How to Build a Report on Sustainability for Audit

A sustainability report is a structured disclosure detailing an organisation's environmental, social, and governance (ESG) performance, supported by verifiable evidence. It functions as a working document for regulators, customers, financiers, and internal decision-makers, rather than a marketing brochure. Its purpose is to provide a transparent, evidence-based account of operations and their impacts.

What a Report on Sustainability Actually Covers in 2026

A practical report on sustainability groups disclosures into core areas that map directly to operational controls and audit evidence. This structure reflects how modern organizations are managed, with an emphasis on systems, processes, and accountability.

The scope of mandatory reporting has expanded significantly. The Corporate Sustainability Reporting Directive (CSRD) increased the number of companies in scope to approximately 50,000, from around 11,000 under previous NFRD rules. The first large filers submitted their FY2024 reports in 2025, and the operational requirements continue to propagate through supply chains.

For compliance and risk teams, this means reports are now outputs of governed systems, not one-off documents assembled after the reporting period. Every disclosed metric must be traceable to source systems and supported by controlled evidence.

Key Audiences and Their Requirements

Different stakeholders use the same report to answer distinct questions, but their underlying need for credible data is the same.

• Regulators require traceable metrics and governance statements that correspond to implemented controls, not just aspirations.
• Customers need consistent supplier data for their procurement and due diligence processes, without requiring manual clarification.
• Financial institutions use comparable indicators to assess risk, inform investment decisions, and comply with their own disclosure obligations.
• Internal decision-makers rely on this same verified dataset for strategic planning, capital allocation, and risk management.

The primary test of a sustainability report is its auditability: can an independent party trace any published value back to its source transaction, measurement, or document through a clear, unbroken chain of evidence?

Core Disclosure Areas in a Report on Sustainability

This structure provides a clear mental model, linking each disclosure topic to the specific artifact an auditor will request and the business function responsible for maintaining it.

Why the Format Has Shifted

Operationalizing the reporting process reduces friction between data owners and assurance providers. For example, emissions data is increasingly sourced from system APIs or automated data exports rather than manually populated spreadsheets. Separating the published report from the underlying evidence pack prevents the common control failure of creating a narrative first and attempting to find supporting data later.

Practical Consequences for Teams

1. Assign Ownership: Each disclosure area requires a designated owner with explicit responsibility for evidence integrity and sign-off.
2. Version and Timestamp Evidence: All evidence must be version-controlled and time-stamped to provide a clear audit trail of when data was captured and approved.
3. Prioritize Governed Indicators: Focus on a concise set of well-governed indicators with clear data lineage over an extensive list that lacks robust evidentiary support.

Why Regulators, Customers, and Auditors Converge on Evidence

Sustainability reporting operates at the intersection of regulation, procurement, and assurance. This convergence is driven by practical necessity. Regulators define minimum disclosure requirements. Customers require comparable data for their own compliance. Auditors validate the controls that produce the reported values. Understanding this alignment helps teams prioritize work that will withstand scrutiny from all stakeholders.

The EU's CSRD and Taxonomy Regulation establish a baseline for which metrics and disclosures are material. In response, financial firms subject to the Sustainable Finance Disclosure Regulation (SFDR) require consistent, machine-readable data from their portfolio companies. Consequently, organizations responding to customer questionnaires are often asked for the same underlying evidence that auditors request for an assurance engagement.

Consider a mid-sized industrial supplier. While it may not be required to publish a formal report, it regularly receives due-diligence requests from larger customers. These customers need verifiable measurements, not narrative summaries. This commercial pressure compels the supplier to maintain versioned policies, auditable measurement records, and clear role assignments, effectively mirroring the practices of a regulated filer.

Evidence as the Common Currency

Auditors approach sustainability assurance as a verification of systems and controls. The central principle is reproducibility. An independent reviewer must be able to follow the data lineage from a published metric back to its source. This requires three foundational elements.

• Versioned documents and policies with timestamps that clarify their period of applicability.
• Traceable data exports or system logs linked to the specific control that produced them.
• Explicit ownership and approval records tied to defined roles, not just individuals.

High-quality evidence consistently outweighs a persuasive narrative during an assurance engagement. This reality shifts the work from storytelling to engineering for traceability. Responsibility is embedded within operational teams: Facilities owns energy and emissions data, HR owns workforce metrics, and Procurement owns supplier conduct evidence. Accountability resides where the data is generated and controlled.

Practical Implications for Internal Controls

Controls must be designed for verifiability, enabling an auditor to sample transactions and reproduce a finding. This means a control is a repeatable process that generates an auditable log, not just a checklist item. Automation can reduce manual error in control execution, but it does not replace the need for human accountability and oversight.

To design practical, auditable controls:

1. Map each disclosed metric to a specific source system and a named owner.
2. Define the control procedure that transforms source records into the reported value.
3. Maintain an evidence pack containing the source data extract, the calculation worksheet, and the approval log for each metric.

The stringent requirements for data security in sectors like healthcare provide a useful model. As detailed in guidance on healthcare data safeguards, the same principles of protecting data, documenting access, and proving control effectiveness support both compliance and audit readiness.

Ultimately, regulators, customers, and auditors seek the same outcome: credible, traceable, and accountable reporting. By focusing on evidence quality—through versioning, clear ownership, and reproducible controls—teams can transform sustainability reporting from a periodic, high-stress exercise into a disciplined and auditable operational process.

The Standard Structure Of A Sustainability Report

A credible report on sustainability follows a predictable structure. This consistency is intentional, as it allows auditors, regulators, and other stakeholders to navigate directly to the information they need, reducing friction and improving efficiency for all parties.

The layout mirrors an operational logic: governance establishes the framework, operations generate measurements, and annexes provide the supporting proof. Understanding this logic simplifies the design of internal controls that align directly with reporting outputs.

Governance and Materiality Assessment

The report begins with governance because it defines the context for all subsequent disclosures: who is accountable, how decisions are made, and what the escalation paths are. The materiality assessment then explains the process for determining which topics are included in the report, providing a decision-making trail that auditors expect to see.

Auditors will sample board minutes, responsibility matrices, and the materiality assessment documentation itself to verify that the scope was determined through a deliberate and documented process.

Climate and Environmental Metrics

Climate-related data is derived from tangible sources, such as utility meters, invoices, and cloud provider dashboards. The primary control challenge is to convert these raw inputs into standardized units (e.g., tCO2e) and to document every assumption and conversion factor used in the process.

Auditors will test this by examining metering logs, calculation worksheets, and data source configurations to verify the chain of custody for the data. The lineage of evidence for emissions and energy data is more important to an auditor than the narrative surrounding it. They focus on how a number was derived, not just the final value.

Social and Workforce Disclosures

Workforce data typically resides in HR information systems. The key control considerations involve ensuring data privacy, proper aggregation to protect anonymity, and adherence to correct reporting period cutoffs.

Practical audit tests include reconciling figures between payroll, HR, and incident tracking systems. Auditors sample anonymized data extracts, training completion logs, and versioned HR policies to verify reported claims.

Business Conduct and Human Rights

These disclosures relate to third-party risk management, including supplier due diligence, contractual obligations, and grievance mechanisms. The controls must demonstrate how supplier risks are assessed, monitored, and—crucially—how identified issues are remediated.

Auditors examine evidence such as completed supplier questionnaires, on-site audit reports, and records demonstrating that corrective action plans for identified issues were completed.

Management Report Annexes and Evidence Pack

This is a critical area where reporting processes often fail. The published report provides the summary and narrative. The evidence pack is the controlled, auditable repository that substantiates every claim made in the report.

A common mistake is to write the report first and then search for evidence. The correct process is to assemble the report from evidence that has been systematically collected and verified throughout the reporting period.

To build an audit-ready evidence pack:

1. Link every reported metric to its source data extract and the control procedure that produced it.
2. Include calculation worksheets detailing all inputs, assumptions, and reviewer sign-offs.
3. Maintain an index that maps reported values to specific files, timestamps, and data hashes, allowing auditors to reproduce samples without relying on institutional memory.

For Scope 1 emissions, for example, the pack should contain fuel invoices, meter exports, and the documentation for the conversion factors applied. For supplier conduct, it should include the original questionnaire, the supplier's response, and the internal procurement approval record. These linkages enable an auditor to independently verify a reported value. Building a robust impact assessment process is foundational to this. Read also: B Impact Assessment

The guiding principle is to design the report as an output of controlled processes, not as a standalone document created under deadline. When ownership is clear, versioning is disciplined, and evidence is indexed, assurance becomes a straightforward verification of systems that are already in place.

Collecting Evidence That Survives an Assurance Review

Evidence collection is the process that determines the credibility of a report on sustainability. Auditors do not accept claims at face value; they require a reproducible trail connecting every published metric to its source system and the associated controls. This necessitates designing data collection processes that preserve data lineage from the outset.

Who Owns Evidence and Why Ownership Matters

Without clear ownership, evidence becomes "orphaned," and data integrity issues often surface late in the audit cycle. For each disclosed metric, assign two distinct roles: a system owner and a control owner. The system owner is responsible for providing source data extracts. The control owner is responsible for validating any transformations and providing final sign-off.

This separation of duties establishes clear accountability and provides auditors with a clean trail for sampling.

• Scope 1 emissions — System owner: Facilities Manager | Control owner: Sustainability Lead
• Workforce training — System owner: HRIS Administrator | Control owner: HR Compliance Manager

Clear ownership produces traceable accountability, which is essential when auditors request reproductions of reported figures.

How Evidence Should Flow Into a Controlled Repository

Design data pipelines so that source extracts are ingested into a versioned, access-controlled repository with essential metadata: data source, timestamp, extract hash, and the identity of the uploader. Using immutable or write-once storage prevents unauthorized or silent edits after ingestion. Versioning provides a clear history of when data was collected or corrected and by whom.

When compiling evidence packs for assurance, include both the source data extract and the associated control artifacts, such as calculation worksheets and approval records.

Access Governance and Upload Rules

Implement role-based access controls to govern who can contribute and approve evidence. Contributors should be able to submit candidate evidence, while designated approvers are responsible for finalizing and locking entries. For third parties like suppliers, establish a secure upload portal that captures necessary metadata without requiring full system accounts.

• Contributors attach files with commentary explaining the context.
• Approvers review, and their decision (accept or reject) and rationale are logged.
• All deletions are "soft," meaning prior versions remain available for audit.

Why Immutability and Traceability Are Non-Negotiable

Immutability ensures that an auditor can test a sample using the exact data that was available at the time of reporting. Traceability connects a reported number to a specific data extract and calculation. Without both, the verification of findings depends on individual memory and is subject to dispute.

An effective evidence pack should include the source extract, the calculation steps and assumptions, approval logs, and links to the governing policy.

Policy-to-Control Linking and Third-Party Flows

Connect policies to controls within your GRC system to allow an auditor to follow the governance thread from a board-level directive down to its operational execution. For supplier evidence, use time-bound data requests that allow vendors to upload supporting documents securely. Each uploaded artifact should be indexed and tied to the supplier record and the relevant procurement control.

A useful practice is to include a simple checklist with each evidence request so suppliers understand the required format. To ensure your sustainability data withstands assurance, a solid metrics governance framework is essential. See how to align your team with trusted KPIs for guidance.

Read more about environmental, social, and governance practices in the AuditReady ESG Guide.

Why Sustainability Has Become a Data-Quality Discipline

Sustainability reporting now intersects with procurement, operations, HR, and facilities, making it as much a data management challenge as an environmental or social one. Auditors and regulators no longer accept unsubstantiated statements. This shift transforms reporting into a discipline focused on versioned records, clear ownership, and immutable logs.

Data Quality Versus Data Quantity

A high volume of metrics is not a substitute for high-quality, verifiable data. An extensive spreadsheet of indicators is of little value if no one can demonstrate the origin of a single figure. Conversely, a small set of well-governed indicators with clear data lineage will withstand scrutiny and provide a reliable basis for decision-making.

• Focus on a limited set of indicators that map directly to operational controls.
• Require a source extract, a calculation worksheet, and an approver for each metric.
• Maintain timestamps and data hashes so an auditor can reproduce any sample.

High-quality evidence is the currency of credible sustainability reporting. This is why organizations must treat disclosures as engineering artifacts rather than marketing copy.

Practical Controls That Produce Traceability

Begin with establishing clear ownership and separation of duties. Assign a system owner to provide source extracts and a control owner to validate transformations. Use role-based access controls and approval workflows to ensure only authorized personnel can finalize evidence.

1. Map each reported metric to a named owner and a source system.
2. Define the control that transforms source records into the published value.
3. Store all evidence and associated artifacts in a versioned, immutable repository with complete metadata.

These steps create reproducible outputs, replacing one-off figures assembled from memory.

Handling Third-Party Evidence

Supply chain data is often the weakest link in the evidence chain. To strengthen it, require suppliers to submit time-bound artifacts that adhere to a clear checklist of acceptable formats. Where direct system access is impractical, use secure upload tokens and index every submission against the relevant procurement control.

• Request specific documents like invoices, attestations, or questionnaire exports.
• Record the uploader's identity and a timestamp with each file.
• Link each file to the procurement control that it supports.

AI as a System Component

AI systems can be used as components in the evidence pipeline to help normalize data from disparate sources or flag anomalies for review. However, human accountability remains paramount. Any AI-assisted transformation must be approved by a human owner, and this action must be recorded in the audit trail. This approach preserves accountability while leveraging technology to improve efficiency.

The Governance Habit

Ultimately, sound governance practices are the foundation of a credible report on sustainability. Versioned policies, clear ownership, robust access governance, and immutable logs transform reporting from a reactive, deadline-driven scramble into a verifiable, repeatable process. This operational discipline is what regulators, customers, and auditors now expect.

A Practical Checklist For Building The Report Throughout The Year

Scoping and Materiality

The scoping and materiality assessment should be conducted early in the fiscal year. Assign a named owner for the process and maintain a log that documents stakeholder inputs, scoring rationale, and the final scope decisions. For example, document why specific Scope 3 emissions categories were included or excluded and who signed off on that decision. This creates a verifiable trail and prevents scope creep.

Data Source Mapping

Every disclosed metric requires a clear lineage to a source system and a control owner. Develop a source map that lists the system, export method, responsible person, and collection cadence for each metric. When an auditor samples a metric, this map should allow them to reproduce it from the specified source without ambiguity.

Evidence Collection Cadence

Establish a collection calendar with defined monthly, quarterly, and annual tasks. Evidence should be attached to controls as it is generated, not retroactively during report assembly.

1. Monthly: Capture operational logs and meter readings.
2. Quarterly: Reconcile source extracts with aggregated values.
3. Annual: Finalize approvals and sign-offs from all control owners.

Maintain an approval log with timestamps and reviewer comments for every artifact, showing who validated it and when.

Mid-Year Gap Review

Conduct a mid-year review to validate data coverage and identify any missing evidence. Produce a gap report that assigns owners, remediation steps, and target dates for any identified issues. A practical tip is to perform a small sample test with your assurance provider mid-year to check data lineage before year-end pressures mount.

Draft Assembly

Assemble the draft report directly from the evidence pack, not from memory or previous reports. Create an index that maps each figure and claim to the specific file name, extract timestamp, and control record in the evidence repository. Include calculation worksheets with inputs and assumptions, and link reviewer annotations to specific tables or figures.

Final Assurance Preparation

Prepare an exportable assurance pack containing all source extracts, calculation worksheets, policy links, approval logs, and an index file. Produce both human-readable and machine-readable versions.

Common failure modes to avoid at this stage include:

• Missing ownership records for data, leading to unverifiable figures.
• Undocumented edits to data, causing non-reproducible samples.
• Last-minute data gathering, creating inconsistencies across the report.

Annual Cadence for a Report on Sustainability

Learn more about ESG due diligence in our article on ESG due diligence and supplier readiness.

FAQ On Building And Auditing A Sustainability Report

Q1: What is the difference between a sustainability report and a CSRD non-financial statement?

A sustainability report is a voluntary communication to stakeholders. A CSRD non-financial statement, however, is a regulated disclosure with specific content, format, and assurance requirements. This distinction is critical because it mandates a shift in process. You cannot simply publish numbers; you must map every figure back to an internal control and maintain an evidence pack sufficient for an auditor to perform their procedures. The report is the narrative; the non-financial statement is the auditable proof.

Q2: How does limited versus reasonable assurance change evidence needs?

The level of assurance directly dictates the rigor of evidence required.

Limited assurance requires the auditor to understand the control environment and perform analytical procedures to determine if the data is plausible. It asks, "Is there anything to suggest this is materially misstated?"

Reasonable assurance is a higher standard. The auditor must perform more extensive testing to conclude that the data is free from material misstatement. This requires deep, reproducible data lineage. For reasonable assurance, your evidence pack must enable an auditor to independently reperform your calculations and arrive at the same result. This typically requires a source extract with a timestamp and hash, a detailed calculation worksheet, a record of approvals by role, and a clear link from the operational control to the governing policy.

In short, limited assurance asks, "Does this make sense?" while reasonable assurance asks, "Can I prove this from scratch?"

Q3: How should small and mid-sized suppliers respond to ESG data requests?

Treat these requests as evidence-gathering exercises, not marketing opportunities. Your customer needs data they can defend to their own auditors.

A practical approach:

• Assign a single owner responsible for the response.
• Provide time-bound artifacts with clear references, not open-ended narratives.
• Supply an index that maps each piece of evidence to the specific metric requested.

If a full report is not required, provide the extracts from your evidence pack that an auditor would request. This saves time for both parties and positions your company as a reliable data provider.

Q4: How can AI help without removing human accountability?

AI systems are best used as system components within a larger, human-governed process. Use them to normalize data from different sources, flag anomalies for review, or suggest correlations between data points.

Human oversight remains central. Any transformation or analysis performed by an AI system must be recorded in the audit trail. A human owner must approve any AI-generated output before it becomes part of the official evidence record. The original source extract should always be retained alongside the processed version, ensuring full transparency of the data transformation process. Evidence, traceability, and clear ownership are what convert a report on sustainability from a narrative into an auditable system of record.

For operational evidence tooling, see AuditReady.