Skip to main content
Regulatory Council
Dark green background, "Weak Application Security Can Cost You Millions," 3 slanted images of fingers pointing to digital locks, and a "Learn the Basics" button
Category: Disclosure & Financial Reporting

ESG Reporting

Also known as: ESG, Environmental, Social, and Governance Reporting, Sustainability Reporting
Simply put

ESG reporting is the practice of disclosing information about how an organization performs on environmental, social, and corporate governance matters. It aims to shed light on a company's operations and progress in areas such as environmental stewardship, social responsibility, and ethical business practices. The disclosures can cover related risks, opportunities, and impacts.

Formal definition

ESG reporting is the disclosure of environmental, social, and corporate governance data concerning an organization's business operations, performance, and progress. Such disclosures typically address an organization's risks, opportunities, and impacts across environmental stewardship, social responsibility, and corporate governance, and are often used to communicate performance on sustainability and ethical practices to stakeholders. While ESG reporting is frequently discussed as a governance and disclosure activity, its scope commonly spans governance, risk, and compliance considerations; the specific content, applicable disclosure frameworks, and whether reporting is voluntary or mandatory vary by jurisdiction, sector, and organization, and should be verified against the applicable regulatory requirements and reporting standards. Note that the evidence provided does not specify particular reporting frameworks, effective dates, or binding obligations.

Why it matters

ESG reporting has become a focal point of governance and stakeholder communication because it provides visibility into how an organization performs on environmental, social, and corporate governance matters that were historically outside the scope of conventional financial disclosure. By disclosing data on environmental stewardship, social responsibility, and ethical business practices, organizations aim to give stakeholders insight into operations and progress that financial statements alone do not capture. The disclosures can cover related risks, opportunities, and impacts, which makes ESG reporting relevant to how a company is directed and controlled as well as how it manages uncertainty against its objectives.

Although ESG reporting is frequently discussed as a governance and disclosure activity, its scope commonly spans governance, risk, and compliance considerations. Reporting can illuminate risks and opportunities that bear on strategy and reputation, and it can intersect with compliance obligations where disclosure is mandated. It is important to note that the specific content of ESG reports, the applicable disclosure frameworks, and whether reporting is voluntary or mandatory vary by jurisdiction, sector, and organization. These specifics should be verified against the applicable regulatory requirements and reporting standards rather than assumed.

The evidence available for this entry does not specify particular reporting frameworks, effective dates, or binding obligations, so organizations should treat framework selection and legal applicability as matters requiring separate verification and, where relevant, professional advice. What the sources consistently emphasize is the underlying purpose: to shed light on a company's ESG performance and progress in a way that informs stakeholders.

Who it's relevant to

Governance professionals and boards
Because ESG reporting concerns disclosures about corporate governance and how an organization performs on ethical and sustainability matters, those responsible for how the organization is directed and controlled have a direct interest in what is disclosed, how it reflects the organization's operations and progress, and how oversight of the reporting process is structured.
Risk managers
ESG reporting can cover an organization's risks and opportunities across environmental, social, and governance areas. Risk professionals may draw on and contribute to these disclosures where they intersect with the identification and treatment of uncertainty against organizational objectives, though the specifics depend on the frameworks and requirements that apply.
Compliance officers and general counsel
Whether ESG reporting is voluntary or mandatory varies by jurisdiction, sector, and organization. Compliance and legal functions are relevant where disclosure obligations are imposed by law or regulation, and they typically help verify applicable requirements and reporting standards. Legal interpretation of specific obligations falls outside the scope of this definition and may require professional advice.
Stakeholders and users of disclosures
ESG reporting is often used to communicate performance on sustainability and ethical practices to stakeholders. Investors, customers, employees, and other external parties who rely on these disclosures to understand a company's ESG operations, impacts, and progress are among the intended audiences, though the comparability and content of reports depend on the frameworks used.

Inside ESG

Environmental Disclosures
Information relating to an organization's environmental impacts and dependencies, which may include greenhouse gas emissions, energy and water use, waste, and biodiversity effects. The specific metrics reported vary by framework, sector, and applicable jurisdiction.
Social Disclosures
Information addressing an organization's relationships with employees, suppliers, customers, and communities, often covering matters such as labor practices, health and safety, diversity, and human rights. Scope and required content differ across frameworks and legal regimes.
Governance Disclosures
Information on the structures, roles, and decision rights by which sustainability-related matters are directed and controlled, such as board oversight, management responsibilities, and related policies. This element connects ESG reporting to the governance pillar of GRC.
Reporting Frameworks and Standards
Voluntary or mandatory reference points that shape the form and content of disclosures. Practitioners should attribute each framework precisely to what its source actually states and note that framework language evolves across editions and that applicability varies by jurisdiction and sector.
Materiality Determination
The process of deciding which ESG topics are significant enough to disclose. Definitions of materiality can differ across frameworks and jurisdictions, and the concept is context-dependent, so the basis used should be stated explicitly.
Data Collection and Assurance
The processes and controls used to gather, validate, and, where applicable, obtain independent assurance over reported information. The extent and nature of assurance vary and may be voluntary or required depending on the applicable regime.

Common questions

Answers to the questions practitioners most commonly ask about ESG.

Is ESG reporting the same as sustainability reporting?
The terms are often used interchangeably, but they are not always identical in scope. ESG reporting typically refers to disclosure organized around environmental, social, and governance factors, frequently oriented toward investors and other capital-market audiences. Sustainability reporting is sometimes used more broadly to address an organization's impacts on society and the environment for a wider set of stakeholders. Usage varies by framework, jurisdiction, and organization, so it is worth clarifying which meaning is intended in a given context rather than assuming equivalence.
Does producing an ESG report mean an organization is compliant with ESG regulations?
Not necessarily. Preparing and publishing an ESG report is a disclosure activity and does not by itself establish that an organization meets any binding legal requirement. Whether specific disclosures are mandatory depends on jurisdiction, sector, listing status, and organization size, and applicable obligations continue to evolve. A published report may still fall short of an applicable regulatory standard, and conversely much ESG disclosure remains voluntary or based on non-binding frameworks. Determining compliance obligations typically requires reference to the relevant primary sources and, in many cases, professional legal advice.
How should an organization decide which ESG reporting framework or standard to use?
The choice often depends on the intended audience, applicable regulatory requirements, sector norms, and where the organization operates or lists its securities. Some organizations are subject to mandatory disclosure regimes in particular jurisdictions, while others adopt voluntary frameworks or standards to meet investor or stakeholder expectations. Because framework language evolves across editions and multiple standards may apply simultaneously, many organizations map their disclosures against more than one and verify current requirements against the primary sources rather than relying on a single default.
What governance structures typically support ESG reporting?
ESG reporting commonly draws on defined roles and decision rights that span governance, risk, and compliance functions. In many organizations this includes board or committee oversight of disclosure, assignment of responsibility for data collection and validation across relevant functions, and processes for reviewing and approving what is published. The specific structures vary considerably by organization size, sector, and applicable requirements, and there is no single mandated model that applies universally.
How can an organization support the reliability of the data in its ESG reports?
Reliability is often supported through controls over how ESG data is defined, sourced, calculated, and reviewed, in a manner conceptually similar to controls over other reported information. This can include documented methodologies, evidence retention, internal review, and in some cases independent assurance. It is worth noting that such measures modify but do not eliminate the risk of error or misstatement, and the level of assurance obtained and whether it is required varies by jurisdiction, framework, and organization.
How does ESG reporting connect to an organization's broader risk management activities?
ESG reporting frequently intersects with risk management because the identification, assessment, and treatment of ESG-related uncertainties against objectives can inform what is disclosed. Some frameworks encourage reporting on how ESG-related risks are governed and managed. In practice this means aligning disclosure processes with existing risk identification and assessment activities, while recognizing that reporting itself is a disclosure function distinct from the underlying management of the risks. The degree of integration depends on the organization and the frameworks it applies.

Common misconceptions

ESG reporting is a single, uniform global standard that every organization follows in the same way.
Multiple frameworks and standards exist, their language evolves across editions, and applicability varies by jurisdiction, sector, and organization size. Whether reporting is a binding legal requirement or a voluntary practice depends on the specific regime.
ESG reporting is purely an environmental or disclosure exercise separate from governance and risk management.
ESG reporting legitimately spans more than one GRC pillar. Its governance element concerns oversight structures and decision rights, and the underlying subject matter can be relevant to identifying and assessing risks against objectives, so it is not confined to disclosure alone.
Publishing an ESG report guarantees compliance with applicable obligations.
No report or control eliminates risk or guarantees compliance. Obligations differ by jurisdiction and sector, materiality and assurance expectations vary, and specific requirements and effective dates should be verified against the primary source and appropriate professional advice.

Best practices

Clearly distinguish which disclosures reflect binding legal requirements from those that reflect voluntary standards or leading practice, and confirm applicability for your jurisdiction, sector, and organization size.
State explicitly the framework or standard being applied and the edition referenced, recognizing that framework language evolves over time.
Document the basis for materiality determinations, since the concept is defined differently across frameworks and jurisdictions.
Connect ESG reporting to existing governance structures by defining board oversight, management roles, and decision rights for sustainability-related matters.
Establish data collection processes and, where appropriate, independent assurance to support the reliability of reported information.
Verify specific figures, effective dates, and detailed requirements against the primary source and obtain professional advice where matters involve legal interpretation.
a promotional banner asking how ready are you for PCI DSS 4.0? With a call-to-action to get the checklist now.