ESRS Data Governance and Internal Controls: From Datapoint Owners to Assurance Evidence

A sustainability metric can be arithmetically correct and still be misleading because the wrong entities were included, the denominator changed, a site estimate was silently replaced, supplier data were duplicated, a late incident was omitted or the narrative claim goes beyond the evidence. ESRS internal control therefore has to cover the full reporting chain: material IRO, disclosure requirement, definition, boundary, source, calculation, judgement, review, approval, presentation and publication.

Revised ESRS 2 GOV-4 requires disclosure of the scope, main features and components of risk management and internal control processes and systems in relation to sustainability reporting. Its AR 10 highlights completeness and integrity of data and accuracy of estimation results. GDR-M requires method, sources, relevant estimates and assumptions, value-chain proxies, context and significant changes for each metric. These provisions create a clear reporting expectation, but they do not prescribe one universal control framework or control catalogue.

Figure 5. ESRS data governance from material IRO and source systems to assurance evidence and publication.

The dictionary is not only a list of names and units. It is the controlled contract between the standard, the data owner, the calculation and the disclosure. At minimum, each record should contain:

Unique datapoint or narrative-claim ID, related material IRO, ESRS requirement and report locator.

Approved name, plain-language definition, official defined terms, unit and classification rules.

Reporting period, cut-off, comparative basis and events-after-period treatment.

Organisational, operational and value-chain boundary; included and excluded entities, sites, products or populations.

Primary source system, report or evidence; extraction method; data owner and backup owner.

Calculation, transformation, consolidation, emission or conversion factor, numerator, denominator and double-counting rules.

Estimate, proxy or model methodology, assumptions, uncertainty, validation and data-quality improvement plan.

Preparer, reviewer, approver, control frequency, evidence retained and issue escalation.

Method version, effective date, change rationale, comparative impact and restatement decision.

Access classification, privacy or privilege note and retention requirement.

1. Separate source data from transformations and outputs. An independent reviewer should be able to identify the population received, adjustments made and final value.

2. Lock formulas and protect controlled cells. Manual overrides should be visible, justified, approved and included in the change history.

3. Maintain factor and methodology registers. Record source, version, geography, period, unit conversion and replacement decisions for external factors.

4. Validate models and estimates proportionately. Test logic, reasonableness, sensitivity, completeness of inputs and known bias; document uncertainty and limitations.

5. Control consolidation. Reconcile entity submissions to the reporting population, prevent duplicates, eliminate internal flows where required and investigate unexplained movements.

6. Retain reproducible period-end versions. A live dashboard that changes after publication is not the complete evidence for the reported figure.

The public GOV-4 disclosure should explain the scope, main features and components of the risk-management and internal-control system over sustainability reporting. It should be specific enough for users to understand how the undertaking manages reporting risk, but it does not need to publish the full internal control matrix or sensitive system details. Relevant information may include governance, risk assessment, data ownership, main control types, estimate governance, monitoring, deficiencies and remediation.

Adaptation warning. The wording must reflect the actual system, findings and governance. A generic statement that “robust controls are in place” is not supported merely by having data owners or assurance.

Detection. A central classification and variance control identifies inconsistent worker populations and an implausible increase. The reviewer traces samples to HR and learning systems and finds that the group instruction did not define completion, population or unit consistently.

Correction. The group issues an approved definition, restates the dry-run data, records the comparative impact and updates the data dictionary, local sign-off and review control. Where reliable historical data cannot be reconstructed, the statement explains the limitation rather than presenting a false trend.

Root cause and remediation. The issue is classified as a design deficiency, not a one-off input error. The group adds a mandatory local population reconciliation, test examples in the reporting manual and targeted training. Internal audit verifies implementation in the next cycle.

Building controls around a list of datapoints without linking them to material IROs, disclosure objectives and report claims.

Using one generic owner sign-off as the only evidence of completeness and accuracy.

Leaving estimates, proxies and external factors outside model and change governance.

Allowing unrestricted workbook access and invisible manual overrides.

Retaining links to live systems but not the period-end extract or calculation version used for publication.

Failing to reconcile source populations, group scope, acquisitions and disposals.

Treating narrative disclosures and legal assertions as editorial text rather than controlled information.

Closing assurance findings without root-cause analysis or verifying remediation.

Describing controls publicly in a way that overstates maturity or omits significant unresolved limitations.

Every material disclosure has an owner, reviewer, method, source and evidence locator.

Data dictionary records are approved, versioned and consistent with group instructions and public wording.

Source populations and reporting boundaries are reconciled and exceptions resolved or disclosed.

Calculations, factors, estimates, proxies and manual adjustments are reproducible and independently reviewed.

Restricted evidence has lawful, secure and workable assurance access.

Narrative claims, target progress, effectiveness and limitations are included in the claim ledger and review.

Changes and restatements have approved rationale and comparative treatment.

Open findings have severity, disclosure impact, owner, due date, compensating control and governance escalation.

Final values and narrative tie to the exact published version and release archive.

Management representations disclose known gaps, unresolved issues and post-close changes.

1. Could an independent reviewer reproduce the final disclosure without relying on the preparer’s memory?

2. Which control would detect a complete but wrongly bounded dataset?

3. Are narrative effectiveness claims subject to the same evidence and approval discipline as quantitative metrics?

Source check completed on 2 August 2026. This article is an educational publication draft. It does not provide legal, assurance or organisation-specific advice. Confirm the applicable ESRS edition, the final Official Journal text, national implementation and the undertaking’s facts before public use.

Changes to ESRS GOV-4, GDR-M, estimates, value-chain data or relief provisions.

New EU or national assurance standards and assurance-provider evidence expectations.

ERP, consolidation, data-platform or access-control changes affecting reporting lineage.

Control failures, restatements, significant deficiencies or recurring assurance findings.

Do not claim that the sample matrix is complete or sufficient for every organisation.

Tailor control owners and evidence to actual systems, legal entities and segregation constraints.

Include narrative disclosures, legal claims and governance approvals in the control universe.

Review retention, privacy, privilege, information security and cross-border access with specialists.