CSRD: preparing for a deluge of sustainability disclosures

The Corporate Sustainability Reporting Directive, or CSRD, will be applicable from 2024, the year in which relevant corporates will need to gather and prepare the sustainability data and information they will publish in their 2025 annual reports or dedicated sustainability publications. Over time, the CSRD will apply to a much larger number of companies which is why it's important to understand what's involved.

The CSRD is one of a number of EU sustainability measures
The CSRD entered into force on 5 January 2023 and is a piece of the complex puzzle put in place by the European Union to enforce global environmental, social and governance (ESG) matters. The Directive aims to help investors and other interested parties to evaluate the sustainability performance of companies as part of the European Green Deal. The EU unveiled its Green Deal in December 2019. The comprehensive plan sets broad objectives for 2030 and the goal of climate neutrality by 2050. The targets require the transformation of the EU's economy and society to a sustainable model that reduces greenhouse gas emissions while reinforcing the bloc’s economic prosperity.

First introduced in 2014 and revised in 2017, the Non-Financial Reporting Directive (NFRD) aims to increase the transparency and accountability of corporates on non-financial issues such as environmental performance, social themes, and governance. It requires companies to describe their business model, strategy, and performance in relation to sustainability, and to disclose any significant risks or opportunities related to sustainability that may affect their business. Reporting on their policies and due diligence processes to identify and prevent human rights and environmental issues throughout the whole value chain is also essential.

The NFRD applies to certain large companies that are listed on EU-regulated markets (or otherwise a public interest entity) and have more than 500 employees. The disclosures on ESG issues can be done by corporates in their annual reports, separate sustainability reports or on their websites. The information must be accurate, consistent, and comparable over time so that investors and other stakeholders can use it to make informed decisions. The enforcement of the NFRD is the responsibility of each EU member state. Each country can define the penalties for non-compliance with the regulation. While some impose fines and sanctions, others use reputational risks to encourage corporates to comply with the requirements.

Criticised for its limited scope, the European Union replaced the NFRD with the CSRD which will introduce more comprehensive and harmonised requirements across Europe.

The CSRD not only introduces more detailed sustainability reporting requirements but also extends the scope of the reporting requirements to all large companies, regardless of whether they are listed or not. In the medium term, listed small and medium-sized enterprises (SMEs) will also be subjected to the reporting requirements as well as non-EU companies that have significant activities in the EU.

• From 2025 (FY 2024): large “public interest” companies with 500 employees or more and with EU-regulated market-listed securities will need to report on CSRD requirements for the past financial year.
• From 2026 (FY 2025): All large companies and group parent companies meeting two of the following tests: (a) balance sheet total exceeding €20m, (b) net turnover exceeding €40m, and (c) more than 250 employees.
• From 2027 (FY 2026): Small and mid-size companies (excluding "micro-enterprises") with securities listed on EU-regulated markets, small and non-complex institutions, and captive insurance and captive reinsurance companies. Listed SMEs then still have the possibility of opting out of the sustainability reporting requirements for a period of two years if they clarify why the information has not been provided. Non-listed SMEs always have the possibility of using the proportionate sustainability disclosure standards applicable to listed SMEs on a voluntary basis.
• From 2029 (FY 2028): EU branches with a net turnover of €40m or more and EU subsidiaries of non-EU companies that at a group level (or if not applicable individual level) generate a net turnover of more than €150m.

The format of the sustainability reporting standards, the European Sustainability Reporting Standards (ESRS), is drafted by the European Financial Reporting Advisory Group (EFRAG). As discussed in more detail in the remainder of this article, the CRSD requires reporting under a double materiality perspective with an increased focus on targets and forward-looking information. CSRD companies are also subject to Taxonomy related disclosures.

The European Financial Reporting Advisory Group (EFRAG) shared the first set of draft European Sustainability Reporting Standards (ESRS) with the European Commission on 22 November 2022. These mandatory reporting standards should be adopted by the Commission as a delegated act by June 2023, upon the consultation of the EU member states and various EU bodies, such as the European Supervisory Authorities (ESAs) and the ECB. The European Commission will adopt separate delegated acts with sustainability reporting standards for listed SMEs and for third-country undertakings by 30 June 2024.

Importantly, in developing the ESRS, the EFRAG has pursued alignment with the Global Reporting Initiative (GRI) standards and with the International Sustainability Standards Board (ISSB) standards (IFRS sustainability standards). The European Commission will review the sustainability reporting standards every three years, by considering relevant developments including on international standards.

Different disclosure layers
The required sustainability information is reported as part of a company’s management report. The three main sustainability matters (environmental, social and human rights, and governance) form the key topics on which companies will report through different disclosure layers (sector-agnostic, sector-specific and entity-specific).

• The sector-agnostic disclosure requirements are applicable to all companies, independent of the sectors in which they operate.
• The sector-specific disclosure requirements apply to all companies within a specific sector. These standards still need to be developed and should address the impacts, risks and opportunities not sufficiently covered by the sector-agnostic requirements.
• The entity-specific disclosures offer companies the opportunity to provide additional entity-specific material sustainability information, insufficiently captured by any of the sustainability reporting standards. These disclosures should become less important once the sector-agnostic and sector-specific standards evolve.

The sector-agnostic disclosure requirements
The first set of draft ESRS of November 2022 covers the sector-agnostic disclosures and explains when companies can include entity-specific disclosures. The ESRS is comprised of two cross-cutting standards and ten topical ESRS. The cross-cutting standards, ESRS 1 (general requirements) and ESRS 2 (general disclosures) apply to all three key sustainability matters (environmental, social, and governance). The ten topical ESRS organise the disclosure requirements in more detail per sustainability matter.

The general requirements - ESRS 1
The ESRS 1 details the general requirements companies need to comply with for the purpose of their sustainability disclosures. They categorise the different disclosure standards and work out how companies should report, by considering concepts such as double materiality, sustainability due diligence, value chain reporting and reporting periods.

Double materiality means that a company, within its sustainability disclosures, not only has to consider the impact of its own actions on environmental, social and governance matters but also the relevant (financial) risks and opportunities to the company arising from environmental, social and governance factors. Put simply, it is not only about how companies impact the world around them (external view) but also about how their business is impacted by the world around them (internal view).

Sustainability due diligence refers to the company processes carried out to identify, monitor, prevent, mitigate or address the adverse impacts connected with a company’s activities. The ESRS due diligence disclosures will form the reporting angle to the due diligence disclosure duties of the Corporate Sustainability Due Diligence Directive (CSDDD) as proposed by the European Commission in February 2022.

Sustainability disclosures should also include value chain reporting on the material impacts, risks and opportunities of a company’s direct and indirect business relationships in the upstream and/or downstream value chain. If value chain information is not available, for the first three years of reporting companies should explain their efforts to obtain this information. They should also explain the reasons why the information could not be obtained and share plans on how to obtain it in future.

The sustainability information should consider short-term (reporting period for the company’s financial statement), medium-term (from the short-term reporting period up to five years) and long-term (more than five years) time horizons. Companies also need to show the connection between the retrospective and forward-looking sustainability information they include in their sustainability statement.

The ESRS cover 84 different disclosure requirements through 1144 data points. The ESRS 2 (general disclosures) provide for two ‘basis for preparation’ disclosure requirements. These disclosures should explain how the company prepared its sustainability statement and which specific circumstances were considered. Moreover, the ESRS 2 sets 14 disclosure requirements on four key reporting areas:

1. Governance (GOV).
2. Strategy and business models (SBM).
3. Impact, risk and opportunity management (IRO).
4. Metrics and targets (MT).

The latter two reporting areas (IRO and MT) include four disclosure content requirements, describing the content that should be included when a company reports on its ESG policies, actions, metrics and targets. These requirements are further addressed by the topical ESRS and the sector-specific ESRS.

The topical ESRS list 70 separate reporting requirements, mostly covering disclosures on the relevant policies, actions, metrics and targets. They also include 18 additional specific requirements that apply jointly with certain ESRS 2 disclosures requirements, such as GOV-1 (the role of the administrative management and supervisory bodies), GOV-3 (integration of sustainability-related performance in incentive schemes), SBM-2 (interest and views of stakeholders), SBM-3 (material impacts, risks and opportunities and their interaction with strategy and business models), and IRO-1 (description of the processes to identify and assess material impacts, risks and opportunities).

ESRS 2 general disclosures
Together with the topical standards, the ESRS 2 (general disclosures) give further body to the Accounting Directive’s new Article 19a and Article 29a requirements as amended through the CSRD. They work out several reporting requirements in the field of due diligence processes (GOV-4) and on principal actual or potential adverse impacts (SBM-3), as well as on incentive schemes linked to sustainability matters (GOV-3) and the provision of value chain information (SBM-1).

The CSRD also requires disclosure of transition plans.

The CSRD also requires disclosure of transition plans. These plans detail the actions and financial and investment plans of the company, ensuring that its business model and strategy are compatible with the 1.5°C global warming target of the Paris Agreement, and the 2050 climate neutrality objective of the EU Climate Law. If relevant, the company will also disclose its exposure to coal-, oil- and gas-related activities. The transition plan requirements return in two topical ESRS, namely E1-1 and E4-1, on climate change mitigation and on biodiversity and ecosystems.

Transition plans are complemented by time-bound targets related to sustainability matters (DC-T). When appropriate, these define the absolute greenhouse gas emission reduction goals at least for 2030 and 2050. They also include a description of the progress made towards achieving these targets and a statement of whether the environmental targets are based on conclusive scientific evidence.

While sustainability reporting standards still need to be developed for SMEs, proportionate to their capacities and scale, the new Article 19a(6) of the Accounting Directive does leave out disclosures related to time-bound targets, incentive schemes, the role of the administrative, management and supervisory bodies on sustainability matters, and the due diligence process for SMEs. These disclosures are mostly covered by ESRS 2 GOV 1-4.

EU legislation data points (ESRS 2 Appendix C disclosures)
The mandatory disclosure of the ESRS 2 Appendix C data points ensures that the necessary information is provided to meet other EU regulatory requirements, such as:

1. The Sustainable Finance Disclosure Regulation (SFDR) principal adverse impact (PAI) disclosures.
2. The Capital Requirements Regulation (CRR) Article 434a (Pillar 3) disclosures.
3. The information on exclusions from the Paris-aligned benchmark and on ESG factors to be considered by underlying assets under the EU Benchmark Regulation.
4. Disclosures related to the EU Climate Law’s net-zero target.

The ESRS facilitate disclosures needed for other EU regulatory requirements.

The ESRS 2 (general disclosures) and ESRS E1 (climate change) data points are already covered through the mandatory disclosure of these ESRS. The other data points subject to mandatory disclosure ensure that information is provided on (other) environment-related indicators such as the generated tonnes of emissions to water, or the hazardous waste ratio of the company. They also facilitate disclosure on social and employee matters, such as the unadjusted and weighted average gender pay gap or violations of the UN Global Compact principles and OECD guidelines for multinational enterprises.

ESRS E1 (climate change) disclosures
The ESRS E1 (climate change) disclosures provide insight into a company’s past, current and future climate change mitigation efforts to align its strategy and business model with the 1.5°C global warming target of the Paris agreement and the 2050 climate neutrality objective of the EU Climate Law. To this purpose, companies need to disclose their transition plans for climate change mitigation and provide information on how they have set (Scope 1, 2, 3 and total) GHG reduction targets. These time-bound reduction targets should include at least target values for the years 2030 and 2050. The target values must be set every five years from 2030 onwards.

Time-bound GHG reduction targets should be set for 2030 and 2050.

The ESRS E1 disclosures will also give information on a company’s total energy consumption, including from non-renewable sources (eg coal, oil, natural gas, nuclear products) for high climate impact sectors, and from renewable sources. They encompass disclosures on gross Scopes 1, 2, and 3 and total GHG emissions, and on a company’s (net revenue-based) GHG emissions intensity. Moreover, the climate change standards give clarity on a company’s own and value chain GHG removals and on the GHG mitigation projects outside the company’s value chain financed by carbon credits. The disclosures also share whether internal carbon pricing schemes are applied.

ESRS E1 disclosures on the potential effects of material physical risks and material transition risks, and on the potential climate-related opportunities, can be omitted for the first year and can be based on qualitative disclosures for the first three years. The potential financial effects from physical and transition risks are reported as the monetary amount and proportion of assets at material physical or transition risk over the short-, medium- and long-term time horizons. For transition risk, a breakdown of the carrying value of real estate assets by energy-efficiency class must also be provided, similar to the CRR Pillar 3 disclosures.

ESRS S1-1 to S1-9 (own workforce) disclosures
The ESRS S1-1 to S1-9 disclosure requirements are only obligatory for companies with 250 employees or more. These disclosures describe the company policies related to material impacts on the own workforce and the associated material risks and opportunities. They give information on the alignment of these policies with the UN Guiding Principles on Business and Human Rights, disclose whether trafficking, forced labour and child labour are explicitly addressed and show if a workplace accident prevention policy or management system is in place.

The disclosures also cover the applicable processes for engaging with their own workers about impacts and to remediate negative impacts. They require the publication of time-bound targets for the reduction of negative impacts on the own workforce or to advance positive impacts. On top of that, the key characteristics of their own workforce should be described, including a breakdown by gender. Disclosures must be made on non-employee workers in their own workforce and on the collective bargaining coverage, although these may be omitted for the first year. Diversity indicators such as the top management gender distribution and distribution by age group should also be provided.

The European Commission will adopt the sector-specific sustainability reporting standards by 30 June 2024. These reporting standards are particularly important to sectors associated with high sustainability risks or impacts. The information to be specified by these standards should be proportionate to the scale of the risks and the impacts related to the sustainability matters specified per sector.

EFRAG aims to develop sector-specific standards within the next three years.

As part of a multi-year process, EFRAG intends to develop sector-specific standards for 41 sectors. Work is underway for the first batch of sector-specific standards, for which EFRAG recommendations will be published by November 2023, with the intention of legislative adoption by June 2024 by the Commission. The first focus will be on sectors with a high sustainability risk or impact on the environment, as well as standards for listed SMEs and voluntary guidance for non-listed SMEs, if feasible. Further sectors will be covered in subsequent years (expected in 2024 and 2025).

Companies within the scope of the CSRD must also provide EU Taxonomy Article 8 disclosures, as detailed in the Disclosures delegated act of 8 July 2021. The ESRS merely facilitate the reporting of this information in an identifiable part of the management report. The Article 8 disclosures give clarity on the environmentally sustainable economic activities of a company as defined under the EU Taxonomy legislation.

The EU Taxonomy is a framework developed by the European Union to help investors, companies, and policymakers identify economic activities that can be considered environmentally sustainable. It defines six environmental objectives: climate change mitigation, climate change adaptation, sustainable use and protection of water and marine resources, transition to a circular economy, pollution prevention and control, and protection and restoration of biodiversity and ecosystems.

Economic activity is Taxonomy-aligned if it makes a substantial contribution to at least one of these objectives, does no significant harm to any of the other objectives, meets the minimum safeguards and meets the applicable technical screening criteria. Activities are Taxonomy-eligible if they qualify for the purpose of financing the environmental objectives of the EU Taxonomy according to the Climate Delegated Act (first two objectives) or the upcoming delegated act for the remaining four objectives (Taxo4).

Taxonomy disclosures apply to CSRD companies.

Since 1 January 2022, large companies within the scope of the NFRD already disclose their Taxonomy-eligible and non-eligible economic activities. Large non-financial NFRD companies start disclosing their Taxonomy alignment this year, via turnover, CapEx and OpEx key performance indicators (KPIs).

Per 2024, financial companies will also report their Taxonomy alignment through the Green Asset Ratio (GAR). The Taxonomy KPI disclosures of non-financial NFRD companies are an important input variable for financial institutions to measure the Taxonomy alignment of their corporate exposures. While the CSRD gradually expands the reporting scope from listed large companies to all large companies and listed SMEs, taxonomy alignment information for non-NFRD companies such as SMEs will already be important for banks at an earlier stage (by mid-2024) for their Pillar 3 disclosures on the Banking Book Taxonomy Alignment Ratio (BTAR).

Information assurance refers to the process of evaluating the credibility and reliability of a company's sustainability reports and disclosures. The purpose of the assurance is to provide investors, regulators, customers, and communities, with confidence in the accuracy and completeness of a company's sustainability disclosures.

The information that will be published in relation to the CSRD requirements will entail corporates having a third-party assurance. A statutory auditor will express an opinion on the sustainability reporting to help the consistency of financial and sustainability information.

A third-party assurance will be obligatory.

The CSRD provides shareholders with more than 5% of voting rights or 5% of the capital with the right to have an accredited third party prepare a report on some elements of sustainability reporting. This accredited third party cannot belong to the same audit firm or network as the auditor carrying out the statutory audit.

Member States can allow the assurance services for sustainability information to be provided by firms other than the traditional auditors of financial information.

On top of the Audit Directive 2006/43/EC, the CSRD sets specific educational qualifications necessary to provide assurance services. Auditors will need to go through an examination of their professional competencies to guarantee the required level of knowledge. Theoretical knowledge includes the reporting standards in relation to the preparation of annual and sustainability reporting, sustainability analysis and due diligence. On the practical side, auditors will have to complete at least eight months of training in sustainability-related services.

From limited to reasonable assurance
The information disclosed under CSRD will first be subject to mandatory external “limited” assurance. With companies starting to put in place processes and reporting, expectations are lower on the comparability and reliability of the information provided. The European Commission will adopt limited assurance standards by October 2026.

By 2028, if conditions are met, a shift towards “reasonable” assurance will take place. The European Commission is expected to adopt reasonable assurance standards by October 2028 on the condition that reasonable assurance is feasible for auditors.

• Limited assurance: the assurance provider reduces engagement risk to a level that is acceptable in the circumstances of the engagement but where that risk is greater than for a reasonable assurance. The nature, timing, and extent of procedures performed are limited compared with that necessary in a reasonable assurance engagement but is planned to obtain a level that is, in the practitioner’s professional judgement, meaningful.
• Reasonable assurance refers to a higher degree of confidence about the accuracy and completeness of the information presented in sustainability reports. CSRD assurance involves three main steps: planning, performing, and reporting. During the planning stage, the auditor will define the scope of the engagement and identifies the applicable reporting frameworks and standards. The assurance provider then develops an assurance plan that outlines the procedures to be performed and the timelines for completion. Auditors will need to have access to corporates’ sustainability reporting systems and procedures. A set of tests to evaluate the accuracy and completeness of the information will be performed. These tests can include examining documentation and records, interviewing key personnel, conducting physical observations of operations, and examining records. Data sources will also be examined to evaluate their reliability.