First ESRS Reporting Cycle: A 15-Month Project Plan for Companies and Groups

Prepared in British English as a practitioner Knowledge Card Package: answer, explanation, application, evidence, connections and publishing layer.

A mature financial close relies on policies, systems, owners, reconciliations and governance that already operate throughout the year. First-time sustainability reporting often lacks this infrastructure. Data may sit in HR platforms, spreadsheets, site systems, procurement tools, risk registers, grievance channels and external providers. Narrative disclosures may depend on board papers, strategy decisions, stakeholder engagement and evidence from the value chain.

A 15-month plan creates time to test the process before the statutory close. It also allows the organisation to correct definition, boundary and control problems while there is still time to collect better data. The plan can be compressed for a simple entity or extended for a complex group, but the sequence should remain controlled.

The project sponsor should approve a short mobilisation paper covering:

• legal entities and group structure;

• expected CSRD scope by jurisdiction and reporting period;

• whether a parent exemption or other exemption is being considered;

• the ESRS edition expected to apply and the transition contingency;

• management-report publication date and local filing dates;

• assurance provider, national assurance framework and independence constraints;

• financial-statement close timetable;

• languages, digital-tagging requirements and incorporation-by-reference strategy;

• prior sustainability reports, GRI or other datasets available for reuse;

• known acquisitions, disposals, reorganisations or system changes.

From financial years beginning on or after 1 January 2027, the amended EU scope generally applies to undertakings exceeding both EUR450 million net turnover and an average of 1,000 employees, including at consolidated level where applicable. Transitional application for 2025-2026 can depend on Member State use of the permitted derogation. The project should therefore use a legal-scope memorandum, not an informal “we are probably in scope” assumption.

The month labels are relative. A group with an early annual-report deadline may need to start before the reporting year. A decentralised group may also need an extra pilot cycle for site and subsidiary submissions.

This workstream is owned jointly by legal, finance and sustainability reporting. It should answer:

• Which undertaking prepares the individual or consolidated sustainability statement?

• Which subsidiaries are included through the financial consolidation perimeter?

• How are associates, joint arrangements, leased assets and other relationships handled for each metric?

• What upstream and downstream value-chain information is relevant?

• Which national implementation rules, exemptions and assurance requirements apply?

• Which ESRS edition is legally effective for the period?

• How will the project respond if the revised ESRS enters into force during implementation?

The key output is a boundary map, not only a legal memo. It should connect every legal entity and value-chain category to data owners, systems, reporting obligations and exclusions.

Critical control

Any change to group structure, reporting period or standard edition triggers a documented impact assessment on materiality, datapoints, methods, comparatives, assurance and report wording.

The project needs clear separation between preparation, review and approval. A practical model includes:

• board or supervisory body: ultimate oversight and approval of the management report;

• audit, assurance or sustainability committee: detailed challenge of process, controls, materiality and findings;

• executive steering committee: scope, resources, cross-functional decisions and issue escalation;

• programme director: integrated timetable, dependencies and evidence of completion;

• technical reporting lead: ESRS interpretation, disclosure matrix and drafting;

• data and controls lead: data dictionary, calculations, controls and evidence;

• topic owners: policies, actions, metrics, targets and narrative evidence;

• legal/privacy team: legal scope, claims, confidentiality and personal data;

• finance and risk: connectivity, financial effects, consolidation and controls;

• internal audit: independent readiness review where appropriate;

• assurance provider: independent engagement, not management's control designer.

The steering committee should approve a decision log identifying the issue, options, source basis, owner, approver, date and effect on disclosures.

The DMA is on the critical path because it determines the material topics, IROs and much of the disclosure architecture. A first cycle should not postpone the materiality conclusion until the report is drafted.

A defensible DMA file includes:

1. business model, strategy, geography, sector and value-chain analysis;

2. a complete IRO universe and controlled taxonomy;

3. evidence sources and stakeholder inputs;

4. impact materiality and financial materiality criteria;

5. severity, likelihood and time-horizon assessments;

6. thresholds or qualitative decision rules and sensitivity analysis;

7. management challenge and governance approval;

8. changes from prior assessments;

9. links to reportable topics and entity-specific information;

10. unresolved limitations and improvement actions.

Critical path risk

If the DMA is late, data owners cannot know which topical metrics, policies and action disclosures will be required. The project then over-collects broad ESG data or discovers material gaps after year-end.

The disclosure matrix connects:

• material IROs and topics;

• DRs, datapoints and ARs;

• owner and reviewer;

• source system or narrative evidence;

• methodology, unit, period and boundary;

• calculation and consolidation file;

• applicable relief, estimate or omission;

• report location and cross-reference;

• control and assurance evidence;

• status, issue and sign-off.

The data dictionary then specifies each quantitative and narrative datapoint. It should be version-controlled and used by software, spreadsheets, instructions and assurance request lists. A separate evidence register records the actual files, approvals and retention status.

High-risk items to dry-run first

Prioritise datapoints with one or more of these characteristics:

• value-chain data or external providers;

• multiple source systems and manual transformations;

• estimates, proxies or models;

• financial effects and links to financial statements;

• greenhouse-gas inventory and Scope 3;

• workforce populations with privacy constraints;

• incident, grievance or human-rights information;

• new baselines, targets or restatements;

• entity-specific metrics;

• significant management judgement.

A first reporting cycle benefits from two dry runs before final close.

Dry run 1 - design test

Use partial-year or prior-year data to test definitions, boundaries, formulas, evidence and consolidation. The objective is not to publish a perfect number; it is to expose design failures.

Dry run 2 - operating test

Use year-to-date data and require owners to perform the intended controls. Sample evidence should be stored as it will be for assurance. The team should track preparation time and bottlenecks.

Final close

The sustainability close should have:

• a cut-off date and late-adjustment policy;

• locked input templates or system workflow;

• entity and site certification;

• calculation version control;

• reconciliations and variance analysis;

• estimate review and approval;

• subsequent-events assessment;

• management representation process;

• issue closure and final sign-off.

The close calendar should be integrated with the financial close because financial effects, headcount, revenue denominators, consolidation changes and report approval depend on finance data.

Drafting should begin with approved evidence, not with generic prose. For every material topic, the team should connect:

• material IROs;

• governance and strategy;

• policies;

• actions and resources;

• metrics and targets;

• current and anticipated financial effects where required;

• limitations and estimates;

• links to financial statements and other management-report content.

The technical editor should maintain a claim ledger. Each significant statement is classified as a requirement, factual statement, estimate, management judgement, future plan or interpretation and linked to evidence.

Group drafting challenge

A consolidated statement should not read as a list of subsidiary initiatives. It should explain the group-level picture while disaggregating where aggregation would obscure significant variations. Subsidiary contributions need a common terminology and approval process.

The assurance provider is not a substitute for management controls. Before fieldwork, management should be able to show:

• how scope and materiality were approved;

• who owns each disclosure;

• how data is complete and accurate;

• how estimates and models are governed;

• how narrative claims are evidenced;

• how changes and restatements are controlled;

• how findings are escalated;

• how board oversight operates;

• how the published statement reconciles to the controlled draft.

The 2023 ESRS disclose risk management and internal controls under GOV-5; the revised 2026 ESRS move this to GOV-4 and simplify the main disclosure to the scope, main features and components of the processes and systems. The adopted AR specifically highlights completeness and integrity of data and the accuracy of estimates as relevant reporting risks.

Figure 2. Critical path and decision gates for the first ESRS cycle. Branded educational visual by London Reporting Academy.

The following ranges are implementation assumptions for a moderately complex group, not ESRS requirements.

A group with poor source systems, many jurisdictions or extensive value-chain metrics may require materially more capacity. A simpler entity with mature GRI and financial-control infrastructure may require less.

Resourcing test

Ask whether the plan funds the work that occurs outside the central sustainability team: site data preparation, HR and procurement extracts, legal review, finance reconciliation, evidence administration, translation, digital tagging and board materials. Under-resourced projects often appear adequately staffed until Month 10, when all workstreams converge.

Profile. A group has 32 legal entities, 18 production sites, operations in nine countries and a prior GRI report. It expects six material ESRS topics and plans publication four months after year-end.

Initial position. Climate and workforce data exist, but site boundaries differ. Scope 3 uses a consultant model with limited internal ownership. Supplier social data is questionnaire-based. Narrative policies are stored in multiple versions. No integrated evidence register exists.

Plan decision. The group begins 11 months before year-end and uses the first four months for scope, governance and DMA. It prioritises dry runs for GHG emissions, workforce populations, water, waste and value-chain worker disclosures. The evidence register and data dictionary are implemented before the first data call.

Critical finding. The first dry run shows that three sites report contractors as employees and that renewable electricity certificates are not linked to consumption periods. Because the issue is found in Month 8, the group corrects definitions and evidence before final close.

Outcome. Assurance fieldwork still identifies findings, but they relate mainly to documentation quality rather than fundamental boundary errors. The group publishes and converts findings into a 90-day remediation programme.

1. Starting after year-end. Begin early enough to influence data collection and governance during the reporting period.

2. Treating the DMA as a consultant presentation. Retain evidence, methodology, decisions, challenge and approval in a controlled file.

3. Assigning datapoints before defining boundaries. Lock metric specifications before data calls.

4. Collecting only quantitative data. Narrative policies, actions, governance and limitations require evidence and controls.

5. Waiting for assurance to identify control gaps. Run management dry runs and internal challenge first.

6. Leaving financial effects to the sustainability team. Integrate finance, risk, strategy and accounting owners from the start.

7. Assuming prior GRI data can be copied directly. Reconcile materiality, boundary, definitions, period and disclosure requirements.

8. Underestimating board and publication lead time. Reserve committee, board, translation, tagging and management-report integration slots at mobilisation.

9. Closing issues in email. Use an issue register with owner, severity, evidence, reviewer and approved resolution.

10. Publishing before the evidence archive is locked. Freeze the final report version, calculations, approvals and source files together.

• Accounting Directive as amended by Directive (EU) 2026/470: legal scope and reporting requirement.

• ESRS 1: reporting undertaking, value chain, double materiality, information materiality, preparation, presentation and reliefs.

• ESRS 2: governance, strategy, IRO process, policies, actions, metrics, targets and reporting controls.

• EFRAG IG 1, IG 2 and IG 3: non-authoritative implementation support for the 2023 ESRS.

• CEAOB limited-assurance guidelines and applicable national standards: assurance planning during the transitional EU period.

• ISSA 5000: global sustainability assurance standard that may inform methodology where adopted or otherwise applicable.

Can the plan be completed in less than 15 months?

Yes for a simpler entity or a mature reporting system, but the project should preserve the sequence and dry-run controls. Compression increases the need for decisive governance and narrow scope management.

Should the DMA be completed before the reporting year?

Ideally, the methodology and much of the assessment should be early enough to shape data collection and management processes. The assessment must also be updated for significant changes and final facts.

When should the assurance provider become involved?

Procurement and independence planning should begin at mobilisation. Management can discuss timetable, evidence expectations and engagement logistics early, while retaining responsibility for methodology, controls and the report.

Do we need new software in the first cycle?

Not necessarily. Controlled spreadsheets and repositories can work for a limited scope, but the organisation still needs definitions, access control, versioning, evidence links and review. Software does not replace these controls.