How to implement ESG reporting controls in practice
- Documenting, testing and remediating controls
- Evidence that supports assurance
- How expectations differ across frameworks
- Our perspective
- Build the skills behind the controls
- FAQ
- Sources
What ESG reporting controls are and why they matter
A control is any action that reduces the chance a number or statement in a sustainability report is wrong. A meter reading reconciled to a utility invoice is a control. So is a second person reviewing the emissions factor selected for a calculation, or a restriction on who can edit the data warehouse that feeds the report.
The reason to formalize them is decision quality. PwC argues that without internal controls over ESG reporting, decisions can rest on incomplete or misleading information, which undermines capital allocation. IFAC makes the assurance case: effective governance and controls build trust, reduce the risk of a modified assurance conclusion and help meet investor expectations.
The practical shift is that sustainability data used to be compiled once a year by a small team from spreadsheets. Once an assurance provider or regulator expects the data to hold up like financial data, "compiled by a small team" is no longer a control. You need to show who did what, which source they used and who checked it.
Who owns what: governance roles in an ESG control system
Controls fail most often at the handoffs, where everyone assumes someone else checked the number. The first design step is to settle the roles. IFAC describes a division that works well in practice, based on the Three Lines Model:
- Management owns and manages the risk and performs the controls.
- Specialist functions (sustainability, risk, compliance) provide expertise, monitoring and challenge.
- Internal audit provides independent assurance and advice.
- The governing body is accountable for oversight.
That split is set out in IFAC's guidance on governance and controls for sustainability information. The IIA's white paper on internal audit's role in ESG reporting adds that internal audit should give objective assurance on the effectiveness of ESG risk assessments, responses and controls.
Baker Tilly advises assigning each control activity to a specific owner or team with the authority and resources to operate it. A named person in the facilities team who owns the energy data control is stronger than a line in a policy saying "operations is responsible".
Cross-functional coordination helps too. Deloitte reports that 81% of executives were creating new roles and responsibilities, as cited from its December 2022 report, and recommends considering a cross-functional working group for ESG governance. For the board side of the structure, see our guide to an ESG governance structure that works for boards and reporting teams and the role of audit committee oversight of sustainability reporting.
The control environment: five COSO principles
Control activities sit on top of a control environment. The COSO report on internal control over sustainability reporting (ICSR) identifies five principles for it:
- Integrity and ethics
- Board oversight
- Structures and responsibilities
- Competent human resources
- Accountability
Translated into a reporting team's daily work, this means a code of conduct that covers data manipulation, a board or committee that actually reviews the reported metrics, a documented reporting calendar with named contributors, people trained for the tasks they perform, and consequences when deadlines or quality standards are missed.
Competence is the principle teams most often underinvest in. Deloitte's analysis stresses that the control environment needs human-centered training so that employees across all functions, not just finance, understand their part of the reporting process. A plant manager who submits waste tonnage needs to know why the weighbridge ticket matters.
Designing controls around material risks
Do not try to control everything at once. IFAC's guidance advises that organizations assess materiality and misstatement risks, prioritize the material disclosures, set control objectives and then apply appropriate controls, integrating sustainability reporting into ICFR over time where appropriate.
Three design choices follow from that.
Start from risk, not from the framework checklist
Ask where a number could be wrong and how much it would matter. Data collected manually from many sites, estimates that rely on judgment, and figures built from supplier information all carry higher risk than a metered figure from one system. Baker Tilly recommends defining clear, measurable control objectives based on the risks you identify, for example "all sites report within five working days" or "every emission factor has a documented source and version".
Reuse what your ICFR already does
IFAC notes that extending ICFR processes to sustainability data reduces implementation costs and increases the reliability of the information. A report from the Institute of Internal Auditors of Spain likewise recommends using synergies between existing assurance models such as ICFR and ICSR requirements. Change management, access controls, reconciliations, review sign-offs and issue logs already exist in finance. Apply them to the sustainability data pipeline first.
Cover three levels
The same Spanish report explains that the COSO ICSR model applies double materiality in risk assessment and addresses control activities at entity, process and technology levels to support data quality. The table below shows what that can look like. The examples are illustrations of common practice, not requirements.
| Level | Purpose | Example controls |
|---|---|---|
| Entity | Set expectations and oversight | Reporting policy, board or committee review of metrics, defined materiality assessment process |
| Process | Make each data flow repeatable | Data owner sign-off, site-level reconciliation to source records, methodology documentation, second-person review |
| Technology | Protect data inside systems | Access restrictions, change logs, locked calculation templates, automated validation rules |
For a deeper look at how data governance supports this, read our guide to audit-ready ESG data governance and our piece on ESG data quality under ISSA 5000.
How to implement ESG reporting controls in practice
IFAC recommends an annual governance and control cycle, a focus on material and high-risk disclosures, cross-functional work and automation to cut manual intervention and errors. A workable sequence looks like this.
- Map the reporting process. List every disclosure, its data source, the people who touch it and the systems involved.
- Rank by risk and materiality. PwC suggests beginning with high-risk metrics such as Scope 1, 2 and 3 greenhouse gas emissions, which stabilizes the reporting environment and demonstrates management accountability.
- Write control objectives. One objective per risk, stated so that someone can tell whether it was met.
- Design and assign controls. Choose preventive and detective controls, then name an owner for each.
- Automate where you can. Replace copy-and-paste between spreadsheets with controlled imports and validation rules.
- Train the contributors. Cover finance, operations, procurement and HR, since data originates in all of them.
- Run the cycle and review. Per IFAC, later years can concentrate on maintenance, review and adjustment as processes and systems mature.
Deloitte's experts describe building an ESG control environment as a journey rather than a sprint, and note that it needs a strong tone from the top. That is a useful expectation to set with executives: the first cycle will not be perfect, but it should be documented and improvable.
Documenting, testing and remediating controls
An undocumented control cannot be tested, and an untested control cannot be relied on. The Spanish IIA report advises documenting controls in risk and control matrices. A basic matrix row holds the risk, the control objective, the control description, the owner, the frequency, the evidence produced and the system involved. If you are used to formal control documentation from IT or security programs, a SOC 2 compliance checklist shows how a structured control inventory is organized, and the same discipline carries over to sustainability reporting.
Testing follows the same report: assess controls through interviews, observation, inspection and documentary evidence, then evaluate their effectiveness. Three practical points:
- Test design first (would this control catch the error?), then operation (did it run every time?).
- Sample across sites and periods, not just the head office.
- Have someone independent of the control owner run the test. This is where internal audit adds value, as covered in our walkthrough of ESG internal audit, mapping COSO to a plan.
When a control fails, the same guidance advises assessing the impact, classifying the severity and proposing improvements, and promoting training and awareness among control supervisors and performers. A simple severity scale (isolated slip, recurring weakness, systemic gap) lets the committee decide what needs immediate action and what can be fixed in the next cycle. Record the remediation owner and a due date, and retest after the fix.
Evidence that supports assurance
Internal controls support assurance by documenting the sustainability reporting process. IFAC describes the evidence worth retaining: it comes from reliable external sources, is controlled within an established framework, is direct, is documented, and is original or traceable if it has been changed.
In day-to-day terms, keep the invoice or meter export, not just the figure typed from it. Keep the version of the emission factor table used. Keep the approval trail showing who reviewed a number and when. If a figure is restated or adjusted, keep the original and the reason. A good evidence checklist habit is to ask of every item whether a stranger could trace it back to its source without asking you a question.
The assurance standard behind much of this is ISSA 5000. The IAASB's January 2025 implementation guide is non-authoritative practical guidance for practitioners, and it confirms the standard applies to entities of all sizes and complexity. Smaller reporters should therefore expect questions about controls too, scaled to their size.
How expectations differ across frameworks
IFAC observes that expectations align across global frameworks such as the ISSB standards and the EU's CSRD in emphasizing transparency about governance, risk management and internal control structures. Jurisdictional requirements vary in detail, but the common direction is that sustainability reporting should reach the same quality, timing and connectivity as financial reporting. If you report under IFRS S2, our guide to the four pillars of IFRS S2 shows how governance and risk management disclosures tie back to your controls.
Our perspective
Most teams we meet do not lack data. They lack a way to show how a number was produced. A control system closes that gap, and it is a skill set as much as a policy set.
We see three habits separate teams that pass assurance smoothly from those that scramble. They assign owners by name. They test controls before the assurance provider does. And they train the people who feed the data, not only the people who sign the report.
That is why our programs are mapped to ISSB, ESRS, GRI and ISSA 5000, and why our credentials are designed around real pass thresholds rather than participation. A reporting professional who understands the standard, and an assurance professional who understands the control, speak the same language when the engagement begins. Building that shared competence across finance, risk, audit and sustainability is the most reliable control we know.
Ransford
Build the skills behind the controls
Controls are only as strong as the people running them. Our reporting and assurance pathways are designed so that preparers and reviewers learn the same standards. The Certificate in Sustainability Reporting is $149 one-off, the Certified Sustainability Reporting Professional (CSRP) is $399 one-off, and the Professional Certificate in Climate, Sustainability and ESG Assurance is $299 one-off.
For shorter, targeted learning, our CPD modules include Sustainability Assurance under ISAE 3000 at $129 one-off and ESG Reporting for Accountants at $79 one-off. The All-Access CPD Pass is $599 per year.
FAQ
What is the difference between ICFR and internal control over sustainability reporting?
ICFR covers controls over financial statements. Internal control over sustainability reporting (ICSR) applies the same control logic to sustainability information. IFAC advises that extending ICFR processes to sustainability data can reduce implementation costs and improve reliability, so most organizations start by reusing what finance already has.
Which ESG metrics should get controls first?
Start with disclosures that are material and high risk. PwC points to Scope 1, 2 and 3 greenhouse gas emissions as a sensible starting point because they are data-heavy and closely scrutinized. Rank the rest by misstatement risk and add controls over successive cycles.
Who is responsible for ESG controls?
Management owns the risk and performs the controls. Specialist functions monitor and challenge, internal audit provides independent assurance, and the governing body oversees the whole system. Each control should still have a named individual or team as its owner.
What evidence will an assurance provider want to see?
Expect requests for original or traceable source documents, the methodology and factors used, review and approval records, and the documentation of the reporting process. IFAC advises keeping evidence that is reliable, direct, documented and controlled within an established framework.
Sources
- IFAC: Governance and Controls for Sustainability Information
- COSO: Achieving Effective Internal Control over Sustainability Reporting
- IIA: Internal audit's role in ESG reporting
- IIA Spain: Internal Control over Sustainability Reporting
- IAASB: ISSA 5000 Implementation Guide
- PwC: Internal controls for sustainability reporting
- Deloitte: Scale your internal controls environment for ESG
- Baker Tilly: Establishing governance over ESG reporting