← Back to all briefings
Governance 6 min read Published Updated Credibility 93/100

Governance Briefing — December 16, 2022

Directive (EU) 2022/2464 (CSRD) now in force extends EU sustainability reporting to nearly 50,000 entities, demanding board-led double materiality assessments, ESRS data architecture, and assurance-ready controls by 2024–2028.

Zeph Tech Research Lead

Research lead, Zeph Tech

Timeline plotting source publication cadence sized by credibility.
2 publication timestamps supporting this briefing. Source data (JSON)

Executive briefing: Directive (EU) 2022/2464 (the Corporate Sustainability Reporting Directive, or CSRD) entered the Official Journal on 16 December 2022, expanding the EU’s corporate reporting regime to nearly 50,000 entities. Boards must supervise double materiality assessments, European Sustainability Reporting Standards (ESRS) implementation, digital taxonomy tagging, and assurance-ready control environments that link sustainability data to financial statements and strategy.

Scope and staged application

  • Legacy NFRD reporters. Large public-interest entities already subject to the Non-Financial Reporting Directive (NFRD) must apply CSRD for financial years starting on or after 1 January 2024, publishing reports in 2025.
  • Other large EU undertakings. EU companies exceeding two of three thresholds (250 employees, €40 million net turnover, €20 million balance sheet total) begin in FY2025. Groups must consolidate EU and non-EU subsidiaries when calculating scope.
  • Listed SMEs. EU-listed small and medium-sized enterprises (excluding micro-undertakings) enter the regime in FY2026 but may opt out until FY2028 with disclosure. Separate, simplified ESRS for SMEs are under development.
  • Third-country groups. Non-EU parents with EU turnover above €150 million and a large or listed EU subsidiary (or EU branch with €40 million turnover) must publish CSRD-aligned sustainability reports for FY2028.

Member States have 18 months from publication to transpose CSRD into national law. Companies must therefore monitor local implementation (for example, Germany’s planned amendments to the HGB or France’s Commercial Code) and reconcile potential gold-plating with EU-level requirements.

Governance and board accountability

CSRD explicitly embeds sustainability oversight in board fiduciary duties. Boards must ensure expertise in climate, human rights, and supply-chain governance, and describe oversight structures within the management report. Organisations should update board charters, assign primary accountability (audit committee, sustainability committee, or combined), and schedule annual deep dives on ESRS readiness. Document director training and retain evidence of external advisors engaged to address knowledge gaps.

Management teams should establish a CSRD steering committee chaired by the CFO or Chief Sustainability Officer. Membership should include risk, legal, internal audit, HR, procurement, and IT. The committee should maintain a programme roadmap covering materiality analysis, ESRS gap assessments, control design, data architecture, and assurance. Programmes should align with broader regulatory commitments such as the EU Taxonomy, Sustainable Finance Disclosure Regulation (SFDR), and national supply-chain due diligence laws.

Double materiality and stakeholder engagement

Double materiality analysis requires evaluating both financial materiality (impacts on enterprise value) and impact materiality (significant effects on people and the environment). Companies should build repeatable methodologies that combine quantitative thresholds, stakeholder interviews, scenario analysis, and risk scoring. Evidence packages must show how management validated outcomes, how often the assessment is refreshed, and how the results influence strategy, risk appetite, and remuneration.

Stakeholder engagement plans should map regulators, investors, employees, communities, and NGOs. Maintain logs of consultation sessions, including the topics discussed and how feedback influenced disclosure priorities. For high-risk supply chains or communities, gather third-party assurance or grievance mechanism data to substantiate claims on due diligence, remediation, and human rights outcomes.

Data architecture and technology enablement

CSRD mandates granular, standardised metrics across climate, pollution, water, biodiversity, workforce, value-chain workers, consumers, and business conduct. Organisations should map data sources (ERP, HRIS, procurement, facility management systems, partner portals) and build a sustainability data lake with governed pipelines, quality checks, and metadata catalogues. Establish data lineage documentation that shows transformation logic, controls, and reconciliation to financial ledgers. Where data gaps exist (for example, Scope 3 emissions), design estimation methodologies aligned with ESRS guidance, documenting assumptions and validation steps.

Because CSRD requires digital reporting in XHTML with XBRL tagging using a forthcoming EU sustainability taxonomy, IT teams must coordinate with finance on European Single Electronic Format (ESEF) tooling. Test that tagging solutions can handle nested ESRS datapoints, narrative disclosures, and cross-references to the annual financial report. Cybersecurity teams should include the sustainability reporting platform in access reviews, change management, and backup testing to protect against tampering.

Control environment and assurance readiness

CSRD demands limited assurance over sustainability information initially, with the European Commission empowered to propose a move to reasonable assurance by 2028. Companies should therefore extend internal control frameworks (e.g., COSO) to non-financial data. Define control owners, frequencies, and evidence requirements for each ESRS datapoint. Examples include automated completeness checks for GHG inventory uploads, manual review of human rights incident logs, and segregation of duties for sustainability adjustments in consolidation tools.

Internal audit should incorporate CSRD controls into the audit universe, testing design and operating effectiveness. Audit workpapers should include sample selections, recalculations, and control walkthroughs. Coordination with external auditors is essential: align on scoping, reliance strategy, and documentation standards to avoid late surprises. For subsidiaries subject to multiple assurance regimes (such as France’s DPEF or the UK’s Streamlined Energy and Carbon Reporting), harmonise evidence requirements to reduce duplication.

Outcome testing and scenario planning

Beyond control testing, organisations must demonstrate that sustainability initiatives deliver intended outcomes. Establish key performance indicators tied to ESRS metrics (for example, emissions intensity reduction targets, injury-frequency goals, gender-pay equity ratios) and embed them into enterprise performance management. Run scenario analyses (e.g., climate pathways consistent with IPCC SSPs) and stress tests that show resilience of strategy and financial plans under different transition or physical risk conditions.

Companies should simulate assurance engagements by running mock “assurance sprints” each quarter. These exercises confirm that evidence repositories, tagging workflows, and disclosure controls operate under compressed timelines. They also test escalation paths when data anomalies emerge and produce lessons learned for subsequent reporting cycles.

Supply-chain and global coordination

CSRD requires value-chain coverage, including upstream suppliers and downstream users. Procurement teams must update supplier codes of conduct, contractual clauses, and due diligence questionnaires to collect ESG data. Implement vendor-risk platforms capable of tracking supplier attestations, audit results, remediation plans, and grievance channel usage. For international groups, align CSRD requirements with reporting obligations in jurisdictions such as the UK (Climate-related Financial Disclosure Regulations), the US SEC’s proposed climate rules, and emerging Asian sustainability standards.

Third-country parents subject to CSRD in FY2028 should begin mapping EU subsidiaries, data flows, and internal reporting capabilities now. Establish global governance forums to harmonise definitions, coordinate technology investments, and share good practices across regions. Where local privacy or data residency rules constrain data sharing, engage legal teams to design compliant transfer mechanisms.

Action checklist for 2023–2024

  1. Confirm scope, assign programme sponsorship, and secure budget for ESRS implementation, technology upgrades, and assurance.
  2. Complete double materiality and gap assessments, publish board-approved roadmaps, and communicate milestones to investors.
  3. Design and test sustainability data architecture, including quality rules, lineage, and integration with ESEF/XBRL solutions.
  4. Extend internal control and assurance frameworks to non-financial metrics, schedule internal audit coverage, and coordinate with external auditors.
  5. Engage suppliers and portfolio companies on data expectations, contract updates, and remediation plans, ensuring alignment with due diligence laws.
  6. Run scenario analyses and outcome-testing dashboards that tie sustainability KPIs to capital allocation, remuneration, and risk appetite.
  7. Prepare stakeholder communication strategies covering investors, employees, regulators, and civil society, highlighting governance structures and progress.

Organisations that invest early in governance, data, and assurance will be best positioned to comply with CSRD, support forthcoming reasonable-assurance mandates, and meet investor expectations for credible, decision-useful sustainability reporting.

Timeline plotting source publication cadence sized by credibility.
2 publication timestamps supporting this briefing. Source data (JSON)
Horizontal bar chart of credibility scores per cited source.
Credibility scores for every source cited in this briefing. Source data (JSON)

Related briefings

Curated signals from the same pillar or overlapping topics.

Continue in the Governance pillar

Return to the hub for curated research and deep-dive guides.

Visit pillar hub

Latest guides

  • CSRD
  • Sustainability reporting
  • Board oversight
  • ESG data governance
  • Assurance readiness
Back to curated briefings