Regulatory requirements intensify with EU's CSRD

Organizations have been preparing for CSRD

One advantage companies have is that many have been preparing for the regulatory regime, said analyst Nitish Mittal, a partner at Everest Group.

CSRD regulation is built on existing regulations, including the NFRD, which means changes for organizations are incremental.

"One of the big concerns that companies have is whether this adds to their regulatory and compliance burden versus reducing it," Mittal said. "It builds on top of existing ESG regulations, which is a good thing."

There are three ways that CSRD expands on previous ESG regulations, he said. First, CSRD requires companies to report on a broader range of metrics, including water resources and biological diversity for the environmental portion, as well as more metrics around gender diversity, workforce diversity and working conditions for the social portion. Second, it focuses on mandates for assuring the reliability of reporting through third-party auditing. Third, it addresses the issue of double materiality, where a company's activities are material both in terms of finances and environmental impact.

You need to ask you suppliers or vendors more questions around their own sustainability reporting, so [CSRD] expands the metrics.

"For example, when looking at the various scopes for emissions, CSRD requires you to follow the money and not just talk about your own emissions, but what you are funding as well," he said. "You need to ask your suppliers or vendors more questions around their own sustainability reporting, so it expands the metrics."

A boardroom discussion in the EU, US

CSRD and its regulatory predecessors such as NFRD have been a discussion in the boardroom and for the C-suite because corporate leaders are being held accountable, said Faith Taylor, global sustainability and ESG officer at Kyndryl, a global cloud infrastructure and services firm.

It's more front and center for European companies, but global companies that do business in Europe will also need to begin reporting on CSRD, Taylor said. They also need to pay attention to regulations from entities including the U.S. Securities and Exchange Commission and state governments like California, as well as the Financial Stability Board's Task Force on Climate-related Financial Disclosures, a global framework for assessing sustainability-related financial risks.

"That's also used in the CSRD as a way for investors and governments to be able to manage and show that they have not only goals, but a plan [for ESG mitigation]," she said. "When companies are looking at how to manage this, they have to look at the global landscape of regulations."

The main concern for companies is that they need third-party validation around their sustainability claims, Taylor explained.

"Going through that process of even getting what's called 'limited assurance' is very time consuming, and you must have the documentation and clearly outline your assumptions," she said. "You must have the backup for your renewable energy claims. Companies have to develop systems and processes to do this and to understand what they're reporting."

These requirements make ESG-related reporting akin to financial reporting. Companies are now starting to integrate ESG into audits and processes within accounting and finance departments, Taylor said.

Tracking metrics is somewhat easier for carbon emissions accounting, as companies can tally utility bills. But companies are still grappling with how to assess social and corporate governance portions of ESG.

"The question is around the social and governance metrics, and you'll see more rigor around that," she said. "In order to know what you should report on, there's a materiality process that companies are now focused on because you can't report on 82 things, you need to say what's material for your company."

Staggered compliance helps SMBs

CSRD requirements are staggered by organizational size to avoid adding financial burdens to SMBs, Mittal said.

"One of the concerns is that in Europe especially -- but globally also -- because there are a lot of small and medium[-sized] businesses, they didn't want that to become like another impact, given the economy right now," he said.

Those companies will be subject to CSRD but haven't thought about it the way larger organizations have, or they've focused on only a small subset of reporting and will need to organize and prepare to take the next step pretty quickly, said Craig Wentworth, principal analyst at TechMarketView.

However, companies that have already devoted time and energy to deliver against wide-ranging UN sustainability goals -- beyond vague statements in annual reports -- or are experienced in bidding for contracts where there is a 'social value' component to the work will be at an advantage, Wentworth said.

"Those businesses that have been slow to embrace wider sustainability concerns without the presence of a regulatory stick will feel most acutely affected in the short term," he said.

While CSRD affects organizations regardless of their industry, some will take things more seriously and sooner than others, Wentworth said.

Organizations or business units with emission-heavy operations such as manufacturing, transportation or construction will have to prepare more immediately because they tend to have a higher burden in complying with Scope 1 emissions reporting requirements, he said. Those with longer or more complex supply chains will have more extensive Scope 3 obligations.

"The other components around the treatment of employees -- respect for human rights, anti-corruption and bribery or diversity -- will affect every type of organization," Wentworth said.

A concern for the whole organization

Every business unit within an organization will need to pay attention to CSRD, but there are roles that will have more responsibility than others, Mittal said.

Most Fortune 1000 organizations now have a chief sustainability officer, who acts as the custodian of CSRD reporting efforts, he said. CFOs will need to be heavily involved because they sign off on the financial materiality in CSRD, as will chief procurement officers because of Scope 3 reporting requirements across internal and external functions.

IT will also need to be involved in CSRD, both for reporting on internal metrics such as the number of devices in an organization and their cloud usage, as well as enabling the systems that report and manage external metrics.

"A lot of this starts with reporting and data collection that IT officers are responsible for," Mittal said. "They're like the bedrock of how you do this, because if the quality of your systems and reporting is not great, you won't be able to move the needle forward, given the number of metrics you need to track now."

Jim O'Donnell is a TechTarget senior news writer who covers ERP and other enterprise applications for TechTarget Editorial.