Skip to the answer

Disclosure GuidesPillar guides, articles, FAQ and expert notes

Level 2 · Decision guide·GRI · Disclosure guides

Using GRI Data for EcoVadis, S&P CSA, CDP and Customer Questionnaires

How to build a single source of truth, preserve definitions and evidence, and convert GRI reporting data into rating and procurement responses without creating inconsistencies

Who this is for A 16-minute read for reporting teams working through GRI alongside ESRS and IFRS S1/S2, and for reviewers testing whether the evidence behind it holds.

Published passport

Current as at 11 August 2026
RK Reviewed by Dr Ross KurinkoLinkedIn Strategic ESG Advisor · IFRS S1 & S2 / GRI / ESRS expert GRI Certified Global Trainer · PhD, University of Cambridge · ESG-AI expert 15+ years on FTSE 100 & Fortune Global 500 disclosures Canary Wharf, London LRA educational guidance · Not issued or endorsed by GRI

Edition written against

This article explains a control model for data reuse. It does not predict a score, guarantee …

Published

12 Aug 2026

Knowledge Hub guide

Last reviewed

11 Aug 2026

Short answer

The answer, before the reasoning

GRI data can provide a strong foundation for EcoVadis, S&P Global CSA, CDP and customer questionnaires, but a GRI report is not a universal answer bank. The destinations use different assessed entities, periods, boundaries, definitions, evidence rules, materiality lenses, formats and scoring logic.

The defensible model is to govern the underlying facts once — through a data dictionary, evidence register and approval trail — and then convert those facts through destination-specific mappings. Every reused answer should retain its source, calculation, scope, limitation and reviewer.

ANSWER | EXPLAIN | APPLY | EVIDENCE | CONNECT | PUBLISH

Article map

This Knowledge Card gives a direct answer, explains the technical logic, shows how to apply it, identifies the evidence needed, and provides a controlled publishing package. Requirements, recommendations, implementation practice and expert interpretation are kept distinct.

In practice

Stage What the reader will get
1 Direct answer and why it matters
2 Technical explanation and distinctions
3 Practical method, mapping and examples
4 Common mistakes, myth correction and reviewer checklist
5 Related standards, source status and update triggers
6 Editorial, SEO, visual and CMS package

Why “copy from the GRI report” fails

A company may report group-wide water withdrawal in its GRI report, complete an EcoVadis assessment for one legal entity, answer an S&P CSA question for the listed parent, disclose to CDP under a different consolidation approach and respond to a customer asking only about one manufacturing site or purchased product. The number may look familiar in every channel while referring to a different organisation, period or boundary.

The risk is larger than a clerical mismatch. Rating submissions often combine narrative policies, evidence documents, performance metrics and question-specific scoring criteria. Procurement questionnaires may be used in supplier qualification or contract decisions. An answer that is technically correct in the GRI report can therefore be incomplete, unsupported or misleading in another destination.

A well-designed GRI reporting system remains highly valuable. It usually already contains material-topic decisions, policies, management actions, targets, metrics, source owners, methodology notes and evidence. The conversion article is about protecting that value through structured mapping rather than repeatedly creating ungoverned spreadsheets.

In practice

Quick orientation

Question Practical answer
Can we reuse a GRI metric? Often yes, after checking assessed entity, period, boundary, definition, unit, calculation and evidence requirements.
Can we reuse a report paragraph? Sometimes, but narrative usually needs to be reframed around the question, assessed entity, evidence and scoring criteria.
Is the GRI report the single source of truth? No. It is a controlled output. The source of truth should sit behind it: data dictionary, source systems, calculation files, evidence and approvals.
Do mappings guarantee points or a rating? No. Scoring methodologies, industry weighting, analyst review, evidence rules and performance thresholds remain destination-specific.
What is the essential control? Each response must link to the underlying fact and show every transformation from source to destination.

In practice

Four destination logics — and one controlled core

Layer What it means in practice
GRI impact reporting Reports material topics representing the organisation’s most significant impacts and the relevant management and topic disclosures. GRI supports transparency and accountability; it is not designed as a rating questionnaire.
EcoVadis methodology Assesses the quality of a company’s sustainability management system through Policies, Actions and Results, using management indicators and documentary evidence. The assessed entity and accepted evidence matter.
S&P Global CSA Uses industry-specific questionnaires, criteria and weights, with question-level data and scoring logic. Public disclosure can be important, but the requested answer and evidence must be tested against the current industry questionnaire and handbook.
CDP disclosure Uses a structured environmental questionnaire, sector and issue pathways, reporting guidance and annual scoring materials. 2026 disclosure includes integrated and issue-specific modules with conditional questions.
Customer questionnaires Vary by buyer, contract, product, site, legal entity, platform and verification expectations. A customer template is not automatically aligned with a reporting standard.
LRA implementation practice Maintain a destination-neutral sustainability data core and a mapping register that records where reuse is exact, transformed, partial or not possible.

1. Treat GRI as a governed data foundation, not a conversion shortcut

A mature GRI process can supply five valuable components: a view of significant impacts; controlled narrative on policies and management actions; quantitative metrics; evidence and methodology; and governance approvals. These components are reusable only when the organisation can separate the underlying fact from the wording used in the published report.

For example, “42,000 megalitres of water withdrawn” is not yet a reusable answer. The reusable object must also contain the reporting entity, sites, period, water sources, inclusions and exclusions, measurement method, estimation approach, unit conversion, source file, data owner, reviewer, restatement status and supporting evidence. The report page is then one output generated from that object.

2. Compare the destinations before mapping

EcoVadis, S&P CSA and CDP are also not interchangeable with each other. EcoVadis explicitly assesses management-system quality through Policies, Actions and Results. S&P CSA uses industry-specific criteria and weights associated with material sustainability issues and company value drivers. CDP uses its own annual environmental questionnaire and scoring materials. A customer may ignore all three and ask for a product carbon footprint or site audit certificate.

In practice

Destination Primary purpose Typical evidence expectation — Why GRI alone may not be enough
GRI report Accountability for significant impacts and how they are managed. Published disclosures supported by internal evidence, methods and controls. — It is the source output being reused, not an external scoring destination.
EcoVadis Assessment of the sustainability management system of the assessed company. Formalised, recent, pre-existing supporting documents; policy, action and results evidence. — The assessed legal entity, coverage, accepted documents and management indicators may differ from group reporting.
S&P Global CSA Industry-specific evaluation of sustainability performance and management. Question-specific answers, public or supporting evidence as permitted, and alignment with current definitions and scoring instructions. — Industry weighting, requested datapoints, response options and scoring logic are not determined by GRI materiality.
CDP Structured environmental disclosure and scoring across climate and nature-related issues. Question-level data, methodologies, targets, governance, risk and verification information under annual guidance. — CDP pathways, activity classification, environmental issue scope, scoring criteria and question logic change over time.
Customer questionnaire Supplier qualification, due diligence, product or contract assurance. Whatever the buyer specifies: certificates, site data, product data, policy evidence, audit records or attestations. — The scope may be a site, product, legal entity or contract rather than the GRI reporting organisation.

3. Build the single-source-of-truth model

Figure 1. The published GRI report is one output. A destination-neutral sustainability core governs the facts, evidence, transformations and approvals used across ratings and questionnaires.

The “single source of truth” is not one giant spreadsheet and not one published report. It is a controlled set of linked records. Small teams can begin in Excel, SharePoint or another document-controlled environment; larger teams may use reporting software. The governance design matters more than the tool.

In practice

Register Minimum fields Purpose
Data dictionary Metric ID, definition, unit, denominator, calculation, source systems, owner, frequency. Prevents one label from hiding different calculations.
Boundary register Reporting entity, subsidiaries, sites, value-chain scope, acquisitions/disposals, exclusions. Explains which part of the business each fact represents.
Evidence register Document ID, type, owner, date, coverage, approval, public/private status, expiry. Supports narrative and quantitative answers and avoids expired or ineligible evidence.
Methodology register Standards, factors, estimation, assumptions, changes, restatements and limitations. Makes conversions and year-on-year changes reproducible.
Destination mapping Question ID, destination definition, source fact, transformation, residual gap, reviewer. Shows whether reuse is exact, transformed, partial or unavailable.
Response and sign-off register Submission, preparer, evidence links, review status, approver, version and date. Creates an audit trail across portals and customer requests.
Issue log Conflict, missing evidence, boundary mismatch, decision, owner, deadline and escalation. Stops unresolved discrepancies from being hidden in email.

4. Use a mapping register that records differences, not just matches

A weak mapping contains two columns: “GRI disclosure” and “question number”. A defensible mapping explains why the source can be reused and what changes are required. It should also show the direction of reuse. Data prepared for GRI may support a rating response, but a rating answer optimised for a scoring rubric should not silently redefine the GRI disclosure.

In practice

Mapping field Example: water withdrawal
Source fact Total water withdrawal by source, group operations, calendar year 2025, megalitres.
GRI output GRI 303-3 disclosure with source categories, stress-area information and methodology.
Destination question Customer asks for water withdrawal at the supplying plant for the previous fiscal year.
Exact differences Entity is one plant rather than the group; fiscal year differs; customer requests cubic metres and supporting invoice/meter records.
Transformation Filter source data to plant; align period; convert megalitres to cubic metres; attach approved meter reconciliation.
Residual gap Stress-area classification is not requested, but the customer asks for a reduction plan not contained in the metric record.
Review Plant operations owner confirms scope; reporting reviewer checks conversion; commercial owner approves external response.

5. Eight consistency gates before reuse

Every reused answer should pass the same gates. This is particularly important when different teams own GRI reporting, ratings, investor relations and customer tenders.

Figure 2. Eight gates for controlled reuse. A response is released only when the source, transformation, evidence and destination-specific sign-off are complete.

1. Entity: confirm the legal entity, group, business unit, site or product being assessed.

2. Period: match the requested year, baseline, average period and submission date.

3. Boundary: compare operational, financial, equity-share, site, supply-chain or product boundaries.

4. Definition: test inclusions, exclusions, terminology and question-specific instructions.

5. Unit and denominator: confirm currency, measurement unit, intensity denominator and conversion factor.

6. Calculation: retain the source extract, formula, factor, estimates, assumptions and reconciliation.

7. Evidence: confirm that the document is current, covers the assessed scope and is acceptable for the destination.

8. Scoring and sign-off: read the current scoring or reporting guidance and obtain destination-specific review and approval.

6. Convert narrative evidence as carefully as metrics

Questionnaires frequently ask whether a policy exists, which actions have been deployed, how much of the organisation is covered, whether performance is monitored, and what results have been achieved. A GRI report may summarise all of this in one paragraph. The destination may require separate evidence for each element.

In practice

Narrative component Possible GRI source Conversion check
Policy / commitment GRI 2 policy commitments or topic-management disclosure. Is the policy formally approved, current, in scope for the assessed entity and acceptable as evidence?
Action / measure GRI 3-3 actions or Topic Standard narrative. Is deployment evidenced across sites, employees or suppliers rather than merely announced?
Coverage Reporting boundary or implementation statement. Does the percentage refer to the assessed entity and the destination’s coverage denominator?
Result / performance GRI metric or target progress. Does the destination require absolute data, trend, target, external verification or performance threshold?
Governance GRI 2-12 to 2-14, responsibilities and approval. Does the question ask for board oversight, executive incentives, frequency or documented decisions?
Due diligence GRI 2-23 to 2-26 and material-topic management. Does the destination require screening coverage, audit findings, remediation outcomes or a supplier-specific process?

7. Manage public and private evidence deliberately

A GRI report is public by design, while rating and customer portals may allow supporting documents that are not public. The organisation should label each evidence item as public, restricted external, confidential internal or prohibited from external use. The label should not be chosen only when a questionnaire deadline arrives.

Public evidence should be consistent with the report, website, policies, data book and previous submissions.

Restricted evidence should have an approved recipient, purpose and retention rule.

Confidential records should not be uploaded simply because they contain stronger detail; use redaction, summaries or attestation where the destination permits.

Evidence expiry dates, document versions and organisational coverage should be monitored.

A questionnaire answer should never make a stronger effectiveness claim than the underlying records support.

Commercial teams should use approved response language rather than editing technical definitions to meet a tender deadline.

8. Establish an annual operating cycle

Ratings and questionnaires often follow different calendars. A central operating cycle reduces rush and contradiction. At the start of the reporting year, update definitions and destination inventories. During data collection, capture evidence once. Before each submission, freeze the destination mapping and current guidance. After submission, archive the response, record analyst feedback and feed justified improvements back into the core data model.

In practice

Cycle stage Key output Control
Plan Destination calendar, question inventory, owners and current methodology pack. Confirm edition and assessed entity before data requests begin.
Collect Approved facts, policies, actions, results and evidence. Use common IDs and retain source files.
Map Question-level mapping and residual gaps. Second-person review of boundary, definition and transformation.
Draft Destination-specific answer and evidence package. Do not edit source facts inside the response workbook.
Approve Signed-off submission version. Technical, legal/confidentiality and business-owner gates as relevant.
Learn Feedback, score or customer comments and change requests. Separate real data improvements from score-chasing changes that would distort the reporting basis.

In practice

Hypothetical case: one group, four assessed scopes

Element Illustrative case
Organisation A listed manufacturing group publishes a consolidated GRI report. One subsidiary completes EcoVadis, the parent responds to S&P CSA and CDP, and a major customer assesses one supplying plant.
Source fact The group reports 2025 Scope 1 and Scope 2 GHG emissions, energy use, water withdrawal, workforce indicators, supplier due diligence and governance information.
EcoVadis conversion Only evidence covering the assessed subsidiary is used. Group policies are mapped only where they formally apply to the subsidiary; local deployment and results evidence are added.
S&P CSA conversion The team reviews the current industry questionnaire, public-disclosure expectations, definitions, question structure and scoring guidance. Some GRI data are reused; additional financially material, industry-specific information is prepared.
CDP conversion Environmental data are mapped to the current CDP pathway, reporting guidance and scoring material. GHG boundaries, verification, targets, transition-plan and issue-specific questions are separately checked.
Customer conversion The customer receives plant-level data and approved certificates for the contract period, not the group total. Product and site claims are reviewed by operations and commercial owners.
Detected conflict The subsidiary’s energy intensity used revenue while the customer template expected production volume. The mapping register prevented the two intensities from being labelled as the same KPI.
Outcome One data core supports all four destinations, but each response retains its assessed scope, transformation, evidence and reviewer.

In practice

Illustrative response methodology note

Annotation Why it matters
Named controlled register Shows that the report is not the sole evidence source.
Reuse conditions Makes matching criteria explicit.
Transformation record Creates reproducibility and accountability.
Policy applicability test Avoids treating a parent policy as proof of local deployment.
Scope warning Prevents readers from generalising the response to the entire group.

In practice

Weak versus stronger reuse approaches

Weak wording / approach Why it is weak Stronger direction
“See our sustainability report.” The response does not identify the requested fact, assessed scope or evidence. Answer the question directly, cite the exact report location and attach or link the accepted supporting evidence.
Copying the same KPI into every portal Definitions, units, periods and boundaries may differ. Use a governed source metric and destination-specific transformation record.
Uploading a group policy for a subsidiary assessment The document may not prove local applicability or implementation. Show formal applicability, local deployment and results evidence for the assessed entity.
Changing a GRI definition to fit a score Creates inconsistency and weakens the reporting system. Maintain the GRI definition; create a separate destination calculation with a transparent bridge.
Using the latest available number without period disclosure A questionnaire may ask for a different reporting year or baseline. State the period and explain any permitted use of more recent or estimated data.

In practice

Common mistakes and corrections

Mistake Risk Correction
Treating the report as the database The publication may aggregate, round or omit the detail needed for a destination. Link responses to source records, calculations and evidence behind the report.
No assessed-entity check Group evidence is applied to a subsidiary, site or product without basis. Maintain an entity and coverage register for every response.
One mapping table reused indefinitely Question IDs, definitions, scoring and evidence expectations change. Version mappings by destination and cycle; trigger review when guidance changes.
No distinction between policy, action and result Management-system evidence is overstated and performance claims become unsupported. Tag evidence by what it proves and its organisational coverage.
Ignoring public/private status Confidential evidence may be exposed or public claims may contradict private submissions. Apply an evidence-classification and release-control process.
Submission owned only by sustainability Operational, financial, legal or commercial facts are not validated. Assign question owners and require destination-specific review.
Score-chasing changes the source definition Year-on-year comparability and GRI consistency are damaged. Keep source definitions stable; document destination-specific bridges separately.

Rule

Myth: “A GRI report should contain everything needed for EcoVadis, S&P CSA, CDP and customer questionnaires.”

Reality: A GRI report can provide a large share of the underlying facts and evidence, but the other destinations have their own assessed scopes, definitions, evidence rules, industry pathways and scoring or procurement logic. The goal is a common controlled data foundation, not identical answers. Why the confusion arises: The same sustainability topics recur across requests, which makes copy-paste feel efficient. The hidden differences usually appear in entity coverage, period, definitions, proof of implementation and question-level scoring.

Readiness

Reviewer checklist

  • Is the destination, cycle, assessed entity and current guidance recorded?
  • Does the source metric have a controlled definition, unit, denominator and owner?
  • Have reporting period and baseline been matched?
  • Are organisational, operational, value-chain, product and site boundaries explicit?
  • Is the transformation reproducible from the source extract?
  • Does each policy or action document cover the assessed entity and remain current?
  • Is the evidence acceptable for the specific destination and classified for external use?
  • Have question-specific scoring, response options and essential criteria been read rather than inferred?
  • Are public statements consistent across the GRI report, website, portals and customer responses?
  • Does the mapping register identify exact, transformed, partial and no-match relationships?
  • Have operational data owners and destination-specific reviewers approved the answer?
  • Are feedback, changed definitions and expired evidence fed back into the core registers?

In practice

Related standards and next steps

Relationship Reference Practical use
Direct GRI 1, GRI 2, GRI 3 and applicable Topic Standards Source disclosures, reporting principles, governance, material topics and metrics.
Comparison EcoVadis Ratings methodology Policies, Actions, Results, management indicators and supporting documents.
Comparison S&P Global CSA 2026 methodology and industry handbook Industry-specific questions, criteria, weights and scoring logic.
Comparison CDP Full Corporate Questionnaire and 2026 guidance Environmental modules, pathways, scoring and evidence.
Implementation GRI source register and data request Create the underlying data, evidence and owner model.
Next step Questionnaire consistency review Test one metric or policy across all current destinations.
Advanced Controls for ESG ratings and procurement claims Govern public/private evidence, sign-off and change management.

A sustainability data mapping register is a controlled record that links a destination’s question and definition to the governed source fact, any transformation, the residual gap and the reviewer. It shows whether reuse is exact, transformed, partial or unavailable while preserving the assessed entity, period, boundary, unit, evidence and approval trail.

Questions

Questions people ask

Can a GRI report be used for EcoVadis?

GRI data can provide a strong foundation for EcoVadis, S&P Global CSA, CDP and customer questionnaires, but a GRI report is not a universal answer bank. The destinations use different assessed entities, periods, boundaries, definitions, evidence rules, materiality lenses, formats and scoring logic.

Does GRI map to CDP?

GRI data can provide a strong foundation for EcoVadis, S&P Global CSA, CDP and customer questionnaires, but a GRI report is not a universal answer bank. The destinations use different assessed entities, periods, boundaries, definitions, evidence rules, materiality lenses, formats and scoring logic.

Can GRI data answer S&P CSA?

GRI data can provide a strong foundation for EcoVadis, S&P Global CSA, CDP and customer questionnaires, but a GRI report is not a universal answer bank. The destinations use different assessed entities, periods, boundaries, definitions, evidence rules, materiality lenses, formats and scoring logic.

What is a sustainability data mapping register?

A sustainability data mapping register is a controlled record that links a destination’s question and definition to the governed source fact, any transformation, the residual gap and the reviewer. It shows whether reuse is exact, transformed, partial or unavailable while preserving the assessed entity, period, boundary, unit, evidence and approval trail.

How should customer questionnaires be controlled?

The defensible model is to govern the underlying facts once — through a data dictionary, evidence register and approval trail — and then convert those facts through destination-specific mappings. Every reused answer should retain its source, calculation, scope, limitation and reviewer.

Take it with you

The checklists as a working spreadsheet

Every checklist and table on this page, with empty status, owner and evidence columns for your team to fill in and keep.

Download .xlsx

✓ LRA AI Assistant · Human-in-the-loop

Ask about this guide

It answers from this page, and reaches into the linked disclosure cards when your question is about the standard itself. Your first two answers are free without signing in.

Try
2 free answers Automated · the LRA team is one click away

Go deeper · GRI

GRI Standards Certified Training

A full reporting cycle with a mentor: impact inventory, threshold, Topic Standard selection, Content Index and assurance readiness.

Available as Guided Flex, Live Cohort, 1:1 Expert Mentorship or Corporate Programme.

See course formats
/en/knowledge-hub/disclosure-guides/gri/gri-alongside-esrs-and-ifrs-s1-s2/using-gri-data-for-ecovadis-s-p-csa-cdp-and-customer-questionnaires/