ESG Reporting: Why Your CFO Faces Audit Risk

Executive Summary

---

When ESG reporting moves from marketing to due diligence

For a long time, ESG reporting was mostly a marketing job. A few paragraphs in the annual report, a nice slide in the pitch deck. The data behind it was usually a collection of utility bills and HR reports, pulled together by a small, dedicated team. This sort of system, held together by one or two diligent people, works well enough, until it doesn't.

The problem usually shows up during due diligence. An investor, no longer happy with a summary, asks a simple question: "Can you show us the raw data and methodology for your Scope 3 emissions calculation?" Suddenly, that master Excel sheet, looked after by one person in the sustainability team, looks like a serious weakness. There is no audit trail, no version control, and no clear line back to the source data. It’s the sort of thing that makes a CFO rather nervous.

In my experience, this is a common story in growing businesses. The very processes that helped you grow are now holding you back. You have probably invested in a modern data stack for your financial and commercial metrics, but your non-financial data is still being managed with methods that are twenty years out of date. You haven't really built a system, you've just put your manual process into a spreadsheet.

The problems with using spreadsheets for ESG data

Using spreadsheets for ESG data isn't just a matter of process, it's a fundamental problem with the setup. Financial data has the discipline of double-entry bookkeeping. ESG data, on the other hand, often has no such structure. This tends to create three main problems:

They are not auditable: A spreadsheet isn't a permanent record. Without a clear history of who changed what, when, and why, your data won't stand up to much scrutiny. This is usually what causes Audit Anxiety for a CFO who has to sign off on the figures.

They depend on one person: The whole system often relies on a single analyst who understands the maze of VLOOKUPs and manual fixes. If that person is on holiday, or worse, leaves, your ability to report on ESG is suddenly at risk.

There is no single source of truth: The sustainability team has one number for water usage, and the operations team has another. This isn't just a small disagreement, it's a failure to establish a Single Source of Truth, which makes consistent, reliable reporting impossible.

I worked with a firm whose entire carbon footprint calculation was in one Google Sheet. It wasn't even locked. When the sustainability lead took a holiday, no one could answer a simple investor query. It felt quite risky. They were one slip of the mouse away from losing everything during a critical funding round.

How to build a reliable system for non-financial data

To fix this, you need to think about the problem differently. It means treating ESG data with the same care you give your financial data. The aim is to build something that works like a proper ledger for your non-financial information.

This doesn't mean you need to buy an expensive new piece of ESG software. It's about getting the foundations right. The approach I usually take is straightforward:

Phase 1: Map and build: First, we map out the current process. We find every source of non-financial data, from energy invoices to HR systems. Then, we write down the rules for the business logic. Instead of a formula in a cell, the definition of 'Employee Churn' or 'Recycled Waste %' is defined in a governed Semantic Layer. This makes sure every report uses the same, agreed definition.

Phase 2: Govern and document: Second, we create an audit trail. We put a light-touch governance framework in place. This isn't about writing long documents that no one reads. It's about using simple tools like CI/CD pipelines to make sure any change to a metric is reviewed, approved, and recorded, just like software code. This is the heart of a practical Data Governance strategy.

Phase 3: Train and hand over: Finally, the goal is for us to not be needed anymore. We train 'Domain Champions' in the sustainability and operations teams. They learn how to use the governed system to answer their own questions, which reduces the bottleneck on the central data team and helps build a culture of people owning their own data.

The main challenge is people, not technology

I should be clear: this isn't a quick job. The technology is usually the easy bit. The harder part is getting people to change how they work.

You're asking the operations team to be more precise with their data than they've ever had to be. You're asking the finance team to look at a carbon metric with the same critical eye they would use for a revenue figure. That sort of change in behaviour can meet a bit of resistance. It's as much about people as it is about data architecture.

But sticking with a fragile, spreadsheet-based process is the riskier option. It's not just inefficient, it's a real liability for the business. As investors and regulators ask for more, the risk of getting the numbers wrong grows every quarter. Having a solid system for Investor Reporting isn't really a 'nice-to-have' anymore.

The pay-off is being able to sit in front of an auditor or investor and, instead of showing them a spreadsheet, you can show them a clear, logical, and auditable data trail. That's how you change ESG from a source of risk into something you can stand behind.