ESRS Data Governance and Internal Controls: From Datapoint Owners to Assurance Evidence

Prepared in British English as a practitioner Knowledge Card Package: answer, explanation, application, evidence, connections and publishing layer.

ESRS reporting combines information with very different characteristics: consolidated metrics, estimates, site data, value-chain information, policies, targets, forward-looking plans, qualitative judgements and narrative claims. These items may originate in finance systems, HR platforms, environmental logs, procurement tools, legal records, surveys, consultant models and manually maintained files. A single sustainability statement may therefore depend on hundreds of contributors and transformations that are invisible in the published report.

The reporting risk is not limited to an incorrect number. Material misstatement can also arise from:

• an omitted disclosure or missing entity;

• the wrong boundary, period, unit or definition;

• an unsupported statement about policy implementation or effectiveness;

• a changed model that has not been approved;

• an estimate presented without its assumptions or limitations;

• a target that does not reconcile to its baseline;

• a late adjustment that bypasses review;

• a version of the report that no longer matches the controlled evidence pack.

The objective is not to create finance-style controls for their own sake. It is to build an information chain that allows management, the board and the assurance provider to understand where information came from, why it is appropriate, how it was reviewed and what limitations remain.

The current 2023 ESRS require the undertaking to disclose the main features of its risk management and internal control system in relation to the sustainability reporting process. The disclosure includes the scope and main components of the system, the risk assessment and prioritisation approach, the principal risks and mitigation strategies, integration of findings into internal functions and periodic reporting to administrative, management and supervisory bodies.

The adopted 2026 ESRS simplify the main disclosure to the scope, main features and components of the risk management and internal control processes and systems. The related Application Requirement says the undertaking shall consider the completeness and integrity of data and the accuracy of estimation results as relevant aspects of reporting risk management.

ESRS does not prescribe one control framework, one software product, one three-lines model, one evidence folder structure or one mandatory frequency for every control. The organisation must design proportionate controls for its reporting risks, structure and data maturity. It may align the system with existing financial reporting, enterprise risk management, compliance or internal audit processes, but the design must address the distinctive risks of sustainability information.

A reliable model separates preparation, ownership, review and approval while avoiding an unmanageable number of hand-offs.

For a smaller undertaking, one person may perform several operational roles. However, significant information should not be prepared and finally approved by the same individual without an additional review.

Three linked levels of control

1. Entity-level controls govern scope, responsibilities, reporting policy, risk assessment, ethics, escalation and board oversight.

2. Process-level controls govern data collection, consolidation, calculations, estimates, narratives, close and report assembly.

3. Disclosure-level controls verify a particular metric or statement against its specification, evidence and ESRS presentation requirements.

A mature system links all three. A perfectly recalculated metric can still be misleading if the entity boundary was wrong. A well-designed group policy can still fail if a site uploads an uncontrolled workbook.

The disclosure matrix is the organising layer between materiality and data collection. It should record, for each material IRO and applicable disclosure:

• ESRS standard, DR, paragraph or datapoint;

• material topic and IRO linkage;

• reporting boundary and period;

• disclosure owner and contributor;

• quantitative or narrative status;

• data dictionary or narrative specification ID;

• source system or evidence category;

• calculation or methodology ID;

• control ID and review frequency;

• report section and cross-reference;

• assurance status and open findings;

• current version and last change date.

A list of ESRS datapoints is not yet a control matrix. The organisation must determine which information is material, how it applies to its facts and which evidence supports fair presentation.

A data dictionary prevents different sites, functions and periods from using the same label for different information. Each controlled metric record should contain at least:

The dictionary should be approved before the final data call. Changing definitions during the close creates inconsistent comparatives and undocumented management bias.

An evidence register records where support is held and how it relates to a disclosure. It is not necessary to copy every source document into one folder, but the link must be durable and accessible to authorised reviewers.

Recommended fields include:

• evidence ID, title and description;

• related metric, narrative claim, target or judgement;

• source owner and custodian;

• original system or repository;

• reporting period and extraction date;

• version, file hash or immutable identifier where available;

• access classification: public, internal, restricted, privileged or personal data;

• retention period;

• review performed and reviewer;

• limitations or missing support;

• link to issue and remediation record;

• final report version supported.

Evidence quality hierarchy

Evidence is stronger when it is contemporaneous, complete, independently generated or system-controlled, directly linked to the reported period and capable of reperformance. A management explanation may be necessary, but it should not replace source records where those records should exist.

For narrative disclosures, evidence may include approved policies, board minutes, programme records, contracts, stakeholder engagement logs, grievance data, training attendance, budgets, action trackers and outcome analysis. A policy proves that wording was approved; it does not by itself prove implementation or effectiveness.

Sustainability metrics frequently require transformations that are more complex than the final number suggests. A calculation inventory should identify every workbook, script, model and external calculation used in reporting.

Minimum controls include:

1. Formula approval. The methodology owner confirms the formula, factors, units and boundary.

2. Source-to-input reconciliation. Inputs reconcile to source-system totals or documented extracts.

3. Automated or independent recalculation. A reviewer reproduces significant calculations or tests formula integrity.

4. Factor governance. Emission factors, conversion rates and classification tables have source, version and effective period.

5. Estimate validation. Assumptions are reasonable and supportable, uncertainty is assessed and actual outcomes are compared with prior estimates where possible.

6. Change control. Model changes require a documented reason, impact assessment, approval and comparative review.

7. Protection. Locked cells, code repositories, access permissions and controlled master files reduce accidental or unauthorised changes.

8. Output reconciliation. Final tables and narrative values reconcile to the approved calculation output and report version.

A spreadsheet can be controlled if ownership, versioning, access, formula review and evidence are disciplined. A sophisticated platform can be uncontrolled if definitions or approvals are weak.

The evidence required for ESRS may include personal information, grievances, worker records, supplier findings, legal advice and commercially sensitive assumptions. Broad access is not evidence transparency.

A practical access model should:

• apply least-privilege permissions;

• separate preparer, reviewer and administrator rights where proportionate;

• restrict personal and grievance data and provide de-identified reporting extracts;

• identify legally privileged or investigation material;

• prevent deletion or silent overwriting after approval;

• retain access logs for high-risk repositories;

• use controlled transfer methods for subsidiaries and external providers;

• define what the assurance provider may inspect and how restricted evidence will be handled;

• revoke access after role changes or project completion.

The public report should be traceable to evidence without disclosing confidential details that are unnecessary for the statement.

A reviewer should do more than confirm that a field is populated. The review should address the assertion relevant to the information.

A staged sign-off model commonly includes:

• preparer certification;

• datapoint owner approval;

• control-owner review;

• technical ESRS review;

• functional or legal review for sensitive narratives;

• topic-level management sign-off;

• group reporting certification;

• final management and board approval.

Sign-offs should identify the exact data and report version approved. A generic email saying “looks fine” is weak evidence.

Every controlled information item needs a rule for changes after initial submission. The change log should record:

• item and version changed;

• date and person making the change;

• reason: new source data, error correction, methodology change, boundary change or presentation edit;

• quantitative and qualitative impact;

• effect on comparatives, targets, financial effects and connected disclosures;

• required re-performance of controls;

• approvals obtained;

• whether the assurance provider and board were informed;

• final report version affected.

Late changes should follow a defined threshold and escalation route. The objective is not to prohibit correction, but to ensure that a correction does not create new inconsistencies elsewhere in the statement.

Management representations support accountability; they do not replace evidence or controls. The CEAOB's non-binding limited-assurance guidelines state that practitioners should request a representation letter signed by at least one responsible member of senior management or those charged with governance, including confirmation of responsibility for the sustainability statements.

An internal representation process may ask responsible executives to confirm that, to the best of their knowledge:

• information in their area is complete and prepared under approved definitions;

• significant estimates, judgements and limitations have been disclosed;

• known errors, fraud concerns and non-compliance relevant to the statement have been reported;

• material subsequent events and changes have been communicated;

• policies, actions and targets are accurately described;

• evidence has been retained and is available;

• unresolved issues are listed rather than concealed.

The representation letter is the final layer of responsibility, not a cure for missing source documentation.

Findings should be managed in one controlled issue log, whether they arise from management review, internal audit, assurance, regulator feedback or post-publication correction.

A useful workflow is:

1. Log the issue with affected disclosure, source, control and report version.

2. Classify the issue: data, boundary, method, evidence, control execution, narrative, presentation or governance.

3. Assess severity based on potential misstatement, pervasiveness, regulatory risk and time to publication.

4. Contain the immediate risk, such as suspending a number or restricting an unsupported claim.

5. Correct the current-period information and reperform affected controls.

6. Analyse root cause: design failure, execution failure, capacity, system, definition or oversight.

7. Remediate with owner, deadline, funding and success evidence.

8. Validate closure independently and update the control matrix, dictionary or methodology.

9. Report significant or overdue issues to management and the board.

Closing an assurance request is not the same as remediating the underlying process. Sustainable closure changes the system that caused the finding.

The matrix below is illustrative. Control frequency and evidence should be tailored to risk, reporting timetable and system maturity.

Figure 2. Illustrative ESRS control matrix linking risks, controls, owners and evidence. Branded educational visual by London Reporting Academy.

How to use the matrix

Each control should have a separate design record specifying objective, population, procedure, evidence, reviewer competence, failure criteria and escalation. The table in the report may describe the overall system; the detailed matrix remains internal evidence.

Profile. A diversified manufacturer estimates purchased-goods emissions using procurement spend and industry emission factors because supplier-specific activity data are incomplete.

Initial risk. The procurement extract excludes two newly acquired entities, currencies are converted using different rates, factor versions are not documented and a consultant sends only the final number.

Control design. The group:

1. reconciles the entity list to financial consolidation;

2. extracts procurement spend under a controlled query and reconciles totals to finance;

3. applies one approved currency-conversion convention;

4. documents factor source, version, classification and effective period;

5. retains the model and requires sufficient detail for reperformance;

6. performs sensitivity analysis and identifies the largest uncertainty drivers;

7. compares the result with prior year and business activity changes;

8. obtains methodology and datapoint-owner approval;

9. discloses the estimate method and limitations proportionately;

10. records a plan to increase supplier-specific data coverage.

Assurance evidence. The evidence pack contains the consolidation reconciliation, procurement extract, mapping table, factor library, model, sensitivity analysis, review record and disclosure cross-reference.

Limitation. This is an illustrative control design. The appropriate GHG methodology, category boundary and disclosure depend on the undertaking's facts and applicable ESRS requirements.

1. Assigning one “ESRS owner” to hundreds of datapoints. Allocate accountable owners at disclosure or metric level and identify contributors and reviewers.

2. Building the evidence register after drafting. Define evidence requirements in the dictionary and disclosure matrix before the data call.

3. Treating narrative disclosures as uncontrolled prose. Use a claim ledger and evidence review for policies, actions, targets, progress and effectiveness.

4. Using the same review for every metric. Design controls around the actual assertion and risk: completeness, boundary, cut-off, estimate or presentation.

5. Allowing local spreadsheets to overwrite group definitions. Lock master specifications and require documented exceptions.

6. Keeping models in external-provider systems only. Contract for data, methodology and outputs sufficient for management ownership and reperformance.

7. Using management representations to cover missing evidence. Representations supplement, but do not replace, records and controls.

8. Closing findings without root-cause remediation. Update the process, owner, system or control design and validate effectiveness.

9. Failing to control the final Word, design or tagging file. Reconcile the published version to approved data and archive the exact final package.

10. Overengineering low-risk datapoints while neglecting high-risk estimates and boundaries. Use a documented risk assessment to prioritise effort.

• Current ESRS 2 GOV-5: risk management and internal controls over sustainability reporting.

• Adopted revised ESRS 2 GOV-4 and AR 10: scope, main features and components of the control system; consideration of data completeness, integrity and estimate accuracy.

• ESRS 1: fair presentation, qualitative characteristics, material information, estimates, value-chain information and preparation of the sustainability statement.

• GDR-M and GDR-T: methodology and contextual information for metrics and targets.

• EFRAG IG 3: non-authoritative datapoint inventory for the 2023 ESRS; useful for architecture, but not a substitute for materiality or control design.

• CEAOB limited-assurance guidelines: risk-based procedures, sufficient appropriate evidence, recalculation, reperformance, value-chain information and representation letters, subject to national pronouncements.

• ISSA 5000: comprehensive international standard for sustainability assurance engagements where adopted or otherwise applicable.

Does ESRS require a formal internal-control framework?

ESRS requires disclosure of the reporting risk management and internal control system, but does not prescribe one named framework. The organisation should use a proportionate, documented system that addresses its material reporting risks.

Is an evidence register mandatory?

The standards do not prescribe a tool called an evidence register. It is a practical way to demonstrate traceability, ownership, access and review and is particularly useful for assurance readiness.

Can the sustainability team own all controls?

The central team can own the reporting framework, but source information should normally remain accountable to the relevant business, finance, HR, procurement, legal or operational owner. Independent review should be proportionate to risk.

Do limited-assurance providers test every control?

No. Assurance work is risk-based. The practitioner designs procedures to obtain sufficient appropriate evidence for the conclusion and may use inspection, observation, confirmation, recalculation, reperformance, analytics or inquiry. Management should not assume every control or datapoint will be tested.

How should narrative claims be controlled?

Create a claim ledger linking each significant statement to evidence, owner, review and report version. Distinguish policy existence, implementation activity, output, outcome and effectiveness.