Book a Demo

Category: ESG Reporting software

  • ISSB Nature Exposure Draft: What It Means for UK SRS S1

    ISSB Nature Exposure Draft: What It Means for UK SRS S1

    Framework mapping view linking UK SRS S1 requirements to nature-related risk data by site

    In October 2026 the ISSB published an exposure draft of IFRS Sustainability Disclosure Practice Statement 1, Nature-related Disclosures. Comments close on 19 February 2027. The headline most summaries lead with is that applying it will be optional.

    For a finance director at a UK-listed company, that headline is the least useful part. The draft itself says that IFRS S1 already requires material information about all sustainability-related risks and opportunities, “including those related to nature” (paragraph IN6). UK SRS S1 is built on IFRS S1. So the real question for your 2029 report is whether nature is material to your business, and whether you can evidence the answer either way. This post covers what the draft proposes, how it lands on UK SRS, and what to put in place while the timetable still gives you room.

    What the exposure draft is

    • A Practice Statement. A company can assert compliance with ISSB Standards without applying it (IN7). A company applying it would assert compliance with both.
    • Available to S1 and S2 reporters only. It can be applied by entities that apply IFRS S1 and S2 at or before the date they first apply the Practice Statement (IN10).
    • Open to jurisdictions to mandate. A jurisdiction adopting ISSB Standards could require it, or make it available on a voluntary basis (IN8).
    • Built on TNFD. The ISSB drew on the TNFD recommendations and metrics. The TNFD’s LEAP approach is offered as one helpful process for identifying risks, and its use is not required (paragraph 11).
    • Light on transition. No comparative information is required in the first year of application (C3).

    The ISSB also says it could later issue the content as a Standard, subject to consultation (IN9). Treat the Practice Statement form as a starting point that may harden.

    Why “optional” does not take nature off your UK SRS report

    Under the FCA’s final rules in PS26/19, UK SRS S1 applies on a comply or explain basis, with a two-year relief for non-climate disclosures. For a calendar-year company, that puts full S1 reporting in FY2029. The S1 explain rules are tied to the sustainability risks and opportunities the company has identified, and a company that has identified none must say so.

    That makes identification the step that carries the weight. If nature-related risks could reasonably be expected to affect your cash flows, access to finance or cost of capital, S1 catches them whether or not the UK ever endorses the Practice Statement. A statement that you identified no material nature risks is itself a judgement, and an investor or assurance practitioner can ask how you reached it.

    The draft is still worth reading closely. It is the clearest published signal of what a well-supported nature disclosure looks like, and it is the yardstick reviewers will reach for when they assess yours. Our post on writing a defensible UK SRS explanation covers the three parts an explanation must contain.

    What the draft would ask for

    Location, across the value chain

    The central proposal is that a company considers the location of its assets and activities throughout the value chain, including the characteristics of nature in those locations, when it identifies nature-related risks (paragraph 10). The standard of effort is the familiar S1 test: all reasonable and supportable information available at the reporting date without undue cost or effort.

    For most companies this is the hard part. Your own sites are on the fixed asset register. The places your key raw materials are grown, mined or processed usually sit with suppliers, and in many cases with their suppliers.

    Two cross-industry metrics

    Paragraph 30(a) would require, where material:

    • the amount and percentage of assets or business activities vulnerable to nature-related risks; and
    • the amount and percentage of assets or business activities aligned with nature-related opportunities.

    The draft suggests presenting these by location where appropriate, for example separating assets near or within areas important for biodiversity, areas of water stress, or areas where soil condition affects productive capacity (paragraph 31). Companies may also refer to the TNFD disclosure metrics (30(b)).

    Targets with a location attached

    For each nature-related target, a company would describe what it relates to and its location-specific aspects, including which value chain locations it covers (paragraph 34).

    Connection to climate

    The draft asks companies to show connections between nature-related and climate-related risks, for example whether the same assets are exposed to both (paragraphs 13 and 33). If your S2 physical risk work already maps assets to locations, that register is the natural starting point.

    What it means for the finance function

    Read as a controls question, the draft asks for three things finance teams already know how to manage.

    • A register. The two proposed metrics are amounts and percentages of assets or activities. They need a defined population, a denominator that reconciles to something, and a documented basis for classifying each item as vulnerable.
    • Evidence from outside the group. Supplier locations and sourcing data will arrive through requests, with mixed quality. Each figure needs its source, its date and a label where it is estimated.
    • A recorded judgement. Materiality conclusions should be written down with the inputs considered, who made the call and who reviewed it. That record is what you show when someone asks why nature is, or is not, in the report.

    The supplier side matters most for timing. If your sustainability team needs site-level data from suppliers for FY2029, the requests need to go out well before that year-end, and the questions you send will compete with every other customer’s questionnaire. Our post on what your customer’s auditor will test in supplier data sets out the evidence standard to ask for.

    Five steps before the 2027 year-end

    1. Read the draft and decide whether to respond. The consultation asks whether location should be a requirement and whether the two metrics are right. If either would be costly for you, 19 February 2027 is the date to say so.
    2. Extend your S2 asset register. Add coordinates for owned and leased sites, then screen them against water stress and biodiversity sensitivity.
    3. List your material commodities and where they come from. Start with the inputs that drive cost of sales and identify which suppliers hold the location data.
    4. Draft a preliminary materiality view. Record the inputs, the reviewer and the open questions. A dated draft in 2027 is easier to defend in 2029 than a conclusion written at year-end.
    5. Check your principal risks. If water, raw material availability or land use already appear there, the S1 disclosure should follow from them.

    One dataset for climate and nature

    The draft’s emphasis on location and connected information rewards companies that hold climate and nature data in the same place, against the same asset and supplier lists. Running them as separate exercises is how the asset count in a nature metric ends up not matching the one in the physical risk analysis.

    Horizon ESG for finance teams keeps that data at datapoint level, with each site, supplier response and materiality judgement traced to its source and approver. The UK SRS reporting page shows how S1 and S2 requirements map in the platform, and the supplier request side is covered on our page for sustainability teams.

    If you want to see how a site register and a materiality record would sit alongside your S2 data, book a short demo.

    Sources: ISSB Exposure Draft ISSB/ED/2026/1, [Draft] IFRS Sustainability Disclosure Practice Statement 1 Nature-related Disclosures, October 2026 (paragraphs IN6-IN10, 10-11, 13, 30-34, C3); IFRS Foundation project page, Nature-related Disclosures; FCA PS26/19, 30 September 2026. Checked 27 October 2026.

  • UK CBAM: Your Supplier’s Emissions Data Now Has a Price

    UK CBAM: Your Supplier’s Emissions Data Now Has a Price

    Calculation view showing emissions as activity data multiplied by an emission factor, the same structure UK CBAM uses for embodied emissions

    Most ESG data requests arrive with a deadline set by a tender or a customer’s reporting calendar. The UK Carbon Border Adjustment Mechanism (CBAM) brings one with a tax bill attached. From 1 January 2027, every tonne of in-scope steel, aluminium, cement, fertiliser or hydrogen imported into the UK carries a carbon charge, calculated either from the overseas producer’s verified emissions or from a government default.

    On 16 October 2026, HMRC put numbers on both sides of that choice. It published illustrative CBAM rates for each sector and an updated draft of the default values, which carry a 10% markup in every sector except fertiliser. For the first time, a supplier’s actual emissions data has a direct cash value to the company buying from it.

    If you run sustainability at a UK company that imports these goods, the import team will probably come to you for that data. This post covers who pays, how the rate works, what to ask a producer for, and how to keep the evidence.

    Who pays UK CBAM

    The liable person is the importer: the business named on the customs declaration, or the business on whose behalf goods are imported. Using a freight forwarder, customs broker or agent does not move the liability to them.

    Registration is triggered by value. From 1 January 2027 you must register if either test is met:

    • Forward test: you expect to import CBAM goods worth £50,000 or more in the next 30 days.
    • Rolling test: on the first day of each month, your CBAM imports over the previous 12 months reach £50,000. Imports before 1 January 2027 do not count.

    Goods with a UK place of origin are out of scope, as are some scrap products. The UK and EU have committed to linking their emissions trading schemes, and the government says this will exempt EU-origin goods once the link is in place. Until then, check the commodity code of each product line against HMRC’s list.

    How the rate is built

    The charge is embodied emissions multiplied by a sector rate. Embodied emissions are the weight of the imported goods multiplied by an emissions intensity in tonnes of CO2e per tonne of product.

    The rate follows the UK Emissions Trading Scheme. HMRC takes the average UK ETS auction price for the previous quarter and reduces it to reflect the free allowances UK producers in that sector still receive. Its cement example uses a Q3 2026 average price of £58.15, an 87.1% free allocation share and a 2027 phase-out factor of 97.5%:

    £58.15 x [1 - (87.1% x 97.5%)] = £8.78 per tCO2e

    The illustrative rates for the other sectors are £9.69 for iron and steel, £9.79 for aluminium, £9.24 for hydrogen and £1.45 for fertiliser. Three points matter for planning:

    • These are illustrative. HMRC says they show what would apply on current data and are not forecasts. The first official rates, for January to March 2027, will be published before the end of 2026.
    • Rates are reset every quarter as the ETS price moves.
    • The phase-out factor falls over time as free allocation is withdrawn, so the share of the carbon price passed through to importers rises. Today’s modest per-tonne rates are a starting point.

    Why the default values make supplier data worth money

    When calculating embodied emissions, an importer has two options: use the producer’s verified emissions intensity, or use the government default for that commodity code. HMRC’s notice states that “actual verified emissions data is preferable” and that defaults are designed so there is “no advantage” in using them.

    The draft defaults apply from 1 January 2027 to 31 December 2028. They are trade-weighted averages built from EU data, with a 10% markup in every sector except fertiliser. From 2029 the UK plans to move to country-specific defaults, and the markup will be reviewed then.

    A worked example

    Take 1,000 tonnes of unalloyed aluminium slab (CN 76011010). The draft default is 2.058 tCO2e per tonne. At the illustrative aluminium rate of £9.79:

    • Using the default: 2,058 tCO2e x £9.79 = roughly £20,150.
    • The markup alone: about 187 tCO2e of that figure, or roughly £1,830.
    • Using verified data: if the producer’s verified intensity were, hypothetically, 1.6 tCO2e per tonne, the charge would be about £15,660.

    Scale that across a year of shipments and a rising rate, and the case for asking producers for verified data makes itself. It is also a figure your finance director will want to see, because the difference lands in cost of goods.

    What to ask an overseas producer for

    A number in an email will not do. To report actual emissions, you must hold evidence that the data has been verified. If you cannot evidence verification, you must use the default. Ask each producer for:

    1. The installation where the goods were made, and the commodity code of each product.
    2. The emissions intensity in tCO2e per tonne, calculated under the UK CBAM system boundaries, including emissions from any precursor goods for complex products.
    3. The monitoring period. Intensity is reported per calendar year. For goods imported in 2027 you use verified 2027 data, or 2026 data if 2027 is not yet verified.
    4. A verification report or verification summary covering that intensity and period.
    5. The verifier’s details. The verifier must be independent of the installation, accredited by an eligible accreditation body to ISO 14065:2020 and ISO/IEC 17029:2019, and accredited for the right activity. A fertiliser specialist cannot verify a steel plant.

    Start the conversation now. Many producers outside the EU have never been asked for installation-level data, and verification takes time to arrange.

    Keep the evidence where the other requests live

    HMRC requires importers to keep CBAM records for six years, including the verification report behind every intensity reported, with a fixed penalty of £500 for failing to keep records. That makes CBAM evidence one more thing to file alongside the customer questionnaires, lender requests and supplier data you already handle.

    The approach that works for CBAM is the same one we set out for answering customer and lender ESG data requests: one dataset, with every figure carrying its source, period, method and approval. It also mirrors what your own customers’ assurers now expect of you, covered in what your customer’s auditor will test. For the full calendar, see our ESG reporting deadlines page.

    Horizon ESG for sustainability teams holds supplier evidence in that one record, with each verified intensity linked to its report, period and producer. Nova, the built-in assistant, drafts answers only from figures that carry their evidence, labels anything estimated, and nothing goes out until a person approves it. Your finance team gets the same record, which matters when the cost of a default shows up in their numbers; our page for finance teams explains the controls.

    If the import team has already asked you about CBAM, book a short demo and bring a supplier with you. We will show you how a verified intensity sits alongside the rest of your evidence.

    Sources: HMRC, Carbon Border Adjustment Mechanism (CBAM): illustrative CBAM rates and worked example, 16 October 2026; HMRC, The Carbon Border Adjustment Mechanism (Default Values) Force of Law Notice (Draft), updated 16 October 2026; HMRC, CBAM policy summary, updated 16 October 2026; GOV.UK guidance on the importer, registration dates, emissions intensity and record keeping for CBAM. Checked 20 October 2026. Rates and default values are draft or illustrative and may change before 1 January 2027.

  • Supplier ESG Data: What Your Customer’s Auditor Will Test

    Supplier ESG Data: What Your Customer’s Auditor Will Test

    Data lineage view tracing a supplier ESG figure back to its source document, method and approver

    When a customer sends you an ESG questionnaire, it is easy to treat it as a form to fill in and forget. For a growing number of customers, though, your answers go straight into a sustainability statement that an independent assurance provider will examine. Your energy figure becomes a line in their Scope 3 calculation, and their assurer has to be satisfied it is supported.

    That has always been the logic of ISSA 5000, the global sustainability assurance standard. On 25 September 2026, the Committee of European Auditing Oversight Bodies (CEAOB) adopted its technical advice on the EU version of the standard for limited assurance, and it kept the value chain rules unchanged. If you run sustainability at a supplier, this post explains what your customer’s assurer is required to do, why it shows up in your inbox, and how to answer a request so the figure holds up.

    What the assurance standard says about supplier data

    The key passage is paragraph A252 of ISSA 5000, carried into the CEAOB advice word for word. It accepts that a reporting company may struggle to get information from businesses it does not control, and that reporting rules may let it fall back on estimates after reasonable efforts. Then it closes the door on that being an excuse for the assurer:

    “Regardless of any limitations on management’s ability to obtain information from such value chain entities, the practitioner is required to obtain sufficient appropriate evidence about the value chain information reported by management.”

    The standard then describes how the assurer might go about it. Three of those routes lead back to you.

    Your customer’s process for collecting your data gets tested

    Paragraph A290 lists “testing management’s process for obtaining information from value chain components” as a procedure the assurer may use. In practice that means looking at how your customer asked you, what you sent back, and whether what they reported matches it. A questionnaire answered with a bare number and no explanation is weak evidence of a sound process.

    A confirmation alone is not enough

    The same paragraph is blunt about one thing. Where your customer holds no independent records, a confirmation from you “is merely a statement of what is reflected in the records maintained by the component” and does not, taken alone, count as sufficient evidence. The assurer then looks for another source. Very often that means your customer comes back to you for the meter readings, invoices or calculation behind the figure.

    Large suppliers may be asked directly

    Paragraph A251 notes that where the reporting company has a direct business relationship with a value chain entity, “such as a large supplier or customer”, the assurer may ask management to help request information from that source. If you are a significant supplier, expect a follow-up asking how a number was produced.

    We set out the six evidence questions an assurer asks in our post on what ISSA 5000 changes. The same questions now travel down the supply chain.

    Why this reaches you even with the value chain cap

    If your company averages 1,000 employees or fewer, the value chain cap limits what a CSRD-reporting customer can require from you to what the Voluntary Standard covers, from financial years beginning on or after 1 January 2027. We covered the detail in the value chain cap is now law.

    The cap governs how many questions you can be required to answer. It says nothing about how well supported your answers should be. Whatever you provide may still be tested by your customer’s assurer, so a shorter questionnaire carries the same evidence expectations per answer.

    Two more points sharpen this.

    • ISSA 5000 reaches beyond the EU. It applies to assurance engagements covering periods beginning on or after 15 December 2026, wherever the practitioner adopts it. A UK or US customer obtaining voluntary or lender-requested assurance brings the same expectations to your data.
    • Not answering has a cost. The standard recognises that reporting rules may let your customer use “reasonable and supportable information (e.g., publicly available sector-average data)” when it cannot get yours. A sector average knows nothing about the efficiency work you have done, and it becomes the figure your customer reports for you.

    A five-point checklist for every figure you send

    None of this needs a consultant. It needs each answer to carry five pieces of information alongside the number. Build them into your dataset once and every future request becomes faster.

    1. Source document

    Name what the figure comes from: the utility invoices, meter export, fuel card statement, payroll extract or waste contractor report. Keep the documents somewhere you can retrieve them in minutes.

    2. Method

    State how you got from the source to the answer. For emissions, that means the emission factor, its publisher and version, and whether electricity is location-based or market-based. Our guide to when carbon estimates are enough covers how to describe a method plainly.

    3. Period and boundary

    Say which twelve months the figure covers and which sites or entities it includes. A calendar-year figure dropped into a customer’s April-to-March report is a common, avoidable mismatch.

    4. Estimate label

    If any part of the figure is estimated, say so and say how. A labelled estimate with a stated basis is usable evidence. An unlabelled estimate that later turns out to be one damages trust in everything else you sent.

    5. Who approved it

    Record who checked the figure and when, ideally someone other than the person who prepared it. Separating preparer and reviewer is one of the first controls an assurer looks for.

    Keep a log of what you sent to whom, with the version. When a customer’s assurer asks a question six months later, you can answer from the record instead of rebuilding the number.

    One dataset that survives someone else’s audit

    Supplier data now has two audiences: the customer who asked and the assurer who checks. The cheapest way to satisfy both is to answer every request from one evidenced dataset, where each figure already carries its source, method, period and approval.

    Horizon ESG for sustainability teams is built around that dataset. Nova, the built-in assistant, maps incoming questions to answers you already hold and drafts responses with every figure linked to its evidence, labelled where it is an estimate, and sent only after you approve it. The same record serves your own finance team, which is why the number in a customer questionnaire matches the one in your annual report. If your CFO wants to see how that is controlled, our page for finance teams covers it.

    If you have a supplier request on your desk now, book a short demo and bring it with you. We will show you what an answer with its evidence attached looks like.

    Sources: CEAOB technical advice on limited assurance standards for sustainability reporting, adopted 25 September 2026, paragraphs A251, A252, A256 and A290 (each marked unchanged from ISSA 5000); IAASB, ISSA 5000 General Requirements for Sustainability Assurance Engagements; Commission Delegated Regulation (EU) 2026/1560. Checked 13 October 2026.

  • UK SRS Comply or Explain: Writing a Defensible Explanation

    UK SRS Comply or Explain: Writing a Defensible Explanation

    Finance director reviewing UK SRS comply or explain disclosures with the board

    On 30 September 2026 the Financial Conduct Authority published PS26/19, its final rules bringing UK SRS into the listing rules. The consultation had proposed making UK SRS S2, the climate standard, mandatory. The final rules apply comply or explain across the whole framework, climate included.

    It is tempting to read that as a reprieve. For a finance director it is better read as a change in the kind of work. Every gap you choose to explain becomes a published statement, with reasons and a plan, sitting in the annual financial report next to your audited numbers. This post sets out what the final rules require and how to decide, line by line, what to comply with in year one.

    What PS26/19 confirms

    • Start date: accounting periods beginning on or after 1 January 2027, with first reports in 2028. For a calendar-year company, that is under three months away.
    • Basis: comply or explain across UK SRS S1 and S2, including Scope 3. The FCA says this brings S2 into line with what it consulted on for S1 and Scope 3.
    • Who: issuers in five listing categories: commercial companies (UKLR 6), international commercial companies with a secondary listing (UKLR 14), depositary receipts (UKLR 15), non-equity and non-voting equity shares (UKLR 16) and the transition category (UKLR 22). Secondary listing and depositary receipt issuers now report against UK SRS themselves, where the consultation had only asked them to signpost home-country disclosures. Closed-ended funds, shell companies and debt issuers stay out.
    • Transition plans: no company is required to produce one, and no location is prescribed. The rules focus on transparency about whether a plan exists and where to find it.
    • Assurance: still voluntary. A company that obtains it must disclose the provider, the scope, the level (limited or reasonable), the standards used and where the report can be found. No explanation is needed if you have none.

    The headcount of companies in scope has moved with the wider categories, so treat older estimates with care until the FCA’s updated figures settle. Our August overview of UK SRS S1 and S2 was written before the rules were final and now carries an update note.

    The two reliefs, and the line you must write if you use them

    The FCA kept both transitional reliefs it consulted on:

    • Scope 3: no disclosure required for one year from initial application.
    • UK SRS S1 (non-climate): no disclosure required for two years from initial application, which the FCA calls “climate-first” reporting.

    For a calendar-year company, that means S2 without Scope 3 for FY2027, Scope 3 joining for FY2028, and S1 in full from FY2029, all on comply or explain. The final UK SRS also keep a one-year relief allowing an existing greenhouse gas measurement method to continue, and relief from comparatives in the first year.

    Using a relief has one condition. You must state that you are using it in the annual financial report. You do not have to explain why, because using a relief does not engage the explain rules. It is a single sentence, and an easy one to forget.

    What an “explain” actually has to contain

    This is the part most summaries skip. The rule text (UKLR 6.6.6R in the instrument appended to PS26/19) sets out what a company must include when it does not disclose in line with S2, or does so only in part:

    1. a summary of the S2 requirements that have not been met;
    2. the reasons for not making those disclosures; and
    3. any steps the company is taking, or plans to take, to make those disclosures in future.

    The S1 version is tied to the sustainability risks and opportunities the company has identified. If it has identified none, it must say so. Nature is the next test of that identification step, because the ISSB's draft says S1 already catches material nature risks, as we set out in what the nature exposure draft means for UK SRS S1.

    Read as a finance director, that is a three-part disclosure with a forward commitment attached. Next year’s report will be read against this year’s stated steps, so an explanation creates a promise you will be measured on. The FCA also reminds issuers of their duty under DTR 4.1.8R to disclose principal risks and uncertainties. If climate is on your principal risks list, explaining away the S2 disclosures that describe it will be hard to defend.

    The detail is still moving. The FCA is consulting on Technical Note 803.1 in Primary Market Bulletin 66, covering how much detail to give, worked examples, and how comply or explain interacts with the UK SRS statement of compliance. Feedback closes on 28 October 2026, with a webinar on 19 October, and the FCA aims to finalise the guidance before the rules take effect. Until then, treat any explanation template you are offered as provisional.

    Deciding what to comply with in year one

    The useful question for each requirement is whether you can produce a number that survives scrutiny. A weak figure published as compliance is a worse outcome than a clear explanation with a dated plan.

    Comply where finance can already evidence it

    • Scope 1 and 2 emissions. UK-incorporated quoted companies already report these under SECR. The data, the method and the sign-off route exist, and explaining them away would read as a controls weakness.
    • Governance and risk management. These follow the TCFD pillars most listed companies have reported against since 2021 or 2022.
    • Anything already in your principal risks. If the board has said it matters, the disclosure should follow.

    Explain where an honest explanation beats a weak number

    • Industry-based metrics you have never collected and cannot evidence for FY2027.
    • Quantified financial effects of climate risks where the modelling would not survive review.
    • Scope 3 from FY2028, for categories where supplier data is still a spend-based estimate you cannot yet improve. Label the estimate, or explain and commit to a date.

    Four questions for every line

    • Can we trace this figure to a source document and reproduce it?
    • Has someone other than the preparer reviewed it?
    • Does it relate to a principal risk the board has already disclosed?
    • If we explain, what is the step, who owns it and by when?

    The first two are the same tests an assurance practitioner applies, which we set out in what audit-ready ESG reporting actually means.

    Assurance just became visible to investors

    The FCA declined to name ISSA (UK) 5000, but it did require you to disclose whichever standard you used. From 2028, investors will be able to see side by side who assured whose figures, at what level and on what scope. The FCA is keeping mandatory assurance under review.

    If you plan to obtain assurance on FY2027 figures, ISSA 5000 applies to engagements covering periods beginning on or after 15 December 2026. Our guide to what ISSA 5000 changes covers what a practitioner will ask to see.

    Where to start this quarter

    Map each S1 and S2 requirement to one of three outcomes: comply, relief, or explain. Record the reason and owner for each, and draft the explanations now while the TN 803.1 consultation is open. The register you build is your first-year disclosure plan, and the steps column becomes next year’s checklist.

    Horizon ESG for finance teams holds that register alongside the data itself: every figure traced to source, every change logged, and each explanation’s stated steps tracked to completion. The UK SRS reporting page shows how the S1 and S2 requirements map in the platform. Much of the Scope 3 work will land on your sustainability team through supplier requests, and our page for sustainability teams covers that side.

    If you want to test a draft explanation against your own data, book a short demo and we will walk through it with you.

    Sources: FCA PS26/19, “Aligning listed issuers’ sustainability disclosures with international standards”, 30 September 2026 (paras 1.2, 1.7, 1.9, 1.11, 3.6-3.7, 3.14-3.24, responses on transition plans and assurance, and UKLR 6.6.6R in the appended instrument); FCA Primary Market Bulletin 66. Checked 6 October 2026.

  • The Value Chain Cap Is Now Law: What Customers Can Require

    The Value Chain Cap Is Now Law: What Customers Can Require

    Sustainability manager reviewing a customer ESG data request against a single evidenced dataset

    For most of this year, the value chain cap was something you could mention to a customer but not cite. It had been agreed, then adopted, then it sat waiting for publication. That wait ended on 21 September 2026, when the Voluntary Standard appeared in the Official Journal of the EU as Commission Delegated Regulation (EU) 2026/1560. It entered into force on 24 September.

    If you run sustainability at a company with 1,000 employees or fewer, and your week goes on customer questionnaires, this is the most useful regulatory change of the year for you. There is now a published legal text setting out what a CSRD-reporting customer can require from you, and a free official format for answering it. This post covers what the regulation says, where its limits are, and how to use it in the next request that lands.

    What was published, and what it is called

    The regulation is the Voluntary Standard (based on VSME), the European Commission’s reporting standard for companies outside mandatory CSRD scope. It builds on EFRAG’s earlier VSME standard for smaller companies, which is why you will see the two names used interchangeably. Expect procurement portals to start quoting the legal name and the regulation number.

    The standard does two jobs at once:

    • It is a reporting framework you can use now. Any undertaking outside mandatory CSRD scope can report against it from 24 September 2026. It gives you a recognised structure for energy, emissions, workforce, policies and governance.
    • It is the reference point for the value chain cap. The Omnibus I Directive, in force since 18 March 2026, limits what CSRD reporters can demand from smaller partners by reference to this standard. Until the standard was law, that limit pointed at a document still in draft. Now it points at a fixed text.

    EFRAG has said it will release an updated digital template in November 2026, including improvements to its Excel to Inline XBRL converter. If your customers ask for machine-readable data, that is the format to watch.

    What your customer can now require

    The cap is narrow and precise, which is what makes it usable. As summarised by Linklaters from the published text, it works like this:

    • Who it protects: value chain undertakings with an average of 1,000 employees or fewer in the preceding financial year.
    • Who it restricts: companies in CSRD scope, meaning more than 1,000 employees and more than EUR 450m net turnover since the Omnibus, roughly 5,000 companies across the EU.
    • What it restricts: requiring information beyond what the Voluntary Standard covers.
    • What purpose it covers: only information gathered for the requester’s own CSRD reporting.
    • When it bites: from financial years beginning on or after 1 January 2027.

    That last date matters for timing. The standard is available to you today, while the cap applies to your customers’ FY2027 reporting cycle. Requests arriving this autumn for FY2026 data are outside it, though pointing to the regulation now still sets expectations for next year.

    The difference between “require” and “ask”

    The cap stops a CSRD reporter from requiring more. It does nothing to stop them asking. A customer can still send you a 200-question portal. What changes is the status of the questions beyond the standard: you are entitled to decline them for CSRD purposes.

    We covered the buyer’s side of this in what the value chain cap lets companies still ask suppliers, written before publication. The substance has held; what has changed is that you can now cite it.

    What the cap does not cover

    This is where suppliers get caught out. The cap is tied to one purpose, and most of your inbox serves other purposes.

    • Requests required by other laws. The cap does not restrict requests a customer needs to comply with other EU or national obligations. A CBAM importer asking for embedded emissions in the goods you ship them is working under a separate regulation, and the cap does not reach that request.
    • Bank and insurer requests for their own processes. A lender’s credit review or an insurer’s renewal questionnaire is usually about their risk assessment. Those requests sit outside a cap built around a customer’s CSRD statement.
    • Voluntary target programmes. If a customer’s SBTi supplier engagement target means they want your emissions and your reduction plan, that request is driven by their climate target. Our post on SBTi Net-Zero Standard V2 explains why those asks are about to get more demanding.
    • Anything you choose to volunteer. The cap is a right to decline. Using it is always your commercial call.

    How to use it in the next request

    1. Check your headcount on the right basis

    The test is average employees over the preceding financial year. If you sit close to 1,000, confirm the figure with HR and keep the working. A customer’s compliance team may ask for it.

    2. Build your dataset on the Voluntary Standard

    Maintain one dataset structured on the standard, with the evidence attached to each datapoint: the meter reading, the invoice, the policy document, the payroll extract. That is the dataset you can be required to provide, so it should be complete, current and ready to send the same day. Everything else becomes a mapping exercise from it.

    3. Ask what each request is for

    Log every incoming request with its sender and purpose. When the purpose is the customer’s CSRD reporting, the cap applies. When it is a tender, a loan, a CBAM declaration or a climate target, it does not, and you decide on commercial grounds. Asking the question politely often shrinks the request on its own.

    4. Invoke it with a helpful tone

    Something like:

    “We average fewer than 1,000 employees, so for your CSRD reporting our disclosures follow the Voluntary Standard under Delegated Regulation (EU) 2026/1560. Our complete dataset on that basis is attached and answers most of your questionnaire. For the remaining items, could you let us know which you need for purposes other than CSRD reporting? We are happy to look at those.”

    You have answered quickly, answered most of it, cited the law accurately and handed the question of the extra items back to the requester. Our guide to answering customer and lender ESG data requests covers what to do when a customer pushes past the cap anyway.

    5. Put 1 January 2027 in the diary

    Review your standard response in December so it is ready when customers start collecting FY2027 data. If EFRAG’s November template changes the file format your customers expect, that is the moment to switch.

    One dataset, answered once

    The cap rewards the supplier who has a Voluntary Standard dataset ready to send, and it does little for the one who has to assemble answers from spreadsheets each time. Horizon ESG for sustainability teams is built around exactly that: one evidenced dataset, mapped to the standard and to the questionnaire formats you actually receive. Nova, the built-in assistant, drafts answers from that dataset with each figure linked to its source, and nothing is sent until you approve it.

    The same numbers will eventually meet your finance team’s figures, and they need to match. If a customer’s figures are assured, their auditor will test what you sent as well. If your CFO is asking how sustainability data is controlled, our page for finance teams covers that side.

    If questionnaires are eating your week, book a short demo and bring the longest one you have. We will show you how much of it one dataset answers.

    Sources: Commission Delegated Regulation (EU) 2026/1560, published in the Official Journal on 21 September 2026; Linklaters, “EU CSRD: revised ESRS and voluntary reporting standard are published in the Official Journal”, 21 September 2026; XBRL International, 27 September 2026. Checked 29 September 2026.

  • SBTi Net-Zero Standard V2: Assurance Through the Back Door

    SBTi Net-Zero Standard V2: Assurance Through the Back Door

    Horizon ESG science-based targets view comparing a company's annual reduction rate with the rate required for a 1.5C pathway

    In March, a lot of finance teams crossed CSRD off the risk register. The Omnibus raised the threshold to more than 1,000 employees and more than €450m turnover, both tests together, and most mid-sized companies fell out of scope along with the assurance obligation that came with it.

    Some of those companies also hold a science-based target, and the SBTi has just rewritten its rules. Version 2.0 of the Corporate Net-Zero Standard makes independent assurance mandatory for its larger category of company, and its definition of “larger” is far wider than the one in CSRD. This is assurance arriving through a voluntary commitment. Nobody owns it, so nobody budgets for it.

    The dates

    The SBTi published Corporate Net-Zero Standard V2.0 on 11 June 2026. According to the SBTi’s own Main Changes Document, it takes effect on 31 January 2027, followed by a transition period running from Q1 2027 to Q1 2028:

    • From Q1 2027, target validation under V2.0 is available.
    • Until 31 January 2028, companies can still submit targets under V1.3.1 (and the Near-Term Criteria V5.3).
    • From 1 February 2028, every new target submission must align with V2.0.

    Companies that already hold 2030 targets are told to start setting their next cycle (2030 to 2035) under V2.0 from 2028. So the question is when you next submit, and for many companies that is sooner than the 2030 date on the current target suggests.

    Category A: why “we are too small” may not hold

    V2.0 drops the separate SME route and sorts every company into one of two categories. Category A carries the full set of obligations. You are Category A if you meet either of these tests:

    • Any country: net turnover of €450m or more, or 1,000 or more full-time equivalents.
    • High-income countries (using the World Bank classification, which includes the UK): Scope 1 and 2 emissions of 10,000 tCO2e or more, or at least two of a €25m balance sheet, €50m turnover and 250 FTEs.

    Everyone else is Category B. Three details matter for finance. Thresholds are assessed on consolidated group figures, even if your target boundary sits lower in the group. They use the average of your two most recent financial statements. Geography follows the country where the ultimate parent is incorporated.

    Compare that with CSRD. CSRD now needs 1,000 employees and €450m. Category A needs only one of them, and in a high-income country a 300-person business with €60m turnover and a €30m balance sheet qualifies. Plenty of companies that fell out of CSRD scope in March are squarely Category A.

    What Category A has to do

    Assurance, at three points in the cycle

    Criterion CNZS-C7 requires independent third-party assurance of the target base year inventory, at a minimum of limited assurance, covering Scope 1, Scope 2 and Scope 3, low-carbon electricity calculations, significant emissions-intensive activities and any other metric used to set targets. The provider must be an accredited independent third party working to internationally recognised assurance standards. The SBTi says it will set out which frameworks it recognises; in practice many providers will run these engagements under ISSA 5000, the new global assurance standard.

    Any base year recalculation must also be assured (C8.6), as must the data behind your end-of-cycle progress assessment (C37.7). The level of assurance is shown publicly on the SBTi Dashboard.

    A published transition plan

    All companies need a transition plan approved by the board. Category A companies must publish it within 15 months of target validation.

    Scope 3 targets, on a new boundary

    Near-term Scope 3 targets are required for Category A and optional for Category B. The old two-thirds coverage rule is replaced by a significance test: targets must cover every Scope 3 category representing 5% or more of categories 1 to 14 emissions, with limited named exclusions that must be reported and justified.

    The other changes worth knowing

    • Separate Scope 1 and Scope 2 targets replace the combined Scope 1 and 2 target. Scope 2 emissions targets are based on the location-based inventory, with market instruments dealt with separately under a new implementation hierarchy.
    • A target base year built on your latest comprehensive data replaces the historical base year. You can still communicate progress against an earlier year if equivalence is validated.
    • Carbon removals get detailed neutralisation rules on storage durability and double counting, plus a requirement for Category A companies to support removals from 2035.

    One point is widely misunderstood, so it is worth stating plainly: carbon credits still cannot be counted toward your Scope 1, 2 or 3 targets. V2.0 creates a voluntary Ongoing Emissions Responsibility recognition programme for credits and other climate contributions, and the standard says outcomes claimed there cannot be counted toward target implementation or netted from the inventory. Credits sit alongside reductions. They never replace them.

    From “does not apply” to an unbudgeted fee

    A typical case looks like this. The sustainability team set a near-term target in 2022 or 2023. The company is 600 people with €120m turnover, so finance correctly concluded in March that CSRD no longer applies. The next SBTi submission falls in 2028, under V2.0, as Category A.

    Because V2.0 uses your most recent comprehensive data as the base year, a 2028 submission will most likely rest on FY2027 figures. Those figures need limited assurance across all three scopes before validation. FY2027 starts in about three months for a calendar-year company, and the assurance fee and internal time are probably in nobody’s plan.

    Scope 3 is the expensive part. Limited assurance of supplier-derived data, spend-based estimates and emission factor choices tests the documentation behind every number. The practitioner checks that methods are recorded and reproducible and that estimates are labelled. Our post on the six tests an assurance provider actually runs sets out what that looks like in practice.

    What to have in place a year ahead

    • Run the category test now on consolidated, two-year-average figures, and record the result with the workings.
    • Find out when you next submit. Check the SBTi Dashboard and your commitment letter. If it is 2028 or later, plan on V2.0.
    • Treat FY2027 as a probable base year. Fix the boundary and factor sets for the year and attach evidence as data is entered.
    • Re-map Scope 3 against the 5% test and identify which categories will need targets and which exclusions you would have to justify.
    • Talk to an assurance provider this autumn about scope, level and the disclosures they see as high risk.
    • Put the fee and internal time in the FY2027 budget. Where lineage is visible, the practitioner spends less time reconstructing evidence and the fee reflects it.
    • Get the transition plan onto the board agenda, since it needs board approval and, for Category A, publication within 15 months of validation.

    For context on what validation requires under today’s rules, see what SBTi validation actually requires.

    One last point. The SBTi inventory, the numbers in customer questionnaires and any figures in the annual report should come from the same evidenced dataset. When they come from three spreadsheets, the assurance provider will find the gaps before you do.

    Horizon ESG holds datapoint-level lineage, factor source and version on every calculation, labelled estimates, an immutable change log and enforced separation between preparer and approver, the controls a limited assurance engagement on a base year inventory will test. Horizon ESG for finance teams sets out how that works for a controller or CFO. If an SBTi submission is on your horizon, book a short demo and ask us to trace a Scope 3 figure back to its source, live.

    Sources: SBTi Corporate Net-Zero Standard V2.0 (June 2026) and Main Changes Document (11 June 2026); SBTi Corporate Net-Zero Standard page, checked 22 September 2026.

  • Will Your Auditor Accept AI-Generated ESG Data?

    Will Your Auditor Accept AI-Generated ESG Data?

    Horizon ESG emission factor matching screen explaining how each calculation stores the factor used, any unit conversion and a confidence score

    Your sustainability team wants to use AI to match emission factors, fill Scope 3 gaps and draft the narrative. Your assurance provider is due in the spring. Somebody in the finance function has to decide whether those two facts are compatible, and that somebody is usually you.

    The short answer is yes, an auditor can accept figures that AI helped produce. The condition is that the method is visible. Assurance providers do not have a rule against a particular technology; they have a rule against evidence they cannot follow. This piece sets out what that means in practice, where AI creates real control risk, and the four things that make AI output assurable.

    What the assurance standard actually says about AI

    There is no separate test for AI, and that is the useful part. ISSA 5000, the IAASB’s standard for sustainability assurance engagements, applies to periods beginning on or after 15 December 2026. It is risk based. The practitioner identifies where the information could be materially misstated, then evaluates whether the information they are given as evidence is relevant and reliable. That test is the same whether a figure came from a meter, a spreadsheet formula, a consultant or a model.

    So the question your provider will ask is the one they ask of every figure: where did it come from, what method produced it, who checked it, and can it be reproduced? We set those questions out in detail in what ISSA 5000 changes. AI output passes or fails on exactly the same basis.

    Where AI gets into trouble is when it makes those questions harder to answer. A number that appears in a cell with no record of the prompt, the source data, the factor chosen or the person who accepted it is unassurable. The model is irrelevant to that finding. The missing trail is the whole of it.

    Where the control risk really sits

    Three uses of AI in ESG reporting carry most of the risk, and each has a clear failure mode.

    Emission factor matching

    Matching thousands of purchase lines or activity records to the right factor is slow, error prone work, and a sensible job to automate. The risk is a match that looks plausible and is wrong: the wrong geography, an outdated factor year, a spend-based factor where an activity-based one existed. If the chosen factor, its source and its version are stored on the calculation, a reviewer can catch that and a practitioner can test it. If they are not, the error is invisible until someone recalculates.

    Estimates for missing data

    Scope 3 cannot be reported without estimation, and practitioners know it. The GHG Protocol Scope 3 Standard already expects companies to describe their data sources and data quality. What draws a finding is an estimate presented with the confidence of a measurement. An AI estimate that is labelled as an estimate, with its basis shown, is a normal part of the engagement. The same number sitting unlabelled next to metered data is a misstatement risk. Our earlier guide to managing carbon reporting estimates covers the labelling side.

    Narrative drafting

    Generated narrative can state things the data does not support: a reduction that was really a boundary change, a policy that exists only in draft. Where narrative sits inside the scope of the engagement, every factual claim in a drafted paragraph needs to tie back to a datapoint or a document, and a named person needs to have approved it.

    Four conditions that make AI output assurable

    If you are setting policy for your team, or assessing a platform, these are the controls to insist on.

    • Every estimate is labelled. Measured, calculated and estimated figures are distinguished in the dataset and in the report, with the basis of each estimate recorded where the figure sits.
    • Factor sources and versions are visible. The factor set, its year and version, any unit conversion and, where the system produces one, a confidence score are stored on the individual calculation. A methodology note written at year end is a poor substitute.
    • AI output goes into the same audit trail as manual entry. One change log, one lineage chain. If AI suggestions live in a separate tool and are pasted in, the trail breaks at the exact point the practitioner will want to test.
    • A human approves before anything reaches a report. Mandatory approval, enforced by the system, by someone other than the preparer. AI output that can reach a disclosure without review is the single fastest way to lose the argument with your provider.

    Notice that none of these are AI controls. They are the controls you would apply to any preparer. Treat the model as a fast junior analyst whose work is always reviewed, and the assurance position largely follows. The six tests an assurance provider runs apply unchanged.

    The sustainability of AI objection

    Someone on your board or in your sustainability team will ask whether using AI to report on emissions creates emissions of its own. It does, and it is worth answering plainly. Model inference uses electricity and, through data centre cooling, water. The International Energy Agency’s Energy and AI report (April 2025) estimated data centres used around 1.5% of global electricity in 2024, with AI a fast growing share.

    For a reporting workload the relevant comparison is with the process it replaces: weeks of manual matching, reconciliation and rework across a reporting cycle, plus the travel and consultant time that often comes with it. The footprint of the inference involved is small against that, though it is not zero, and a credible reporting team says so. If it matters to your stakeholders, ask your provider where its models run and on what energy.

    What to do before your next engagement

    • Tell your provider now which parts of the process use AI. It is a planning conversation, and they will want to scope procedures around it.
    • Write a short AI use policy covering which tasks are permitted, who approves output, and how estimates are labelled.
    • Run a trace test on AI-assisted figures. Pick five and follow each back to its source data, factor and approver. Any figure you cannot trace in a minute is on the remediation list.
    • Keep the two teams on one dataset. If the sustainability team answers customer questionnaires with AI-assisted figures from one place and finance assures figures from another, the numbers will drift apart.

    That last point is where most AI risk actually surfaces. When you are comparing ESG platforms on their audit trail, check whether AI output lands in the same trail as everything else.

    In Horizon ESG, the intelligence layer is called Nova. It speeds up collection and factor matching, and every output it produces is sourced, labelled, editable, and recorded in the same audit trail as manual entry, with human approval required before it reaches a report. You can read more on how Nova works, or see the controls from the finance side on Horizon ESG for finance teams. The most useful test is a live one: book a short demo, pick an AI-assisted figure, and ask us to show its working.

  • ISSA 5000: What the New Assurance Standard Changes

    ISSA 5000: What the New Assurance Standard Changes

    Horizon ESG calculation view showing activity data, the emission factor applied and its source and version for a single figure

    Somebody will mention ISSA 5000 in your next audit planning meeting, if they have not already. Its date sits inside your next reporting cycle, and the question that follows is the one finance always gets: what does it cost, and what do we need to have ready?

    The short answer is that ISSA 5000 does not change what your company reports. It changes how the people assuring those figures are required to work, and that lands on your evidence rather than your arithmetic. Here is what the standard is, when it applies, what the practitioner will actually test, and what to have in place a year before fieldwork.

    What ISSA 5000 is

    ISSA 5000, General Requirements for Sustainability Assurance Engagements, is the International Auditing and Assurance Standards Board’s (IAASB) global standard for assuring sustainability information, published in November 2024. Three design choices matter for you:

    • It is framework neutral. It applies whether the information is prepared under ESRS, the ISSB standards (and therefore UK SRS), GRI, the GHG Protocol or a voluntary basis.
    • It covers both limited and reasonable assurance, with the work effort for each set out separately.
    • It is profession agnostic. Accounting firms and non-accountant providers can both use it, whoever you appoint.

    Because it governs the engagement rather than the obligation, it applies to voluntary assurance too. If a lender or customer asks for assured figures and you commission a provider, that engagement will be run to ISSA 5000 once it is in force.

    The date, and why it is closer than it looks

    ISSA 5000 applies to assurance engagements on sustainability information reported for periods beginning on or after 15 December 2026, or as at a specific date on or after 15 December 2026. Early application is permitted.

    For a calendar-year company, the first period fully under the standard is FY2027. The controls that produce the FY2027 figures need to be operating from 1 January 2027, and the evidence the practitioner will sample is created throughout that year, not assembled at the end. Planning conversations with a provider usually start in the autumn before the period begins, which is now.

    The regulatory picture around the standard is still settling. In the EU, the Omnibus package removed the Commission’s power to mandate reasonable assurance under CSRD; the delegated act on limited assurance is now due by 1 July 2027, with CEAOB advice on EU add-ons and carve-outs to ISSA 5000 due 30 September 2026 (Commission letter to CEAOB, 27 January 2026). Australia is consulting on scrapping or delaying its move to reasonable assurance, closing 2 October 2026. California has made assurance optional for its 2026 cycle only. The pattern is the same everywhere: limited assurance, kept permanently, done properly. And since CSRD now reaches only around 5,000 companies after the March 2026 threshold change, for most readers the driver is a lender, a customer or a voluntary target, not a regulator.

    Limited versus reasonable assurance

    The way ISSA 5000 draws this distinction determines how much evidence you will be asked for.

    Limited assurance

    The practitioner assesses risks of material misstatement at the level of the disclosure, then designs procedures that respond to them. The conclusion is negative in form: nothing has come to their attention that suggests the information is materially misstated. Enquiry and analytical review carry more weight, but for a high-risk disclosure such as a Scope 3 estimate the practitioner is still required to obtain evidence, not simply ask.

    Reasonable assurance

    Risks are assessed at the assertion level for each disclosure, the financial audit model: completeness, accuracy, cut-off, classification. That means more testing, more evidence, and where the practitioner intends to rely on your controls, testing that they operated throughout the period. The conclusion is positive in form. Most first engagements are limited assurance, and in the EU and Australia that now looks like the destination rather than a stepping stone.

    The point for planning: the gap between the two is a gap in evidence and controls testing, not in the numbers. A dataset with datapoint-level lineage and enforced approval can be stepped up from one to the other. One built from spreadsheets cannot reach either without reconstruction. We covered the engagement mechanics for in-scope EU reporters in our earlier piece on what limited assurance means and how to prepare.

    What the practitioner actually tests

    The misunderstanding that costs the most money is the belief that the provider recalculates your totals. They do not. ISSA 5000 is risk-based: the practitioner works out where the information could be materially wrong, then tests the process, documentation and controls that would prevent or detect that. The engagement is a sequence of questions, each needing evidence behind the answer:

    • Where did this figure come from? A disclosed number is followed back through the calculation to the activity data and the source document. They want the invoice attached to the figure, not a folder that contains it somewhere.
    • Which method and which factor version? The factor set, its year, the boundary and any allocation rule need to sit on the figure at the point of calculation, not in a methodology note written afterwards.
    • Who changed it, when, and why? A change history that cannot be edited or cleared, showing the original value alongside any correction.
    • Who approved it, and was it the person who prepared it? Segregation of duties is a control they will test if they intend to rely on it, and a policy document is not a control.
    • Is this a measurement or an estimate? Estimates are expected in Scope 3. What the practitioner objects to is an estimate presented with the confidence of a meter reading. Labelled data quality and a stated basis turn a potential finding into a normal conversation.
    • Can last year be reproduced? Comparatives get tested. If factor updates overwrite prior periods, every restatement query becomes an argument.

    We set these out as a checklist, with the one demo request that settles whether a platform can do them, in our post on the six tests an assurance provider actually runs.

    Twelve months ahead: what to have in place

    • Speak to your provider before the period starts. Agree the scope, the assurance level and which disclosures they consider high risk; that tells you where to concentrate.
    • Fix the boundary and the factor sets for the period and record them where the calculation happens.
    • Attach evidence as data is entered. Source documents linked to datapoints in January are evidence; the same documents gathered the month before fieldwork are a project.
    • Assign preparer and approver roles and let the system enforce them, so the control is testable rather than asserted.
    • Label estimates and close prior periods, so comparatives can be regenerated on the methodology that applied then.
    • Run the trace test yourself. Pick ten disclosed figures at random and follow each back to its source. Anything over a minute is on the remediation list.
    • Budget for it. The fee is driven less by the complexity of your numbers than by how much fieldwork goes on reconstructing evidence; where lineage is visible the practitioner samples less. Put the fee and the internal time in the FY2027 plan now.

    One last point. If your sustainability team answers customer questionnaires from a different dataset to the one you will have assured, the two will diverge. One evidenced dataset feeding both closes that gap.

    Horizon ESG holds datapoint-level lineage, an immutable change log, enforced separation between preparer and approver, factor version on every calculation, and reproducible prior periods: the controls described above. Our ISSA 5000 page sets out what is available today and what we are still building. If FY2027 is your first period under the standard, book a short demo, pick a figure, and ask us to trace it live. Horizon ESG for finance teams is built for that request.

  • What Audit-Ready ESG Reporting Actually Means: 6 Tests

    What Audit-Ready ESG Reporting Actually Means: 6 Tests

    Horizon ESG data quality view showing emissions split by measured, spend-based and estimated sources with an aggregate uncertainty range

    You have sat through the demo. Somewhere around slide four the words “audit-ready” appeared, and nobody in the room could have told you what they meant. Every sustainability platform now makes the same claim, which means the claim itself carries no information.

    If you run finance, you already know what the phrase should mean, because it is the standard your own numbers are held to: a controls environment that an auditor can test, not a spreadsheet that happens to be tidy. This piece applies that standard to sustainability data: the six things an assurance provider actually examines, and the one demo request that tells you in under a minute whether “audit-ready” is a capability or a slide.

    Assurance is a controls problem, and that makes it yours

    The shift that matters is not a new disclosure standard. It is that sustainability figures are now being tested the way financial figures are. Limited assurance is already live for the largest CSRD reporters, and ISSA 5000, the IAASB’s sustainability assurance standard, applies to engagements covering periods beginning on or after 15 December 2026. In the UK, lenders and listed customers are asking for evidence behind supplier numbers whether or not any regulation requires it.

    What an assurance provider does with your sustainability report is worth being precise about. They do not recalculate your totals. They test whether the process that produced the totals is documented, controlled and reproducible: where each number came from, who touched it, what method was applied, and whether the same inputs would give the same answer again. That is an audit of controls, and controls are the discipline finance already owns. We covered the engagement itself in our earlier piece on what limited assurance involves and how to prepare; this post is about what the platform underneath it has to do.

    The six tests an assurance provider actually runs

    Use these as a checklist. A platform that fails two or three will still produce a report, but the assurance fee rises to cover the extra sampling, and the gaps are found on your time rather than the vendor’s.

    1. Evidence attached at datapoint level, not in a folder

    The auditor picks a number, say Scope 2 electricity for one site, and asks to see the invoice, the meter reading or the utility export behind it. The test passes if that source is attached to that datapoint, with the extracted value visible against the document. It fails if the answer is a shared drive called “Evidence FY2025” containing 400 PDFs. Vouching a figure to its source should take seconds, not a search.

    2. An immutable change history

    Every figure needs a record of who changed it, when, from what value to what value, and why. A “last modified” timestamp is not a change history. Neither is a log that an administrator can edit or clear. Ask to see the history of a figure that was corrected mid-year and check that the original value is still visible alongside the correction and the reason given for it.

    3. A prior period reproduced on the methodology that applied then

    This is the test most platforms fail quietly. Emission factors are updated every year. If the platform overwrites the old factor with the new one, last year’s published total can no longer be regenerated, and a restatement query from your auditor turns into an argument you cannot win. The control you want is versioned factors and closed periods: ask the vendor to regenerate FY2024 as it was reported, on the FY2024 factor set, while FY2025 runs on the current one.

    4. Methodology and factor versions recorded with the figure

    Which factor set was used (the DEFRA year, the grid factor source, the database version), which organisational boundary, which allocation rule for shared sites. These need to sit on the datapoint, captured at the moment of calculation, not in a methodology document written afterwards from memory. When the auditor asks “why does this factor differ from the one in the note”, the answer should be on screen.

    5. Segregation of duties enforced by the system

    Preparer, reviewer and approver should be different people, and the platform should refuse to let the person who entered a figure sign it off. A policy that says this is nice; a system that enforces it is a control. Sign-off should be recorded with the name, the date and what was approved, exactly as you would expect for a journal above the approval threshold.

    6. Estimates labelled as estimates

    Assurance providers do not object to estimates. Spend-based proxies and modelled figures are normal in Scope 3. What they object to is an estimate presented with the same confidence as a meter reading. Every figure should carry its data quality (measured, spend-based, modelled) and the report should show the aggregate uncertainty that results. This is also where built-in intelligence earns its place, provided it is bound to evidence: in Horizon ESG, anything Nova drafts or estimates is labelled as such, carries its sources and factor versions, and waits for a named human to approve it in the same audit trail as a manual entry. An estimate nobody can distinguish from a measurement is a finding waiting to happen.

    The one request that settles it

    Checklists can be rehearsed. So once the vendor has finished, make this request, in these words:

    “Trace a published figure back to its source document, live, without preparation.”

    Pick the figure yourself. A pass looks like this: the presenter clicks the total, the calculation opens showing activity data and the factor with its version, the source file is one click further, the change log and the approver’s name are visible, and the whole thing takes under a minute. A fail sounds like “we would need to set that up”, “let me show you the evidence folder”, or a quiet switch to a spreadsheet. You will know which you have seen, and so will your auditor.

    What this does to cost

    Two costs move when the six tests are met. The assurance fee falls, because the provider samples less when lineage is visible and can rely on system controls rather than substantive testing. And the internal cost becomes predictable, because year two is the same process as year one instead of a fresh reconstruction. The platform fee is a line item; the reconstruction is what quietly eats a quarter of someone’s year. If you are comparing vendors on this, our comparison of ESG reporting platforms on audit trail and lineage sets out where each one, including ours, is stronger and weaker.

    Twelve months ahead: what to have in place

    • Agree the boundary and the factor sets for the period now, and record them where the calculation happens.
    • Close prior periods so that FY2024 and FY2025 can be regenerated as published.
    • Assign preparer and approver roles per datapoint group and let the system enforce them.
    • Attach source documents as data is entered, not in the month before fieldwork.
    • Run the trace test internally on ten figures picked at random. If any fail, that is your remediation list.

    One last point. The numbers your sustainability officer sends to customers and lenders in questionnaires need to match the numbers you publish. Produced from different sources, they diverge, and a customer noticing is the worst way to find out. Our piece on answering customer and lender data requests covers that side; one evidenced dataset feeding both is what closes the gap.

    If you want to see the six tests against real data, Horizon ESG for finance teams is built around datapoint lineage, enforced approval and versioned factors. Book a short demo, pick a figure, and make the request above. We would rather you asked it of us first.

  • How to Answer Customer and Lender ESG Data Requests

    How to Answer Customer and Lender ESG Data Requests

    One ESG dataset mapped to multiple reporting frameworks and questionnaire formats in Horizon ESG

    Somewhere in your inbox right now there is an ESG questionnaire you have not opened yet. It might be from a customer’s procurement portal, from your bank’s annual credit review, or from an insurer’s renewal pack. Each one uses a different format, asks slightly different versions of the same questions, and lands with a deadline that has nothing to do with any regulation.

    If that describes your week, this piece is for you. It covers why the requests keep multiplying even though the EU just cut its reporting rules back, the legal ceiling on what your customers can now require of you, and how to stop answering every request from scratch.

    Update, 30 September 2026: The voluntary standard behind the cap is now EU law. It was published in the Official Journal on 21 September 2026 as Commission Delegated Regulation (EU) 2026/1560, so you can cite it by number. Our follow-up sets out what customers can now require and what they can only ask.

    Why the requests keep coming when the regulation went away

    On 18 March 2026 the Omnibus I Directive came into force and CSRD shrank dramatically. The threshold is now more than 1,000 employees and more than EUR 450m net turnover, both tests together, which cut the reporting population from roughly 50,000 companies to roughly 5,000 across the EU.

    If your company fell out of scope, you might reasonably have expected the questionnaires to slow down. They have not, and the reason is structural. The 5,000 companies still in scope are the largest buyers, banks and insurers in Europe, and their obligations cover their value chains: your emissions, your energy mix, your workforce data, your policies. Banks need supplier and borrower data for financed emissions. Insurers ask at renewal. Procurement teams have embedded ESG scoring in tender processes that are not going to be unwound because a directive changed.

    The obligation did not disappear. It moved, from the regulator to your customers. And that changes the nature of your deadline: it is a tender date, a contract renewal, a credit review. Nobody in Brussels set it, and nobody in Brussels will extend it.

    The value chain cap: the ceiling on what they can require

    Here is the part most suppliers still have not heard. The same Omnibus package that shrank CSRD also gave you a statutory ceiling. If your company has fewer than 1,000 employees, a CSRD-scope customer cannot require you to provide sustainability information beyond what the voluntary VSME standard covers. The European Commission adopted the VSME-based voluntary standard on 3 July 2026, and for CSRD reporters the cap bites from financial year 2027.

    We unpacked the legal mechanics in our earlier piece on what the value chain cap lets buyers still ask suppliers, written for the company sending the questionnaire. This post is the other side of the conversation: what to do when you are the one receiving it.

    Three things to hold onto. First, the cap limits what a customer can require for their CSRD reporting; it does not stop them asking for more, but they must identify which parts of a request go beyond the cap and tell you that you are entitled to refuse those parts. Second, the cap does not stop you volunteering more if it is commercially worth it. Third, the cap is only useful to you if you actually have a VSME dataset to point at, which is the real work.

    How to invoke it without souring the relationship

    The cap is a boundary, not a weapon, and the tone that works is helpful-with-a-ceiling. Something like:

    “We have fewer than 1,000 employees, so under the Omnibus I value chain cap we maintain our sustainability data against the VSME standard. Our full VSME dataset is attached and covers most of your questionnaire. Could you confirm which of the remaining items you need for purposes other than CSRD reporting, and we will see what we can do?”

    You have answered fast, answered most of it, stated the legal position without threatening anyone, and moved the burden of justifying the excess back to the requester. That is a very different conversation from either silence or a flat refusal.

    One dataset, many formats

    The deeper fix is to stop treating each questionnaire as a document to be written and start treating it as a view of a dataset you already maintain.

    The VSME standard is the natural spine for that dataset, because it is now the reference point for what you can be required to provide. Build it once: energy and emissions, workforce basics, policies, certifications, incidents. Attach the evidence to each datapoint, not to a folder, so that every answer you send out carries its source with it. Then each new request, whatever the format, becomes a mapping exercise rather than a writing exercise.

    The consistency matters as much as the speed. When five people answer five portals from memory and spreadsheets, the same question eventually gets five slightly different answers, and one of them ends up contradicting the number your company published elsewhere. One maintained dataset is what prevents that.

    This is the problem Horizon ESG’s sustainability team workspace is built around: one evidenced dataset, mapped to the frameworks and questionnaire formats you actually get asked for. Nova, the built-in assistant, drafts questionnaire answers from that dataset, with every figure traced to its source and every draft held for your approval before anything leaves the building.

    When a customer asks for more than the cap allows

    It will happen, usually because the person running the portal has never heard of the cap. A short sequence to work through:

    • Check the purpose. The cap governs requests made for CSRD reporting. Data requested for contract qualification, product compliance or the customer’s own risk management sits outside it. Ask which is which; the question itself often shrinks the request.
    • Ask them to flag the excess. A CSRD-scope buyer asking beyond the cap is supposed to identify which items exceed it and tell you they are optional. If they have not, asking them to do so is entirely reasonable.
    • Decide commercially, not defensively. The cap gives you a right to decline, not a duty. If a strategic customer wants two extra datapoints and you can produce them from your dataset in an hour, volunteer them.
    • Counter-offer the dataset. “Here is our complete VSME dataset now; the remaining items would take us six weeks” gives the requester something to bank immediately and usually ends the conversation.

    The commercial cost of answering slowly

    It is tempting to treat questionnaires as overhead to be minimised. The evidence in front of most sustainability officers points the other way: the requests you are receiving are attached to revenue and to the cost of capital. From January 2027, UK CBAM adds a tax bill to some of them: a UK importer’s charge on steel, aluminium, cement, fertiliser or hydrogen depends on the overseas producer’s emissions data. A tender response that misses the portal deadline is a bid not scored. A slow answer to a bank’s ESG review does not usually lose the loan, but sustainability-linked facilities increasingly tie margin to data quality, and “supplier could not evidence their numbers” is a phrase that shows up in credit files.

    Being easy to buy from is the quiet advantage here. The supplier who returns a complete, evidenced, consistent dataset in two days is doing more for renewal season than most marketing budgets.

    One dataset, two audiences

    A last point worth raising internally: the numbers you send to customers and lenders need to match the numbers your finance team publishes. When the two are produced separately, they eventually diverge, and a customer noticing the difference is the worst possible way to find out. If your CFO is starting to ask assurance-flavoured questions about sustainability data, that is the same problem from the other end; our page for finance teams covers that side.

    If your week is currently being eaten by questionnaires, book a short demo and bring your worst one. Answering it from one dataset is the fastest way to see the point.

Book Your Free Demo