ESG data management: every figure, back to its source

A good test of ESG data management is to pick one published number and ask five questions about it.

Where did it come from, how was it turned into the figure, which period does it cover, how does it compare with last year, and who signed it off?

For statutory figures the instruments answer some of those questions for you: SECR fixes the period and the comparative, the gender pay gap regulations fix the snapshot date and the signature, and ESOS fixes the reference period and how long the evidence is kept.

The tool on the panel traces ten common figures back to the provisions that govern each step.

Where an instrument is silent — no prescribed emission factor, no required control framework — the choice is the company’s, and the data has to show which choice was made.

That is the whole discipline: make every choice once, write it down, and apply it the same way next year.

Source. Every figure starts as a document — a utility bill, a fuel card statement, a payroll extract, a supplier’s confirmation — and the first job is to keep it, labelled with the period it covers.

Calculation. The GHG Protocol Corporate Standard sets five principles — relevance, completeness, consistency, transparency and accuracy — and asks a company to choose equity share or control, operational or financial, as its consolidation approach.

It treats a minimum-emissions threshold as “a predefined and accepted negative bias”, which is why an exclusion has to be disclosed and justified rather than quietly applied.

Most UK reporters take emission factors from the government’s annual conversion factors, and the methodology should say which year’s set.

Control. A named owner enters each dataset, someone else reviews it, and the approval chain ends where the law puts it — the board for the strategic and directors’ reports.

Mapping. Collect once, present several times: the same kWh figure feeds SECR, ESOS and a CDP response, and drift between them is the most visible kind of error.

Output. Each regime has its own document and location, which the ESG reporting requirements page sets out regime by regime.

How a company runs those outputs as one programme is on ESG reporting in practice.

Assurance-ready means an assurance provider could test the figures without the company rebuilding them.

In practice that means four things: every figure traces to a source document, the method and factor year are written down, changes are logged with a reason, and the approval chain is recorded.

The standard most UK providers would use for that work is changing.

The FRC issued ISSA (UK) 5000, the UK adoption of the IAASB’s sustainability assurance standard, effective for periods beginning on or after 15 December 2026 and issued for voluntary use; it binds a provider that represents compliance with it, and no one else.

The IAASB announced on 8 May 2025 that ISAE 3410, its greenhouse gas statement standard, is withdrawn with effect from ISSA 5000’s effective date.

ISAE 3000 (Revised) remains in place for other assurance engagements.

None of that makes assurance compulsory, and the FCA deliberately named no standard in its rules; the FRC’s sustainability reporting FAQs cover the wider regime.

How assurance works, and what levels mean, is on sustainability assurance.

For listed companies, controls over ESG data are now a board matter in their own right.

The UK Corporate Governance Code 2024 asks the board, from financial years beginning on or after 1 January 2026, to declare the effectiveness of material controls, and the FRC says those extend to controls over reporting, such as narrative and ESG reporting controls (Provision 29).

For every company, the strategic report and directors’ report are approved by the board, so the approval chain for a SECR or climate figure ends there.

Retention rules differ by regime and are easy to miss: the ESOS evidence pack for Phase 4 is kept until at least 5 December 2035, and gender pay gap figures stay online for at least three years.

How data responsibilities sit within board oversight is on ESG governance, and how they feed targets on ESG strategy.

Each statement is one we hear about ESG data, and each answer names the provision that settles it.

The false ones usually invent a requirement — a mandatory factor set, a mandatory standard, a fixed threshold.

The true ones are the quieter rules that decide whether next year’s figures can be compared with this year’s.