Internal controls over sustainability data

Sustainability figures often come from spreadsheets, utility bills, HR systems and supplier questionnaires that no one has ever audited. As limited assurance spreads under the CSRD, SB 253 and the ISSB standards, and reasonable assurance comes into view, companies need the same discipline over this data that they apply to the financial statements. This guide explains what internal controls over sustainability data are, how the COSO framework applies, where errors come from, works through a manufacturer's scope 2 process, and covers what regulators and assurance providers expect.

By Mirza Fahad Baig, Chartered Accountant. Reviewed by Hamza Fida, Chartered Accountant. 4 minute read.

Short answer

Internal controls over sustainability data are the policies, procedures and checks that give a company confidence that its sustainability information, such as emissions, energy, workforce and safety figures, is complete, accurate and reported on time. They mirror internal control over financial reporting: COSO's 2023 guidance, Achieving Effective Internal Control over Sustainability Reporting (ICSR), applies its Internal Control Integrated Framework, with its five components of control environment, risk assessment, control activities, information and communication, and monitoring, to sustainability reporting. Typical controls include a reporting boundary reconciled to the list of legal entities and sites, reconciliations of source data such as energy invoices to meter readings, version control over emission factors and calculation tools, review of variances against prior periods, access controls over data systems, and documented sign-off by data owners. Under the CSRD, audit committees must monitor the effectiveness of internal control and risk management over sustainability reporting, and ESRS 2 asks companies to describe these systems. Assurance providers working under ISSA 5000 must understand the controls relevant to the information, so weak controls mean more testing, more findings and a higher risk of a modified conclusion.

At a glance

Purpose
Complete, accurate data
Framework
COSO ICSR guidance
Key risk
Missing sites, estimates
Typical control
Reconcile to source
EU
Audit committee oversight
Assurance
Weak controls, more work
Internal controls over sustainability dataPurpose: Complete, accurate data; Framework: COSO ICSR guidance; Key risk: Missing sites, estimates; Typical control: Reconcile to source; EU: Audit committee oversight; Assurance: Weak controls, more work.KEY FACTS AT A GLANCEInternal controls over sustainability dataPurposeComplete, accurate dataFrameworkCOSO ICSR guidanceKey riskMissing sites, estimatesTypical controlReconcile to sourceEUAudit committee oversightAssuranceWeak controls, more workTax BakersInternal controls over sustainability dataPurpose: Complete, accurate data; Framework: COSO ICSR guidance; Key risk: Missing sites, estimates; Typical control: Reconcile to source; EU: Audit committee oversight; Assurance: Weak controls, more work.KEY FACTS AT A GLANCEInternal controls oversustainability dataPurposeComplete, accurate dataFrameworkCOSO ICSR guidanceKey riskMissing sites, estimatesTypical controlReconcile to sourceEUAudit committee oversightAssuranceWeak controls, more workTax Bakers
Key facts at a glance, as set out in this guide.

What are internal controls over sustainability data?

They are the processes that prevent, or detect and correct, errors in sustainability information before it is published. Like internal control over financial reporting, they cover the whole chain: deciding what is in the reporting boundary, collecting data, applying methods and emission factors, estimating where data is missing, reviewing results and approving the report. Good controls make the data reliable enough for management to use in decisions and targets, not only in the annual report. See managing a GHG inventory and collecting ESG data across a group.

How does the COSO framework apply to sustainability data?

  • Control environment: board and audit committee oversight, clear owners for each metric and competent staff.
  • Risk assessment: identifying, metric by metric, what could go wrong and how material the error would be.
  • Control activities: reconciliations, reviews, approvals, segregation of duties and IT controls over the tools used.
  • Information and communication: documented methods, definitions and data flows that everyone uses consistently.
  • Monitoring: internal audit reviews and follow-up of control failures and assurance findings.

COSO's ICSR guidance, published in March 2023, applies each of the framework's 17 principles to sustainability reporting and stresses linking the work to existing financial controls rather than building a separate system.

Where do sustainability data errors come from?

The most common are an incomplete boundary, such as a newly acquired or leased site left out; manual spreadsheets with broken formulas; wrong units or conversions; out-of-date emission factors; estimates for missing data that are never revisited; double counting between sites or scopes; supplier data accepted without checks; and cut-off errors when bills cover periods that straddle the year end. Changes in methods or boundaries that are not documented also make figures impossible to compare from year to year. See GHG base year recalculation.

Internal controls over sustainability data in practice: a manufacturer's scope 2 process

A manufacturer with 14 sites using 118,000 MWh of electricity a year designs controls over its scope 2 data before its first assured year.

Controls over a manufacturer's scope 2 dataControls over a manufacturer's scope 2 data1BoundarySite list matchedto legal entities2CollectInvoices matchedto meter reads3CalculateLocked factorsand tool versions4ReviewVariance over 10%explained5Reportand sign offOwner sign-offand audit trail
Each step has a control and evidence an assurance provider can test.

Matching the site list to the legal entities in the financial statements reveals a leased warehouse using 1,800 MWh, 1.5% of the total, that had been left out. Invoices are reconciled to meter readings each quarter, and estimated months are flagged and trued up. Emission factors sit in a locked table with the source and version recorded, so a change is visible. The sustainability controller explains any site whose consumption moves by more than 10% from the prior year, and each site manager signs off the data, leaving a trail an assurance provider can follow. See scope 2 location-based and market-based methods.

What do the CSRD, ESRS and UK rules require?

The CSRD requires audit committees to monitor the sustainability reporting process and the effectiveness of the company's internal quality control, risk management and internal audit over it. ESRS 2 asks companies to describe their risk management and internal control processes over sustainability reporting, including the main risks identified and how they are mitigated. In the UK, Provision 29 of the 2024 UK Corporate Governance Code asks boards of companies applying the Code to declare, for periods beginning on or after 1 January 2026, whether their material controls, including reporting controls, were effective. US rules do not yet require controls over sustainability reporting, although SB 253's move to reasonable assurance in 2030 will make them essential. See ESRS 2 general disclosures.

How do controls affect assurance?

Under ISSA 5000, a provider performing limited assurance must understand the company's reporting process and relevant controls; for reasonable assurance it must understand more and will often test controls so that it can rely on them. Weak controls do not by themselves prevent a conclusion, but they mean more detailed testing, more management letter points and more risk of misstatements being found late. See limited and reasonable assurance and getting ready for sustainability assurance.

How can a company build these controls?

  • List the metrics reported and rank them by the risk and size of error.
  • Map each data flow from source to report, and name an owner for each metric.
  • Add preventive and detective controls at the risky points, with evidence that they operate.
  • Replace fragile spreadsheets with controlled tools, or add access, change and formula checks.
  • Bring sustainability data into the scope of internal audit and of the finance close calendar.

Need help applying the standards?

Our Chartered Accountants help finance teams and students apply IFRS and US GAAP to real transactions.

Book a call Chat on WhatsApp

Questions people ask

What is internal control over sustainability reporting?

The policies, procedures and checks that make sustainability information complete, accurate and timely, applying the same principles as internal control over financial reporting.

Is there a framework for internal control over sustainability reporting?

Yes. COSO's 2023 guidance applies its Internal Control Integrated Framework, with five components and 17 principles, to sustainability reporting.

Does the CSRD require internal controls over sustainability reporting?

It requires audit committees to monitor their effectiveness, and ESRS 2 asks companies to describe their internal control and risk management over sustainability reporting.

Do assurance providers test controls over sustainability data?

For limited assurance they must understand relevant controls; for reasonable assurance they usually test them so they can rely on them.

Sources

Every fee, date and rule on this page was taken from these official and primary sources.

  1. COSO: Achieving Effective Internal Control over Sustainability Reporting (ICSR), March 2023, announced by The IIA
  2. ICAEW: 2024 UK Corporate Governance Code, what's different, including Provision 29
  3. Directive (EU) 2022/2464, the Corporate Sustainability Reporting Directive, as amended by the Omnibus I Directive published on 26 February 2026
  4. EFRAG Knowledge Hub: revised ESRS 2 General disclosures, delegated act version
  5. IAASB: ISSA 5000, General Requirements for Sustainability Assurance Engagements
  6. IESBA: International Ethics Standards for Sustainability Assurance

Rules and fees change. If you are reading this long after October 14, 2026, confirm the figures with the source before you rely on them.

SustainabilityGetting ready for sustainability assuranceSustainabilitySustainability assurance explainedSustainabilityBuilding a GHG inventory: data and controls

More in Sustainability

Previous in this topicAssurance under SB 253Next in this topicCalifornia AB 1305: voluntary carbon market disclosuresTopicAll 100 guides in Sustainability

This guide is general information. It is not tax or legal advice for your situation.