An ESG framework is a written method for deciding what your company measures on environmental, social and governance topics, who owns each number, and how you publish it. It turns broad sustainability promises into a short list of figures an auditor can check.
That sounds bureaucratic until you see what happens without one. Teams collect energy data in spreadsheets, procurement keeps supplier records somewhere else, and when an investor or a bank asks for emissions figures, nobody can say where the numbers came from. A framework fixes the ownership and the method before the question arrives.
This guide is for people who have to deliver that work: finance leads, operations managers, founders and sustainability teams inside normal companies, not specialists at a Fortune 100 reporting department. It covers what a framework is, which rules actually apply in 2026, how the main standards differ, and what to build first.
One thing changed the picture this year: the rules got narrower in Europe and shakier in the United States, while investor demand for comparable numbers did not move.
Key Takeaways
- A framework tells you what to measure and how to report it; a standard defines the exact metrics.
- Europe cut CSRD scope sharply in 2026, so many companies that were preparing to report no longer have to.
- US federal climate rules are stalled, but California and EU customer requirements still reach American firms.
- ISSB (IFRS S1 and S2) is becoming the global baseline; GRI covers impact; SASB covers industry metrics.
- Materiality is the filter that keeps reporting to a few topics that matter instead of hundreds.
- Auditable data beats a longer report: one dataset, named owners, documented methods.
What an ESG framework actually is
ESG stands for environmental, social and governance: the three buckets investors and regulators use to group non-financial topics. Environmental covers emissions, energy, water and waste. Social covers employees, safety, human rights and communities. Governance covers board oversight, ethics and how decisions get made.
An ESG framework is the structure you put around those buckets. It answers four questions: which topics matter for your business, which numbers prove progress on them, who inside the company produces each number, and how often you publish.
Framework or standard? The difference matters
People use the two words interchangeably, which causes real confusion when you are choosing tools.
A framework gives you the shape: what topics to cover, how to set boundaries, how to organize the story. The recommendations of the Task Force on Climate-related Financial Disclosures (TCFD) worked this way, splitting climate reporting into governance, strategy, risk management, and metrics and targets.
A standard gives you the rules: exact definitions, calculation methods, and required disclosures. IFRS S2 and the European Sustainability Reporting Standards (ESRS) work this way. Because a standard pins down the method, two companies applying it can be compared.
In practice most companies use both. Start with a framework to organize the program, then adopt a standard when you need numbers that survive an audit or a regulator.
Why anyone bothers
Four reasons, in descending order of how often they actually drive the decision:
- Someone demands it. A regulator, a large customer, a lender, or an investor asks for specific data, and you cannot win or keep the business without it. This is the practical reason corporate responsibility shifted from pledges to proof.
- It reduces risk. Energy exposure, supplier failures, safety incidents and governance gaps are business risks first and reporting topics second. Measuring them makes them manageable. Our guide to building a practical risk management framework covers how the two connect.
- It saves money. Energy, waste and transport reduction programs usually pay for themselves, which is why carbon reduction roadmaps tend to start with the utility bill.
- Customers check. Buyers increasingly test claims against evidence, and what consumers actually reward now depends on whether a claim can be backed up.
Materiality: the filter that keeps reporting sane
Materiality is the process of deciding which topics belong in your report. Without it, teams try to cover everything, produce a hundred-page document nobody reads, and still miss the number the investor wanted.
Financial materiality and impact materiality
Two lenses, and they point in opposite directions.
Financial materiality asks how a sustainability topic affects your company. A drought that halts a supplier, a carbon price that raises input costs, a safety failure that triggers a lawsuit. This is what investors and the ISSB care about.
Impact materiality asks how your company affects people and the environment. Emissions you release, working conditions in your supply chain, water you draw from a stressed basin. This is what GRI and most stakeholders care about.
Double materiality means applying both. The EU requires it. Most voluntary reporters use it anyway, because the two lists overlap more than people expect: a labor problem in your supply chain is both a harm and a business risk.
How to run an assessment without hiring consultants
A workable version takes a few weeks:
- List candidate topics. Start from a sector standard rather than a blank page. SASB’s industry standards and GRI’s sector standards both give you a starting list.
- Ask the people who would know. Short interviews with procurement, HR, operations, your biggest customers and one or two investors will surface more than a survey.
- Score each topic twice. Once for financial impact, once for impact on people and environment. Use a simple scale and write down why you gave each score.
- Cut the list. Most companies land on five to twelve topics. Anything below the line still gets monitored, just not reported in detail.
- Assign an owner to each surviving topic. A topic with no named owner will not produce reliable data.
- Revisit annually. Rules and risks move. So does your business.
An online retailer, for example, usually lands on packaging waste, delivery emissions, supplier labor conditions and data privacy. A software company lands somewhere very different: cloud energy use, hiring practices, and the governance of its AI features. Sector shapes the list more than size does.
What actually changed in 2026
This is the part that moved most since the last version of this guide, so it is worth being precise.
Europe: CSRD is much narrower now
The EU’s Omnibus I amendment was published on 26 February 2026 and entered into force on 18 March 2026. It cut the Corporate Sustainability Reporting Directive (CSRD) back hard.
Under the revised rules, mandatory reporting applies to large undertakings with more than 1,000 employees and net annual turnover above EUR 450 million. Listed small and medium-sized companies are now fully exempt. Limited assurance stays mandatory, with an assurance standard due no later than 1 July 2027 (Accountancy Europe).
The reporting standards themselves were rewritten. On 3 July 2026 the European Commission adopted revised ESRS that cut mandatory datapoints by more than 60% and total datapoints by more than 70%, which the Commission expects to lower reporting costs by over 30% per company. The revised standards are expected to apply from financial year 2027.
The related due diligence law, CSDDD, was pushed back and narrowed too: it now targets companies with 5,000 or more employees and EUR 1.5 billion turnover, applies from 26 July 2029, caps penalties at 3% of net worldwide turnover, and no longer obliges companies to adopt a climate transition plan.
What this means in practice: if you were told two years ago that CSRD would catch you, check again. Many mid-sized firms are now out of direct scope. They are not out of the conversation, because in-scope customers still ask suppliers for the data they need.
United States: the federal rule is on hold
The Securities and Exchange Commission adopted climate disclosure rules in March 2024, then stayed them on 4 April 2024 while consolidated litigation ran in the Eighth Circuit. On 29 May 2026 the SEC proposed rescinding the rules entirely.
So there is currently no federal climate reporting mandate in force for US public companies. That does not make the topic optional. Investors still ask, lenders still ask, and two other sources of obligation remain: EU customers passing requirements down their supply chain, and California.
California: the deadlines that are real
California’s rules reach any company doing business in the state above a revenue threshold, measured on total global revenue.
SB 253 requires Scope 1 and Scope 2 greenhouse gas reporting from companies with annual revenue above USD 1 billion. The California Air Resources Board moved the first reporting deadline to 10 November 2026. Scope 3 is not required for the 2026 reporting year; a limited five-category approach is proposed to start in 2027.
SB 261 requires a climate risk report from companies with revenue above USD 500 million. Its statutory deadline of 1 January 2026 is not being enforced: a preliminary injunction paused it, and CARB has said it will announce an alternate date once the appeal resolves.
If your revenue clears either line and you sell in California, this is the deadline to plan around, not the SEC.
The main standards, in plain terms
Four names cover most of what you will be asked about. They are complements, not competitors.
ISSB: IFRS S1 and S2, the emerging global baseline
The International Sustainability Standards Board sits under the IFRS Foundation, the body behind international accounting standards. It publishes two standards: IFRS S1 for general sustainability-related financial disclosures and IFRS S2 for climate.
Both are built for investors, which means they focus on financial materiality and use the same four-part structure TCFD introduced.
Adoption is spreading rather than complete. S&P Global reported that as of 1 January 2026, 21 jurisdictions had adopted the standards on a voluntary or mandatory basis, with reporting starting between January 2024 and January 2026, and a further 16 planned to follow. Chile, Qatar and Mexico began mandatory application at the start of 2026, and the UK has proposed rules taking effect from 1 January 2027.
GRI: the impact standard
The Global Reporting Initiative is the oldest of the group and the one built around impact rather than enterprise value. Its Universal Standards (GRI 1, 2 and 3) have applied since 2023 and set the expectations for materiality and stakeholder engagement.
GRI also publishes sector standards. GRI 14 for mining applies to reporting periods beginning on or after 1 January 2026. GRI and the IFRS Foundation continue to work on alignment so companies can use one dataset for both impact and investor reporting.
Use GRI when your audience includes employees, communities, NGOs or customers who want to know what your operations do to the world, not just what the world does to your balance sheet.
SASB: industry-specific metrics
SASB standards cover 77 industries and pick out the handful of topics that tend to be financially material in each one. They are now maintained under the IFRS Foundation and feed directly into IFRS S1.
Their practical value is the shortcut: instead of inventing metrics, you open the standard for your industry and find the ones investors in your sector already ask about.
TCFD: retired, but the structure survived
This one trips people up. The Task Force on Climate-related Financial Disclosures disbanded in October 2023, and the IFRS Foundation took over monitoring from 2024.
You will still see TCFD named in contracts, tenders and investor questionnaires. That is usually shorthand for its four-part structure: governance, strategy, risk management, and metrics and targets. IFRS S2 keeps that structure, so reporting against IFRS S2 satisfies a TCFD-shaped request.
CDP, GRESB and the sustainability indices
These are assessments rather than standards. You fill in a questionnaire, someone scores it, and the score circulates among investors and customers.
CDP runs climate, water and forests questionnaires. More than 22,000 companies disclosed through CDP in 2025, including over 4,400 first-time disclosers, plus nearly 11,000 smaller companies using a dedicated SME questionnaire. The 2026 scoring deadline is 16 September 2026, with responses accepted without a score into late October.
GRESB benchmarks real estate and infrastructure assets for investors in those sectors. If you manage real assets, your investors probably already participate.
Sustainability indices, including the Dow Jones Sustainability Indices, rank listed companies using their own assessments. Inclusion influences perception more than it changes operations, but for public companies it is worth tracking.
A word of caution on all three: they are data-hungry. Do not commit to a questionnaire before you can answer it from records you already keep.
Which metrics to build first
Start narrow. A short set of numbers you can defend beats a long set you cannot.
Environmental. Greenhouse gas emissions across Scope 1 (what you burn directly), Scope 2 (the electricity you buy) and Scope 3 (everything else in your value chain). Then energy consumption, water use and waste. Scope 1 and 2 are achievable in a quarter for most companies. Scope 3 is genuinely hard and usually arrives later, one relevant category at a time, and it is where work on greener supply chains, supply chain resilience and circular economy models starts to show up in the numbers. Purpose-built carbon accounting software exists specifically because doing this in spreadsheets breaks down fast.
Social. Headcount and turnover, health and safety incidents, training hours, pay and workforce composition where you are permitted to collect it, and supplier labor standards. Programs on workplace inclusion produce most of this data already.
Governance. Board oversight of sustainability topics, ethics and whistleblowing cases, and how you handle data and AI. A documented business ethics framework and a working privacy compliance framework both generate governance evidence you can report.
For each metric, write down three things before you collect anything: the boundary (which entities and sites are included), the method (how it is calculated, and with which emission factors), and the owner. Those three lines are what turns a number into evidence.
Data, controls and software
Most ESG reporting fails on plumbing, not ambition. The numbers live in utility portals, ERP records, procurement systems, HR software and a dozen spreadsheets. Nobody can reproduce last year’s figure, so nothing can be assured.
What auditable actually requires
Assurance providers ask the same questions an auditor asks about financial data. Where did this number come from? Who entered it? What changed since last year and why? Can you show the calculation?
Spreadsheets struggle here because they have no change history and no access controls. That is the practical argument for dedicated tooling, not the marketing one.
What the software does
ESG platforms pull readings from meters and systems automatically, apply published emission factors from sources such as the EPA, DEFRA and the IEA, and keep an audit trail of every change. Good ones let you map one dataset to several reporting formats. Our overview of ESG reporting in SaaS covers how that market is developing.
The prerequisite is boring and unavoidable: someone has to own the data. A data governance strategy that names owners and defines quality rules will do more for your report than any tool, and a basic data literacy program stops the numbers being misread once they exist. The same logic drives regtech tooling in adjacent compliance areas.
Report once, disclose many times
If you face more than one reporting demand, build a crosswalk: a single table mapping each data point you collect to every place it needs to appear.
The idea is simple. Collect once, in one definition, then publish into GRI, IFRS S1 and S2, CDP, a customer questionnaire and your annual report without recollecting anything.
To make that work:
- Harmonize definitions first. If “employee” means three different things in three systems, no mapping will save you.
- Reuse narrative, not just numbers. Governance descriptions, risk registers and scenario analysis can usually be edited rather than rewritten for each audience.
- Use the official interoperability guidance. EFRAG and the IFRS Foundation published mapping between ESRS and the ISSB standards; GRI and the IFRS Foundation have their own alignment work.
- Keep a calendar. CDP, annual reports and regulatory filings have different deadlines. Sequence them so one dataset closes before the season starts.
Where this is heading
Two trends are worth planning around.
Consolidation. The alphabet soup is thinning. SASB moved under the IFRS Foundation, TCFD closed, and ESRS and ISSB now publish interoperability mapping. Fewer, better-aligned standards is the direction of travel, even while the political appetite for mandates swings.
Automation. AI tools are moving into the tedious parts of this work: validating data, flagging outliers, drafting narrative from structured inputs, and mapping one dataset to several formats. That helps with cost, but it adds a governance question of its own, since models used on employee or customer data fall under rules such as the EU AI Act. Treat an AI assistant as another system that needs owners and controls, not as a shortcut past them.
Capital is following the same logic. Investment in climate tech and the products grouped under green finance both depend on measurable results rather than intentions.
The steady part underneath every trend is unchanged: investors, lenders and large customers want comparable numbers they can trust. That demand has survived every swing in regulation so far.
Getting started this quarter
If you are starting from nothing, this order works:
- Find out who is actually asking, and for what. One real request beats a generic framework choice.
- Run a short materiality assessment and cut to a handful of topics.
- Pick your primary standard based on that audience: ISSB for investors, GRI for impact, ESRS if the EU rules reach you.
- Build Scope 1 and 2 emissions properly, with boundaries, methods and owners written down.
- Publish something modest and accurate, then extend it next year.
A short report you can defend line by line is worth more than a glossy one you cannot. The same principle runs through a wider sustainability strategy, and it needs leaders who are judged on decisions rather than statements to stick.
Found this useful?
Make SmartKeys a preferred source on Google, and our articles will surface more often in your Top Stories, AI Overviews, and AI Mode.
Add as Preferred Source
