Insights

Positive impacts: real vs reframed

Under ESRS, a positive impact is a net-positive contribution of the company’s activities to people or the environment – for example, creating jobs in underserved areas, enabling access to medicines, or restoring habitats. Reducing the company’s own negative impact (mitigating its GHG emissions, cutting its water withdrawal, lowering its waste generation) is a different thing: it is mitigation of a negative, not a positive contribution.

A number of companies appear to conflate these two in their reports. The issue matters because the IRO classification drives which disclosures are required and how investors and other stakeholders read the report. An emission reduction dressed up as a positive impact inflates the picture of the company’s net contribution.

Reducing a negative, labeled as a positive

The clearest case is where a company lists its own emission or resource reductions as positive impacts inside a formal IRO table.

Reduction of greenhouse gases due to the implementation of measures to mitigate climate change – Positive impact. 7.5% Reduction in energy intensity in factories by 2030 compared with 2015 – Positive impact. 45.28% reduction of CO2 emissions (scopes 1 and 2) by 2030 compared to 2021 – Positive impact.

Acerinox’s materiality IRO table places own-operation emission and energy-intensity reductions under “Positive impact”, side by side with the same underlying topic (GHG emissions) correctly classified as a “Negative impact”. The mitigation and the activity it mitigates are treated as two symmetrical IROs with opposite signs.

ESG is embedded in our corporate strategy with a focus on eight priorities that have significant positive impact on our business, our stakeholders, and society at large. Sustainable development, and in particular the reduction of carbon footprint and our contribution to circularity, are part of our commitments for a sustainable and inclusive future.

Capgemini treats its own footprint-reduction commitments as “significant positive impact” for society. The sentence conflates two different IRO categories: mitigating one’s own negative impact is a valid action, but it is not a positive impact in the ESRS sense.

Continue to enforce our policy for e-vehicles over time to reduce our CO2 emissions (OO) – Actual positive impact.

F-Secure classifies an internal vehicle-fleet electrification policy as an “actual positive impact” in its own-operations category. The action is genuine, but it is reducing F-Secure’s own footprint, not creating a net-positive contribution to people or the environment.

Genuine positive impacts

At the other end, some companies identify and disclose positive impacts in the ESRS sense: net contributions to people or environment that would not happen without the company’s activity.

“Play to Win” core business strategy aims to build a healthier, more resilient world by ensuring access to healthcare for the world’s poorest people and bringing focus to addressing broader unmet needs.

Sanofi frames access to healthcare in low-income countries as a positive impact on consumers and communities (ESRS S4 and S3). This is a net-positive contribution: the company’s activity expands access that would not otherwise exist.

Positive impact on climate through forest carbon sequestration, products substituting fossil-based alternatives, and carbon stored in wood-based [products]. Actual positive impact, short, medium, and long term, own operations and joint operations.

Stora Enso identifies three genuine positive-impact mechanisms: sequestration in managed forests, substitution of fossil-based materials in customers’ value chains, and carbon storage in long-lived wood products. Each of these creates benefits outside the company’s own operations rather than reducing a negative inside them.

To create a positive impact in local communities, we have liaison officers who engage with local stakeholders [and] support initiatives that generate local employment, training, and biodiversity.

Ørsted’s S3 disclosure describes tangible community investment and local job creation around its wind farm sites. These are positive contributions to affected communities, not reductions in a negative impact.

Honorable mentions

Other cleanly-categorized positive impacts worth looking at:

• Leonardo(S3) – explicit IRO row labeled “Leonardo’s positive impacts on the welfare of local communities and production countries”.
• BBVA(S3) – community contribution disclosed in millions of euros by geography.
• HUGO BOSS(E4) – regenerative farming designed to “enhance soil health, restore habitats, and promote biodiversity”.
• Neste(E4) – stated target of “net positive impacts on biodiversity from new activities” and a nature-positive ambition.

The distinction sounds technical but matters for how a company’s net contribution is read. An action plan to reduce emissions belongs in the Actions disclosure (E1-3) as a mitigation, not in the IRO table as a positive impact. Getting the classification right keeps the materiality map honest and makes cross-company comparison meaningful.

Disclosing expenditure on action plans

ESRS expects companies to disclose the significant expenditure and resources allocated to their sustainability action plans. The relevant disclosure requirements (E1-3, E2-3, E3-3 and so on through to G1-4) all ask for monetary amounts, but companies are also permitted to use ranges or describe resources qualitatively when precise figures are not available.

In practice, environmental action plans (especially E1-3 on climate) are more likely to include monetary expenditure than social action plans. Most S1-4 and S2-4 disclosures describe programs and initiatives without any budget figures. The standards do not distinguish between environmental and social topics here: any “significant” expenditure should be disclosed.

What good looks like

The strongest disclosures break expenditure into CAPEX and OPEX, link it to specific actions, and indicate how much is already spent versus planned. Standards-setters may point to examples like these and expect others to meet the same quality over time.

Each of the actions has an associated budget (CAPEX or OPEX) that must be approved by the CEO of the corresponding factory. Based on the financial data, an estimate has been made to allocate CAPEX or OPEX to energy efficiency (€1,402,478 and €216,933 respectively) and to the other decarbonization levers (€635,600 and €27,910,939 respectively). The 2025–2030 Decarbonization Plan requires an estimated annual investment of €817,500 in CAPEX and €1,711,315 in OPEX. 95% of the CAPEX and 49% of the OPEX of the 2024 decarbonization initiatives is aligned with the Taxonomy.

Acerinox splits current and planned expenditure by CAPEX and OPEX, breaks it down by decarbonisation lever, and ties it to Taxonomy alignment percentages. This level of granularity makes it possible for a reader to assess whether the company is investing at a scale that matches its stated ambitions.

An internal carbon price of €100 has been implemented to consider carbon-intensity variations between suppliers in raw material pilot tenders. [...] OPEX increase for decarbonized sourcing considered in 2024 Strategic Plan to fund activities with suppliers. [...] We aim to define these targets by the end of the 2026 fiscal year.

Sanofi takes a different approach: their action plan table has a column for “Current and future allocated resources (CAPEX, OPEX)” but fills it primarily with team descriptions and governance structures rather than monetary figures. The only concrete number is the internal carbon price of €100 per tonne. This is an honest disclosure – the company acknowledges it does not yet have full budget figures – but it shows the gap between what the standards ask for and what many companies currently provide.

Ranges and large-scale plans

Companies are allowed to use ranges rather than exact figures. Some large companies disclose investment envelopes that run into the billions.

Planned investment of €16,000–19,000 million over 2024–2027, with above 35% focusing on low-carbon businesses.

Repsol uses a range (€16–19 billion) for its multi-year plan, then provides exact figures by business unit. This is a legitimate way to handle uncertainty while still giving the reader a sense of scale.

Social topics: the gap

Monetary expenditure disclosures are noticeably rarer for social topics. Most S1-4 (Own workforce) and S2-4 (Value chain workers) disclosures describe programs qualitatively with no budget attached. A few companies stand out.

In 2024, Hydro spent NOK 300 million in its local communities including community investments, TerPaz (local community centres), donations and sponsorships. Hydro made a provision in December 2024 of NOK 300 million to support communities along the pipeline between the Paragominas mine and Alunorte refinery in Brazil.

Norsk Hydro is one of the few companies to put a specific figure on social expenditure. NOK 600 million across community investments and a pipeline-related provision gives a concrete picture of resources committed to affected communities.

The pattern is clear: environmental action plans, particularly for climate (E1-3), are more likely to include monetary figures. Social action plans lag behind. As CSRD reporting matures, standards-setters and auditors are likely to look to the stronger examples – Acerinox’s CAPEX/OPEX breakdowns, Repsol’s range-based approach – as benchmarks for what adequate disclosure looks like.

How to deal with “current financial effects”

ESRS requires companies to disclose two distinct types of financial effects for each material environmental topic: the current financial effectsalready reflected in the reporting period’s financial statements, and the anticipated financial effects expected in the short, medium and long term. The anticipated effects can be omitted for the first three reporting years, and most companies have done exactly that. But current financial effects cannot be deferred.

This page offers examples of companies that have disclosed current financial effects, as well as those that have disclosed no such effects.

Disclosing current financial effects

A small number of companies connect specific events or expenditures in the reporting period to their sustainability-related risks and opportunities, and cross-reference the financial statements.

In 2024, financial effects arose in connection with a risk identified in the S3 Affected Communities standard (see page 304). The risk describes the negative financial effects that may arise, for example, as a result of legal proceedings. For more information, see the Notes to the Consolidated Financial Statements on page 411.

BASF identifies a specific current-period financial effect, names the ESRS topic it relates to (S3), and directs the reader to the relevant note in the consolidated financial statements. The underlying event: in May 2024 BASF Corporation agreed to a €305 million class settlement with U.S. public water systems over alleged PFAS contamination from aqueous film-forming foam products. This is the kind of connectivity between the sustainability statement and the financial statements that the standards expect.

Spanish Temporary Energy Levy: Negative impact of €-450 million in 2024, included in special items, representing direct financial cost of climate/energy policy measures. [...] Brent averaged $81/bbl in 2024, 2% below 2023, contributing to 16% reduction in Upstream earnings (€1,490 million vs €1,779 million in 2023). [...] The production margin indicator came to 6.6 USD/bbl in 2024, while it was 11.1 USD/bbl a year earlier, contributing to 47% decline in Industrial segment earnings.

Repsol quantifies several climate-transition-related effects that hit the current period: a €450 million energy levy, declining margins from the energy transition, and specific segment earnings impacts. The disclosure connects climate policy directly to reported financial performance.

The more common approach: no current effects

Most companies that address current financial effects at all conclude that there are none, or that they are not material. This is a legitimate outcome, but the quality of the explanation varies. Some companies provide a clear rationale. Others offer a single sentence with no supporting analysis.

The current financial effects of the identified material risks and opportunities are limited.

The material risks identified in the DMA as per the CSRD methodology are already included in our risk management framework. These identified material risks are gross risks in accordance with the CSRD and related methodology established by EC, EFRAG and other guidance and do not take into account mitigation measures in place. The level of control over those risks is monitored by our risk management governance process. We therefore do not expect a material adjustment to the financial statements due to those material risks.

Regulatory restrictions mean that certain energy sources, such as biogas, can no longer be used for emission reduction measures. However, hedging activities ensured that financial effects for the BMW Group were completely avoided. No material risks or opportunities have been identified for which there is a significant probability of occurrence in 2025 that would result in a material adjustment to the carrying amounts of the assets and liabilities recognised in the corresponding financial statements.

These three responses illustrate the spectrum. Netcompany offers a single sentence with no supporting detail. Sanofi provides more context, explaining that its material risks are assessed on a gross basis (before mitigation) and that existing risk management controls are sufficient to prevent material financial statement adjustments. BMW explains the specific mechanism that prevented financial effects (hedging) and confirms no material adjustments to carrying amounts.

Auditor opinions: clean conclusions, but emphasis-of-matter tells the year-one story

CSRD requires limited assurance on the sustainability statement (the bar moves to reasonable assurance over time). Each company in the corpus published an independent assurance report alongside its CSRD disclosures, typically a 2-4 page section issued by the statutory auditor or a separate assurance provider. We extracted the substance of each opinion: assurance type, conclusion, standards used, and any qualifications, emphasis-of-matter or other-matter paragraphs.

Across 78 companies with assurance opinions found in the main report:

• 75 unqualified (clean) conclusions– the standard outcome for limited assurance
• 0 qualified, adverse, or disclaimed conclusions
• 67 limited assurance only; 10 with limited + reasonable (reasonable on financial information or specific tagged data, limited on the rest of the sustainability statement)
• 60 cite ISAE 3000 (Revised) as the assurance standard, with 6 also using ISAE 3410 for greenhouse gas information; the rest use national equivalents (Dutch Standard 3810N, Finnish good assurance practice, Spanish ICJCE Guide 47, Swedish RevR 12)

So the headline is uneventful: assurance opinions are universally unqualified. The interesting story is what the auditors flagged withoutmodifying their conclusion – the emphasis-of-matter and other-matter paragraphs that around 30 of these reports contain.

The four patterns of emphasis-of-matter

The emphasis paragraphs cluster into four themes, all of them consequences of FY2024 being the first year of full CSRD application.

1. First-year-of-CSRD methodology caveats

The most common pattern is a paragraph drawing attention to the general context of first-time CSRD reporting: methodological choices, estimation principles, and the unavailability of certain information.

The information described in the paragraph ‘Disclaimer’, of note 5.1.1 ‘General information’ of the Sustainability Statement, which describes the uncertainties and limitations inherent to the context of the first year of application of the CSRD directive, in particular: the main assumptions, sources of interpretations and methodological principles followed by Atos SE’s management, in particular with regards to estimates on emission and conversion factors, resources inflows and electronic waste generated; the unavailability, to date, of certain information, in particular with regard to the transition plan, the resilience analysis, the transition risks and the recycling rates.

Forvis Mazars and Grant Thornton (Atos’ co-auditors) provide a specific list of where Atos exercised methodological judgment and where information was not available – useful triangulation for a reader trying to assess what’s in scope and what isn’t.

Without qualifying the conclusion expressed above, we draw your attention to the information provided in sections 3.1.5. Basis for preparation and 3.5.1. Methodological note on data reporting in chapter 3 of the Universal Registration Document, which sets out the context in which the sustainability information was drawn up and the methodological principles applied.

A more compact version of the same pattern. PwC and Forvis Mazars point readers to Sanofi’s methodology disclosures rather than listing specifics. Common across French corporates.

2. Comparative information not under assurance

Because FY2024 is the first year of CSRD application, prior-year comparatives in the sustainability statement weren’t under assurance scope. Auditors disclose this as an other-matter paragraph – particularly common in Finnish reports where the national accounting act has specific language for this.

We draw attention to the fact that the group sustainability report of Qt Group Plc that is referred to in Chapter 7 of the Accounting Act has been prepared and assurance has been provided for it for the first time for the financial year 1.1.–31.12.2024. Our opinion does not cover the comparative information that has been presented in the group sustainability report. Our opinion is not modified in respect of this matter.

KPMG Finland uses near-identical language in their Neste, Siili Solutions, and WithSecure reports – this looks like a standard template paragraph for first-year CSRD assurance in Finland. Tietoevry (Deloitte) has a near-identical version.

3. Measurement uncertainty in the metrics

A second cluster of paragraphs flags the measurement uncertainty inherent in the quantitative metrics, especially where ESRS allows for “different but acceptable” measurement techniques and where historical comparability is limited.

Most significant uncertainties affecting quantitative metrics: Section draws attention to ‘Sources of estimation and outcome uncertainty’ and Appendix 4 ‘Basis of preparation’ that identify quantitative metrics and monetary amounts subject to high level of measurement uncertainty. Comparability may be affected by lack of historical sustainability information in accordance with ESRS and absence of uniform practice. This allows for different, but acceptable, measurement techniques, especially in initial years.

The comparability of sustainability information between entities and over time may be affected by the lack of historical sustainability information in accordance with the ESRS and by the absence of a uniform practice on which to draw, to evaluate and measure this information. This allows for the application of different, but acceptable, measurement techniques, especially in the initial years.

Deloitte uses a near-identical paragraph for both Heineken and Stellantis (and several other Dutch-listed companies they audit). This appears to be Deloitte’s standard CSRD year-one emphasis paragraph, signalling to investors that comparability may be limited.

4. Double materiality assessment as an ongoing process

A third cluster flags that the double materiality assessment is inherently iterative – the IROs included in this year’s statement may shift in future years as due diligence evolves and sector-specific standards land.

Emphasis of matter: We draw attention to section “Materiality analysis and results according to the concept of double materiality” of the sustainability statement. The disclosure in this section explains possible future changes in the ongoing due diligence and double materiality assessment process, including engagement with affected stakeholders. Due diligence is an on-going practice that responds to and may trigger changes in the company’s strategy, business model, activities, business relationships, operating, sourcing and selling contexts relevant for stakeholders as a group.

Double materiality assessment process: We draw attention to section ESRS 2 General disclosure of the consolidated sustainability statement. The disclosure in this section explains possible future changes in the ongoing due diligence and double materiality assessment process, including engagement with affected stakeholders.

PwC Netherlands uses a near-identical DMA-process paragraph for both Cementir and RHI Magnesita. Like the Deloitte language above, this looks like a firm-level template applied across CSRD engagements.

Notable specific emphases

Beyond the four standard patterns, three reports contain company-specific emphases worth flagging individually.

With regard to the information published by Veolia Environnement on the presentation of its greenhouse gas (GHG) emissions, in Section 4.1.2.1.2 “Aligning Veolia’s trajectory with the 1.5°C target” – [emphasis paragraph drawing attention to specific GHG presentation and 1.5°C alignment claims].

KPMG and EY (Veolia’s co-auditors) layer a second specific emphasis on top of the standard methodology paragraph – this one drawing attention to how Veolia presents its 1.5°C-aligned trajectory. Worth a closer look at the underlying disclosure.

Concerning the consultation of the social and economic committee provided for in the sixth paragraph of Article L.2312-17 of the French Labour Code we inform you that as of the date of this report, this consultation has not yet been held.

PwC and Deloitte note a procedural gap: French law requires the social and economic committee to be consulted on certain matters, and this consultation hadn’t happened by report date. Same paragraph appears (less commonly) in TotalEnergies’ assurance report.

We draw your attention to: Paragraph 5.5.1 “Disclosure requirements of the CSRD directive with which Ubisoft has complied in its sustainability report”, which presents the omissions of quantitative and qualitative information in the sub-paragraph “List of omitted or unavailable data points”, associated with the context of a first CSRD Directive reporting exercise.

KPMG and Forvis Mazars draw direct attention to the data points Ubisoft chose to omit. The unusually direct language is consistent with Ubisoft’s own pattern of being upfront about omissions – visible elsewhere in their GOV-1 disclosure on board ESG training.

What this tells us

Three observations stand out from the assurance landscape:

• The opinions are uniformly clean, but the emphasis-of-matter language is a structured and increasingly useful signal of where the auditor sees risk in the underlying disclosure. A reader who only checks the conclusion misses most of the information.
• Firm-level templates are visible. Deloitte’s measurement-uncertainty paragraph, PwC’s DMA-process paragraph, and KPMG Finland’s comparative-information paragraph each appear in near-identical form across multiple engagements. Useful for a reader trying to identify what’s firm-template versus what’s a company-specific concern.
• Year-one CSRD is well-flagged. Between auditors (in their emphasis paragraphs) and management (in BP-1 / BP-2 disclosures), the limitations of the first reporting cycle are documented to a level that leaves limited room for surprise. FY2025 reports will tell us how much of this language drops out as comparability and methodology stabilize.

The transition plan, audited: where E1-1 disclosures fall short

ESRS E1-1 (Transition plan for climate change mitigation) is the most consequential disclosure in the climate standard. The 2025 amendment to E1-1 specifies ten elements that the disclosure must contain – not just GHG targets and a 1.5°C statement, but also decarbonisation levers, key actions, the investments and funding required, board approval, embedding in strategy, key assumptions and dependencies, locked-in GHG emissions, and progress against the plan.

We audited each company’s E1-1 disclosure against all ten criteria, reading both E1-1 itself and the related DRs (E1-3 actions, E1-4 targets, E1-8 GHG emissions) to verify cross-references. Of 83 E1-material companies:

• 82 have substantive E1-1 content (1 has none)
• 50 score 8 or higher out of 10 criteria covered
• 10 score a perfect 10/10: BMW Group, Covestro, Equinor, Eramet, Fuchs Petrolub, Nykredit, RHI Magnesita, Saab, Stellantis, Teleperformance
• 2 score 3 or below– either still building the plan or relying entirely on standalone climate documents

The full company-by-criterion matrix is on the dedicated transition plan audit page – sortable, with hover evidence quotes for every cell.

Coverage by criterion

The picture is bimodal. Five criteria are universally or near-universally covered. Three are widely missed.

The pattern is consistent: the “narrative” elements (targets, levers, action lists, alignment statements) are well-covered. The analytical elements that the 2025 amendment specifically added (locked-in emissions, key assumptions and dependencies, plus explicit board approval as a governance discipline) are where coverage breaks down.

What a complete transition plan looks like

The ten 10/10 disclosures share a pattern: they treat the transition plan as a quantified business plan rather than a sustainability narrative. Three illustrative quotes from the analytical criteria most companies miss:

Residual emissions at Net Zero: Maximum 10% of base year 2019 emissions (approximately 15 million tonnes CO2e) will remain in 2050, requiring permanent neutralisation through CO2 sinks. Scope 3 emissions will account for around 99%.

BMW’s locked-in emissions disclosure quantifies the residual 15 Mt CO2e they expect to need permanent removals for in 2050. It also names which scope (Scope 3 = 99%) is the residual driver. This is the analytical move ESRS E1-1 §16(d) is asking for.

The Stellantis Carbon Net Zero Targets also apply to Stellantis’ locked-in emissions, which are mainly generated by ICE vehicles sold. These vehicles have an expected life of 15 years. Accomplishing these objectives is dependent on the progress made in the environment in which we operate in (for example, the pace of electrification adoption, which can be impacted by public policies, the rollout of charging infrastructure, access to decarbonized electricity).

Stellantis combines the two missed criteria in one paragraph: the locked-in emissions are 15 years of sold ICE vehicles, and the key dependencies are EV adoption, charging infrastructure, and decarbonised power. Specific. Falsifiable. Useful.

Locked-in emissions are defined as estimates of future greenhouse gas emissions (Scope 1 and 2) from operated active and firmly planned assets over their lifetime, and cumulative greenhouse gas emissions from use (scope 3) of produced products. [...] It is developed, reviewed, and updated in consultation with, and approved by, the board of directors and the CEO.

Equinor opens with a definition of locked-in emissions before presenting the numbers, and is explicit that the plan was approved by the Board and CEO. The combination is unusual: most disclosures either assume the reader knows what locked-in emissions means or skip the explicit governance line.

The SBT-as-transition-plan pattern

A more compact pattern is also visible: companies that have published SBTi-validated targets and a 1.5°C alignment statement, but haven’t yet built the analytical layer underneath. Nine companies fit this pattern strictly – they tick GHG targets and 1.5°C alignment but miss three or more of the four “beyond-SBT” criteria (decarbonisation levers detail, investments, assumptions, locked-in emissions). Most are services, software, or consumer companies where transition impacts are smaller or less direct.

Atos aims to reduce its GHG footprint in line with international scientific standards, to do its part to limit global warming to 1.5°C. The target is compatible with the Paris Agreement, exceeding the minimum requirements necessary to limit global warming to 1.5 degrees. [...] Atos expects to finish building its transition plan in 2025 and to obtain approval by end 2026 by the Executive Committee and the Board of Directors of Atos.

Atos is unusually explicit about where they are on the journey: the targets are set, the 1.5°C statement is in, but the transition plan itself is being built and won’t be approved until end 2026. Honest disclosure, even if it doesn’t fully meet E1-1’s requirements yet.

Our transition plan is aligned with the Science Based Targets initiative (SBTi) and contributes to limiting global warming to 1.5°C. [...] reduce absolute Scope 1 and 2 emissions by 45% by 2030 compared with 2019, and Scope 3 emissions by 25% by 2030 compared with 2022.

Novartis ticks the SBTi/1.5°C box and the GHG targets box, but the disclosure has no locked-in emissions analysis, no key assumptions, and no explicit board approval. For a pharma company with substantial Scope 3 from ingredients and packaging, the analytical layer matters.

Why the analytical criteria matter

ESRS E1-1 was always more than a target disclosure. The 2025 amendment makes that explicit: locked-in emissions analysis tells the reader how much of the company’s decarbonisation problem is structural (i.e. requires asset turnover, write-downs, or stranded value) versus addressable through new investment. Key assumptions and dependencies tell the reader which external conditions the plan rests on, and therefore where the plan’s execution risk is concentrated.

A reader can’t do transition risk analysis on a target alone. The analytical criteria are where the transition risk lives. It is no coincidence that the 10/10 disclosures are clustered in heavy industry (BMW, Stellantis, Equinor, Eramet, RHI Magnesita, Saab, Covestro) – sectors where transition impacts are large enough that the analytical work has to be done internally anyway. The amendment is asking everyone else to write up the same analysis.

Coverage will rise in FY2025 reports as companies bring the newer paragraph 16 elements into scope. The benchmark exemplars are already visible.

What climate scenario analysis looks like in practice

ESRS expects companies with material climate impacts to run scenario analysis covering at least a well-below-2°C pathway and a pathway with significantly higher warming (typically above 3°C). Of the 87 reports reviewed, 70 (80%) name at least one reference scenario. This is a picture of what they are actually using.

The most common reference scenarios

The same handful of scenarios appear again and again. IPCC pathways dominate the physical-risk side; IEA pathways dominate the transition side. RCP labels (the earlier IPCC AR5 generation) and SSP labels (the current AR6 generation) often describe overlapping temperature pathways, so they are grouped below.

Counts combine companies naming either the SSP or the equivalent RCP label for the same temperature pathway.

The dominant pattern: IPCC physical plus IEA transition

The most common approach across the dataset is to pair an IPCC scenario (covering physical-risk projections) with an IEA scenario (covering transition-risk projections). Chemicals, industrials, healthcare and auto companies all tend to use some version of this combination.

Sanofi used scenario analysis to perform a physical and transition risk assessment based on three of the IPCC climate change scenarios (RCP2.6, RCP4.5, RCP8.5) under two different time horizons (2030 and 2050). For transition risks, Sanofi also used IEA transition scenarios (IEA Net Zero Emissions 2050 and IEA Sustainable Development Scenario).

Sanofi’s selection is the clearest example of the IPCC + IEA pairing. Three IPCC RCPs bracket the physical-risk side from well-below-2°C to more than 4°C, and two IEA pathways cover the transition side.

The identification and assessment of the transition events was based on the 1.5°C Net Zero Emissions by 2050 scenario of the International Energy Agency. Physical-risk projections for production sites were based on IPCC SSP5-8.5.

BASF uses a minimal but compliant version of the pattern: one IEA transition scenario (NZE 2050), one IPCC physical scenario (SSP5-8.5).

Three IPCC climate scenarios are used: a low-emissions scenario (<+1.5°C, SSP1-1.9), a medium scenario (+2.5°C, SSP2-4.5), and a high scenario (>+4°C, SSP5-8.5).

BMW takes the all-IPCC route, using three SSP-based scenarios with explicit temperature labels. No IEA scenario is named in BMW’s climate DRs, but the three-scenario pairing covers the required temperature range.

Less common choices worth looking at

A handful of companies have made unusual or interesting scenario choices that step outside the standard IPCC + IEA pairing. Each of these is worth considering as an input to a company’s own scenario design.

The analysis uses WBCSD’s 1.5°C Societal Transformation Scenario and its >3°C Historic Trends Scenario to test the business model against contrasting food-system futures.

Danone is the only company in the dataset to use the World Business Council for Sustainable Development’s food-system scenarios. For a food company, the WBCSD pathways translate more directly to agricultural and consumer-behavior inputs than a generic IEA energy scenario would.

Two internal pathways were modelled: a “baseline” scenario (current production and emissions trajectory) and an “achievable sustainable” scenario (target production with 60% renewable electricity and full decarbonisation-lever adoption).

Acerinox pairs standard IPCC and IEA scenarios with two custom scenarios designed to stress-test its own decarbonisation plan. The custom pair is more operationally meaningful than any reference scenario alone, because it directly ties scenario inputs to the company’s levers.

Three SSP-RCP combinations are used: SSP1-RCP1.5 (1.5°C), SSP2-RCP2.7 (2.7°C), and SSP4-RCP4.0 (4°C).

Kone uniquely uses SSP4 (“inequality”) as its high-warming pathway, rather than the more common SSP5 (“fossil-fueled development”). SSP4 captures a middle-of-the-road world with strong regional inequality, which Kone argues fits its supply-chain exposures better than SSP5 would.

The analysis uses the full IPCC RCP suite (RCP 2.6, 4.5, 6.0, 8.5), two NGFS scenarios (Net Zero 2050 and Delayed Transition), and CAT Current Policies.

Hilti has the most diverse scenario set in the dataset – four IPCC RCPs, two NGFS pathways, and the Climate Action Tracker Current Policies scenario. It is the only company to use CAT, and its NGFS usage is rare outside the financial sector.

The menu of reference scenarios is stable and well-known. The practical question is not which scenarios to name but how meaningfully they are applied to the business. For that, see Drawing a conclusion on climate resilience.

Drawing a conclusion on climate resilience

ESRS 2 SBM-3 and ESRS E1 require companies to describe the resilience of their strategy and business model to climate change. Scenario analysis is part of the input. The output that matters is a conclusion: is the strategy resilient, under what conditions, and where are the vulnerabilities? The quantitative financial effects of that analysis can be deferred under the ESRS 1 Appendix C phase-in, but the qualitative resilience conclusion cannot.

Across the reports reviewed, the quality of resilience conclusions varies widely. Some companies run detailed scenario analysis but never translate it into a conclusion. Others state “we are resilient” with no supporting evidence. A small number do both: they run the analysis and draw a conclusion that connects to their financial statements or to specific actions.

What good looks like

The strongest resilience conclusions are anchored to something concrete: the assumptions behind the financial statements, or the specific actions the company says will keep the strategy resilient.

At present, the BMW Group’s strategy is consistent with the transition to a carbon-neutral economy in accordance with ESRS E1 AR 12(d). [...] the low-emission scenario is incorporated into the assumptions for the Group Financial Statements.

BMW does two things well. It states the conclusion plainly (the strategy is consistent with a carbon-neutral economy), and it anchors that conclusion by noting that the low-emission scenario is used in the assumptions underlying the consolidated financial statements. The connectivity between the sustainability and financial statements is exactly what the standards expect. Three IPCC scenarios (SSP1-1.9, SSP2-4.5, SSP5-8.5) sit behind the analysis, but the reader gets the output first.

Nine physical hazards (extreme heat, river flooding, coastal flooding, tropical cyclones, wildfires, water stress, and others) were scored from 0 to 10 at site level across medium and long time horizons under IPCC SSP5-RCP 8.5 and SSP1-RCP 2.6.

Acerinox’s conclusion is granular by asset: the reader can see which specific sites face which hazards. Site-level findings make the conclusion actionable – mitigation can be directed at the sites that score highest on the hazards that matter most.

Analysis without a conclusion

A common failure pattern is running the analysis but not drawing a conclusion from it. The scenarios are named, the methodology is described, and then the reader is left to infer whether the strategy holds up.

Three IEA scenarios were used: STEPS (Stated Policies, 2.4°C), APS (Announced Pledges, 1.7°C) and NZE (Net Zero Emissions, 1.5°C). Lifecycle carbon intensity was checked against TPI (<2°C) and MSCI ITR (1.9°C).

TotalEnergies names its scenarios and benchmarks its carbon intensity, but E1-9 is marked “omitted” and SBM-3 does not draw a resilience conclusion. The inputs are there; the output is missing. Novartis shows the opposite problem – a quantified exposure table with USD amounts at 2025, 2030 and 2050 but no named scenario to anchor it.

Boilerplate resilience

At the weaker end, companies assert resilience without showing the work. No scenarios, no horizons, no specific findings – just a statement that the strategy is resilient.

Our three strategic sustainability priorities – decarbonisation, biodiversity, and community impact – play an enabling role in our strategy and project delivery. They support that we mitigate risks and deliver more resilient energy projects that also drive a positive change for society and nature.

Ørsted’s entire SBM-3 climate resilience content is the paragraph above plus a pointer to other pages. E1-9 is similarly brief: 134 characters directing the reader to the anticipated financial effects discussion. No scenarios are named in the structured disclosures, no horizons are specified, and no conclusion is drawn about where the strategy might be vulnerable.

During 2024, KONE’s strategy and business models showed resilience in harnessing the material opportunities and addressing material impacts and risks [...] The conclusion was supported by a qualitative assessment based on KONE reaching the set strategic targets and KPIs during the reporting period.

KONE’s resilience conclusion is that KONE hit its KPIs this year. This conflates operational performance with climate resilience: meeting strategic targets in 2024 says very little about whether the business model holds up under a 4°C warming scenario in 2050. E1-9 is then deferred under phase-in.

MAPFRE faces significant risks due to climate change, especially in relation to natural disasters that may increase in frequency and severity, impacting claims and the resources needed for their management. Furthermore, the increase in climate risk could potentially introduce material uncertainty in the assumptions and lead to an inaccurate assessment of insurance risk.

Mapfre’s entire E1-9 content is the paragraph above. For a property and casualty insurer whose core business is pricing climate risk, this is thin. No scenarios, no quantification of expected claims under different warming pathways, no conclusion about whether the underwriting book is resilient.

The honest admission

One company stands apart by stating plainly that the analysis has not been performed.

Qt has not conducted a separate resilience analysis on the company’s capacity to address its material impacts and risks or take advantage of its material opportunities.

QT Group’s disclosure is non-compliant with the resilience requirement, but it is transparent about that fact. A reader knows exactly what is missing and can ask about it. That is more useful than boilerplate that creates the appearance of analysis without the substance.

The pattern across the dataset: large, sophisticated companies are not always the strongest reporters. Some mid-caps (Hilti, KRONES, Frequentis) outperform much larger peers on resilience conclusions. The most common failure is producing inputs without an output – running scenario analysis and never stating what it means for the strategy. For a companion view of the scenarios themselves, see What climate scenario analysis looks like in practice.

Adequate wages: the benchmark question

ESRS S1-10 asks companies to disclose whether all own-workforce employees are paid an “adequate wage”. The standard interprets “adequate” as benchmarked against a living wage– a wage covering basic living needs for the worker and their family in the local context – rather than just the legal minimum wage. Outside the EU especially, the two can differ significantly: WageIndicator and Fair Wage Network living wage estimates often run 20-40% above national minimum wage levels, and even within the EU the UK Real Living Wage (£12.60/hr) sits above the National Living Wage (£11.44/hr).

S1-10 is also new: many companies are still building the assessment process, so we should expect a spread of maturity. Across 66 companies that disclose something on S1-10:

• 22 (33%) anchor to a named external living wage benchmark
• 13 (20%) are mixed: living wage benchmark in some geographies, minimum wage / CBA elsewhere
• 17 (26%) explicitly assess against minimum wage or CBA only
• 10 (15%)claim “all employees are paid an adequate wage” without naming a benchmark
• 4 (6%) assess S1-10 as not material to their business

1. Living wage benchmark, with coverage

Companies in this group typically name a benchmark provider (most commonly the Fair Wage Network or WageIndicator), give the % of workforce assessed, and disclose the gap.

99.2% of employees were assessed against the Fair Wage Network benchmark in 2024. 99.7% of the assessed employees earned at least a fair wage according to Fair Wage Network. The remaining 0.3% below the fair wage threshold were located in Singapore.

When Heineken’s Singapore employees fell below the FWN level mid-year, the company did a second benchmark against Singapore’s tripartite Progressive Wage Model and confirmed 100% compliance there. Detailed disclosure of how a single-country gap was investigated and resolved.

Out of 29,564 employees assessed, 396 individuals (1.3 percent) were identified to have earnings below what is considered “decent living” covering the basic needs of workers. The company has developed a dashboard to track employees earning below the living wage threshold and will continue to map wages below the living wage and close the wage gap in 2025.

Particularly transparent disclosure – Norsk Hydro names the number of people below the threshold, not just the headline %. Most companies disclose only the percentage.

Sanofi published a commitment in 2024 to pay a living wage for all employees. The company uses data from the Fair Wage Network, which covers family costs for basic food, water, housing, clothing, healthcare, transport & communication, education, and leisure & other discretionary spending. Following the latest agreement on living wages by the International Labor Organization (ILO), Sanofi adheres to ILO principles and aligns with the United Nations Global Compact’s living wage ambition.

For each geographical area, used the higher of the minimum wage and the so-called living wage. Relied on 2024 data from Eurostat, WageIndicator, and the IDH Benchmark. Selected only countries representing more than 4% of the workforce, covering 80% of the total workforce. The analysis did not reveal any discrepancies in relation to the reference decent wage as at 31 March 2025.

A clearly-described methodology that takes the higher of two reference points and triangulates between three data providers. Also clear about the coverage gap (80%, not 100%) with a stated target to expand.

2. Mixed: living wage at home, minimum wage abroad

A common pattern is to apply a living wage benchmark in the home country and rely on minimum wage or collective bargaining agreement elsewhere. This is often a stepping stone toward full coverage.

Atos is operating in 68 geographies and 91.3% of these countries have minimum wages dictated by law: where a minimum wage is dictated by law, Atos pays more than this level of wage. In the UK specifically, Atos is a Real Living Wage Employer.

Crisp disclosure of the two-tier approach – UK Real Living Wage in the UK, minimum-wage compliance everywhere else. No published commitment to extend the UK approach to other geographies.

Veolia has used the statutory minimum wages or the local minimum wages established by the most relevant collective agreements as the adequate reference wage whenever possible. For 5 countries representing less than 1% of the Group’s employees, reference wages do not exist or are not applicable. Veolia launched a pilot scheme on living wages in six countries representing a significant proportion of the workforce: France, United States, United Kingdom, Japan, Colombia, Poland.

Veolia’s primary benchmark is statutory minimum wage / CBA, with an internal living wage methodology piloted in six countries. Notably honest about the <1% of workforce in five countries where no reference wage applies – a level of transparency about gaps that’s unusual.

3. Minimum wage or CBA as the reference

These companies meet a legal floor or CBA minimum and report compliance against that, without referencing a living wage benchmark. In some sectors and geographies, CBA minima approximate living wage levels; in others they don’t. The disclosure tells you which question the company decided to answer.

The wages of employees in all of Qt’s operating countries have been compared to either the country’s minimum wage level or the minimum wage specified in the applicable collective agreement if a national minimum wage has not been established. If the minimum wage varies within the country, the highest minimum wage level is used as the reference value.

The most direct articulation of the minimum-wage approach in the corpus. QT Group operates primarily in EMEA, North America and APAC; they report 100% of employees paid at or above the relevant minimum.

The references that Eni uses for the comparison are the minimums established by law or by contract in each Country and the market minimums of medium-large local companies, which are well above the poverty thresholds established by Eurostat for the European Union and by the Wage Indicator for other Countries.

Eni references Wage Indicator data as a contextual comparison (“wages are well above poverty thresholds”) but doesn’t adopt it as the primary benchmark for adequacy. For a company operating in 60+ countries, the practical effect of using legal minimum / market minimums depends heavily on which countries are weighted.

Roche’s disclosure on adequate wages is limited to policy commitments and supply chain expectations. No specific benchmark, coverage percentage, or adequacy assessment is disclosed for Roche’s own employees. Suppliers are required to pay workers according to applicable wage laws, including minimum wages.

A pharma group of Roche’s scale operating in many low-wage markets would benefit from a more substantive own-workforce disclosure. The current text addresses suppliers more than the group’s own employees.

4. The wider claim, narrower disclosure

A separate group of companies state that all employees are paid an adequate wage but don’t name the benchmark used to assess that. These claims may be backed by genuine internal work; the S1-10 disclosure simply doesn’t show the methodology.

All employees are paid an adequate wage. The company specifies that adequate wage is “in line with benchmark” but does not disclose which benchmark is used.

MAPFRE establishes appropriate and competitive remuneration in accordance with the applicable benchmark indexes, according to function/job position, merit, and performance. This remuneration is based on applicable regulations while guaranteeing equality and nondiscrimination.

All employees receive an adequate salary, in accordance with applicable benchmarks. The company describes its compensation strategy as “differentiating and competitive”, but doesn’t specify which benchmarks are used (living wage methodology, Fair Wage Network, minimum wage, or CBA).

Other companies in this group: Barco, Bechtle, Crayon Group (cites Mercer compensation data, which is market-rate benchmarking rather than a living wage standard), Fuchs Petrolub, Repsol, TAG Immobilien, WithSecure.

Why the benchmark choice matters

The point of ESRS S1-10 was to push beyond the legal floor. A company benchmarking against a living wage and finding gaps is doing the work the standard expects – sometimes uncomfortably, but transparently. Norsk Hydro disclosing 1.3% of its workforce below the threshold is a good example. A company benchmarking against minimum wage and reporting 100% compliance has accurately answered a different question.

The 22 companies in group 1 have built the assessment infrastructure. The mixed group is likely to expand that coverage geographically over the next reporting cycle. The minimum-wage-only and “claim-without-benchmark” groups represent material work still to be done – often the assessment exists internally but hasn’t yet been described in the disclosure.

The ESRS gender pay gap: omissions and workarounds

ESRS S1-15 (formerly S1-16) prescribes how the unadjusted gender pay gap shallbe calculated (AR 98 amended): the difference between mean gross hourly pay of male employees and mean gross hourly pay of female employees, divided by the mean gross hourly pay of male employees, expressed as a percentage. It is expected to cover all employees, and the word is “shall” – not “may”.

Several companies did not follow the requirement. They either substituted their own methodology or omitted the figure entirely. Notably, each of the examples below received limited assurance from their auditor stating that the sustainability statement was prepared in accordance with ESRS. That assurance held despite the clear deviation from a prescribed formula.

Setting aside routine variations (reporting on annual rather than hourly pay, or using an inverse formula), two substantive patterns stand out: companies that substituted their own methodology, and companies that did not disclose a figure at all.

Companies that substituted their own methodology

One group disclosed a pay gap figure but measured something other than the ESRS-required metric, typically substituting a proprietary methodology they considered more appropriate.

As we believe that equal pay for equal work is the right approach and an appropriate reflection of a fair representation of the gender gap, we have chosen to not disclose the global raw gender pay gap as in a Group present in more than 50 countries, with different business models and varied gender and pyramid structures in each country, such a globally calculated parameter is not providing a relevant picture.

Capgemini explicitly declines the unadjusted global figure and instead reports an adjusted “equal pay for equal work” gap, calculated via EDGE-certified regression analysis on fixed compensation, for the top five countries by headcount (covering approximately 75% of global workforce). The reported figures range from −9.3% (Poland) to 0.3% (France).

The specific metric used by Atos is not the unadjusted gender pay gap as required by ESRS S1-15 (formerly S1-16). An unadjusted gender pay gap, as required by ESRS S1-15 (formerly S1-16), would be irrelevant in the context of Atos given the non-linear gender pyramid. The specific metric used by Atos provides an accurate function-based vision that is a more powerful tool to foster gender equality.

Atos reports a 6.95% gap on annual basic salary and 6.59% on total target remuneration, but calculates the gap by function and GCM level before consolidating via weighted-average headcount. The company explicitly states the ESRS method would be “irrelevant” for its context, and lists the unadjusted gender pay gap as “Not material for Atos” in its ESRS cross-reference table.

The Group uses the following methodology to calculate the gender pay gap: (Average women CR / Average Male CR −1) × 100 where CR = Compa Ratio = Total Target Cash / Country median. In 2024, the Gender Pay Gap stood at 1.1 pt on a scope including managers, senior managers, and executive positions.

Danone substitutes a Compa Ratio methodology for the ESRS formula. The numerator uses total target cash (base plus target variable, not hourly gross pay), the denominator is a country median (not the male average), and the scope is managers and above only. The company states a roadmap to expand to all employees in future years.

The document references ESRS S1-15 (formerly S1-16) disclosure requirements but does not provide a single headline unadjusted gender pay gap percentage as required by the standard. Gender pay gap information is provided via the French Professional Equality Index (scores of 92–100/100 across three UES entities) and an adjusted “identical profile” methodology using Mercer Consulting’s approach.

TotalEnergies discloses French regulatory index scores and an adjusted pay gap calculated from role-and-seniority-controlled data, but stops short of producing the single ESRS-required figure. The French index is calculated on a different methodology, so it is not directly comparable to the ESRS metric other companies report.

Companies that did not disclose

A second group reported no gender pay gap figure at all. Seventeen of the 84 S1-material companies reviewed fall into this category. The stated reasons range across three buckets: phase-in under ESRS 1 Appendix C, a materiality assessment that ruled S1-15 (formerly S1-16) out, or silent omission with no explanation.

BASF has indicated that ESRS S1-15 (formerly S1-16) metrics (unadjusted gender pay gap and excessive CEO pay ratio) are “Not material” according to the disclosure index table on pages 326–327. The company references qualitative information about compensation concepts and principles but does not provide the quantitative metrics required by S1-15 (formerly S1-16).

BASF’s stated rationale is materiality. The company discloses qualitative compensation principles (equivalent positions compensated comparably regardless of gender) but declines to put a number on it.

To ensure that data published is consistent and reliable, Sopra Steria has decided not to publish, for this first year of CSRD reporting, indicators regarding gender pay gap and total compensation ratio. Groundwork carried out with the various subsidiaries and countries while preparing data collection and publication highlighted several issues, especially the need to standardise practices between the different entities and harmonise the quality of the data reported.

Sopra Steria invokes the first-year phase-in under ESRS 1 Appendix C and commits to resolving methodology inconsistencies across its subsidiaries before publishing a figure. The company does disclose a France-specific workplace gender equality index score (89/100) as a partial substitute.

Not disclosed. No gender pay gap percentage is reported, and no ratio of highest-paid individual to median employee is disclosed, despite extensive remuneration disclosures for Board and Corporate Executive Committee members.

Roche provides detailed disclosure of individual executive pay but does not include the two S1-15 (formerly S1-16) metrics. No phase-in statement or materiality assessment is offered as rationale.

ESRS S1-15 (formerly S1-16) is prescriptive on the formula to use. When companies omit the figure or substitute a proprietary methodology, cross-company comparison becomes impossible and the purpose of the harmonized metric is weakened. The examples above represent a minority of the sample, but they illustrate how the standard’s prescriptive approach is landing in practice in year one – and that limited assurance opinions have so far not pushed back against these deviations.

Board sustainability expertise: three approaches

ESRS 2 GOV-1 paragraph 21(d) asks companies to describe the extent to which their administrative, management and supervisory bodies have, or have access to, sustainability expertise. The hundreds of CSRD reports reviewed handle this three different ways: some name the expertise their board holds, some acknowledge the gap and describe how it is being addressed, and some rely on external advisors.

1. Named expertise at board level

The strongest disclosures list the relevant sustainability skills of individual board members, usually via a formal skills matrix.

December 2024 marked the first time that Supervisory Board members were surveyed for the first time on their specific sustainability skills relating to the key sustainability topics. The skills matrix for the Supervisory Board includes Experience, (Access to) expertise, In relevant markets, In relevant areas of competence, and Sustainability – with sub-columns for individual mobility and climate change.

BMW publishes a Supervisory Board skills matrix with Sustainability as a named column. It is transparent that 2024 was the first year individual sustainability competencies were actually surveyed – previously the matrix did not cover this. That transparency is itself notable: BMW is signalling what it did not have before.

Corporate Governance Committee, the Board of Directors drew up and approved its own skills matrix. This document is made to serve as a mandatory guide for all Board member selection processes. [...] In 2024, training was provided to the Board on the contents of the CSRD and the implications at the Board level and on the Group’s management and reporting.

Acerinox combines three mechanisms: a board skills matrix that includes sustainability, a dedicated Sustainability Committee with five members, and CSRD-specific training provided to the full Board in 2024. The Chair of the Audit Committee also sits on the Sustainability Committee, creating a deliberate bridge between the two.

2. Limited expertise, being built

A second group of companies acknowledges that board-level sustainability expertise is being developed rather than already held. The signals range from board training being delivered in 2024 to infrequent exposure to sustainability matters.

For the 2024–25 fiscal year, no specific ESG training has been provided for directors. The Board of directors is informed on sustainability issues at least once a year, coinciding with the presentation [of the annual report].

Ubisoft’s disclosure is unusually candid: no ESG training for directors in 2024–25 and one sustainability briefing per year. For a company with material S4 (consumer and end-user) and E1 topics, the frequency and depth of board engagement visible in the disclosure is limited.

The Board of Directors has received ESG training 2024 to build appropriate skills and expertise to oversee sustainability matters. The training included information [on the material IROs from the double materiality assessment].

F-Secure’s wording acknowledges that the purpose of the 2024 training was to build appropriate skills and expertise, rather than to refresh existing expertise. The phrasing is honest about where the board was starting from.

3. Access via external expertise

A third pattern is explicit: the board does not need to hold the expertise itself, because it has structured access to external advisors or to in-house sustainability functions.

SAP consults with external sustainability and AI ethics advisory panels consisting of experts from academia, industry, and civil society for advice on generating positive social impact and mitigating human rights risks.

SAP operates a formal external Sustainability Advisory Panel. The panel is cross-disciplinary (academia, industry, civil society) and is positioned as a structural input into sustainability decisions rather than an ad-hoc consultation.

The board has access to ESG expertise within Crayon’s management ranks, in the form of the Global ESG Team. External consultants may also be conferred with at the discretion of the board of directors.

Crayon Group describes a two-tier access model: in-house ESG team expertise as the first resource, with the option to bring in external consultants when needed. The disclosure does not claim the board itself holds the expertise, but is clear about how the board accesses it.

None of these three approaches is non-compliant. GOV-1 requires the company to describe the expertise of the board and / or its access to expertise. What matters is that the description is honest. The strongest disclosures say directly what the board holds, what it does not, and how the gap is addressed. The weakest are silent on both the expertise and the access arrangement.

Anchoring sustainability internal controls: Three Lines and COSO

GOV-4 (was GOV-5) asks how a company manages risks and internal controls over its sustainability reporting. There are two widely used reference points the disclosure can be anchored to:

• The Three Lines model(formalized by the Institute of Internal Auditors as “Three Lines of Defense” in 2013, updated to “Three Lines Model” in 2020): line management owns risk and controls, second-line specialists (risk, compliance, sustainability) monitor, and internal audit provides independent assurance.
• The COSO Internal Control framework (1992, revised 2013), with the sustainability-specific extension Achieving Effective Internal Control Over Sustainability Reporting (ICSR) published in 2023. COSO ERM (2017) covers enterprise risk management on the same principles. The variants share a common backbone: control environment, risk assessment, control activities, information and communication, monitoring.

Across the hundreds of CSRD reports reviewed, 58 companies reported on GOV-4 (the rest marked it not material or omitted). Of those:

• 5 companies (9%) anchor their disclosure to COSO in any form (IC-IF, ICSR, ERM or generic): Sanofi, Virdien, Amadeus, AMAG, Acerinox.
• 4 companies (7%)explicitly name the Three Lines model: Acerinox, Amadeus, Novartis, Eni (as “three control levels”).
• 51 companies (88%)reference neither. They describe their controls in narrative, often using the word “framework” without identifying which framework.

1. The Three Lines model

The Three Lines structure maps cleanly onto how sustainability reporting work is organized: business and data owners produce the numbers, a sustainability or risk function reviews, internal audit assures. Where companies do anchor to a model, this is the most common explicit reference.

The methodological approach is aligned with the three lines of defense (COSO) risk model. Key to the model is the establishment of projected roles and responsibilities to ensure and oversee compliance with the ICSSR: Board of Directors, data management and monitoring officers, internal monitoring, internal audit, etc.

One sentence that does both jobs at once: it names the model and identifies COSO as the source.

Amadeus formally adopted the Three Lines of Defense Model (‘Three Lines Model’) with the endorsement of the Board and the Executive Committee.

Amadeus is explicit that the Board endorsed the model, and the rest of their controls description is structured around the three lines.

As the basis of our integrated assurance system, we follow a model for managing our risks developed by the Institute of Internal Auditors that describes three lines of assurance.

Novartis attributes the model correctly to the IIA and uses “three lines of assurance” rather than “three lines of defense”, reflecting the IIA’s 2020 update away from defensive language.

The IRM Model is characterized by a structured approach, based on international best practices and considering the guidelines of the Internal Control and Risk Management System, that is structured on three control levels: 1st Level – Line Management / Risk Owner; 2nd Level – Specialist Functions (Integrated Risk Management, Integrated Compliance, HSE, etc.); 3rd Level – Internal Audit Function.

Eni does not use the words “Three Lines”, but the three-level table is the model in everything but name. This pattern (the structure without the label) is also visible across BBVA, BMW, Pandora and BIL, which describe similar arrangements without attributing them to any framework.

2. Aligning with COSO

Five companies cite COSO. They cite different parts of the COSO library (the 2013 IC-IF, COSO ERM, the 2023 ICSR sustainability extension), but the underlying principles are the same. The differences are mostly about which document the company chose to name.

Sanofi has the most thorough disclosure in the corpus. They cite COSO 2013 IC-IF as the foundation, then COSO 2023 ICSR as the sustainability-specific extension, then describe how the existing SOX-controlled financial reporting process will absorb sustainability data from 2025 onward.

Sanofi applies the Internal Control – Integrated Framework issued in 2013 by the Committee of Sponsoring Organizations of the Treadway Commission (COSO), reflecting its listing on the US market and in light of obligations under the Sarbanes-Oxley Act. The COSO framework is considered equivalent to the reference framework of the Autorité des Marchés Financiers (AMF, the French Financial Markets Regulator).

Sanofi’s Internal Control system has adopted the COSO guidance “Achieving Effective Internal Control Over Sustainability Reporting (ICSR): Building Trust and Confidence through the COSO Internal Control – Integrated Framework (2023)” as the foundation for establishing and maintaining an effective system of internal control over sustainability reporting.

The 2023 COSO ICSR guidance was published specifically to extend the COSO internal control framework to sustainability reporting. Sanofi and Amadeus are the only companies in the corpus that explicitly cite it.

Virdien (formerly CGG) takes a similar approach, driven by their French listing requirements. They cite COSO ERM and ISO 31000 for the policy layer, then COSO 2013 specifically for internal control evaluation, with the IIA Code of Conduct governing the internal audit function.

The Company complies with the 2013 COSO internal control integrated framework, established by the Committee of Sponsoring Organizations of the Treadway Commission (“COSO 2013”). The Internal Audit Department evaluates internal controls based on the COSO 2013 framework and tools and in compliance with the Code of Conduct of the Institute of Internal Auditors (IIA).

Amadeuscombines COSO ERM and ISO 31000 as design principles, and reports that it is actively building the sustainability extension – an internal “ICSR matrix” based on COSO – through 2024.

In 2024, Amadeus’ Group Internal Control unit has started to develop an internal control environment model – Internal Control over Sustainability Reporting (ICSR) matrix – based on COSO. Amadeus ICSR model contains a sustainability risk and control matrix for the Group that includes the material sustainability topics and the entity specifics identified through the double materiality assessment.

AMAG Austria Metall keeps it concise: a single sentence locating their risk management between two named standards.

AMAG’s risk management is based on the “Risk Management” standard (ISO 31000) and the COSO ERM Framework.

A useful minimum: even a one-line attribution gives the auditor and the reader a recognisable anchor.

The silent majority

The other 51 reporters describe their controls without anchoring to anything external. Detailed examples (BBVA, BMW Group, Pandora, HELLENiQ Energy, Tietoevry, Royal Schiphol) describe credible structures: board oversight, audit committees, internal audit, dedicated sustainability functions, two-level controls. But the disclosure floats free of any identifiable reference framework. Tietoevry, for example, uses the phrase “risk management framework” or “internal control framework” seven times without ever identifying which framework.

This matters for three reasons:

• Limited assurance is easier and cheaper against a recognized framework. The auditor does not have to evaluate the framework itself.
• Comparability across companies depends on shared vocabulary. “Our internal control framework” without a referent is hard to benchmark.
• COSO published the 2023 ICSR guidance specifically to fill this gap for sustainability reporting. Two of 58 reporters explicitly use it; seven cite COSO or the Three Lines model in any form.

For a company writing GOV-4 next year, the practical recommendation is short. Pick a Three Lines structure for governance, COSO for controls, and say so explicitly. It costs nothing in substance and adds a great deal in clarity.