ESG & Sustainability Governance
CSRD is where most leadership teams first meet ESG. The real question is whether it is governed, or only disclosed.
Governing sustainability, risk and responsibility, not only reporting them.
Why it's on the leadership agenda
Many leadership teams first meet ESG through CSRD. But CSRD is one framework among many, and the report is only the visible output. Regulators, investors, lenders and customers now look behind it, at how sustainability, health and safety, and supply chain risk are actually governed.
The rules have also moved. The Omnibus I Directive, in force since 18 March 2026, narrowed the CSRD to EU undertakings with more than 1,000 employees and net turnover above EUR 450 million. Many organisations are now out of scope, but customers and lenders still ask them for the same data, and those in scope publish board-approved disclosures with limited assurance.
Data protection, ESG and EHS are often run separately, with different owners, data and assumptions. Leadership needs one picture of risk and responsibility, not three.
What the module covers
Materiality and strategy: which environmental, social and governance issues matter to your business, and turning them into priorities your leadership team owns
Regulatory readiness: CSRD, CSDDD, the ISSB standards and the wider frameworks run as one coordinated programme, with your scope confirmed on evidence
Operational risk: environment, health and safety, supply chain and climate exposure in the same line of sight as financial and strategic risk
Data and assurance: the controls, accountability and audit readiness behind the figures you publish, connected to your data protection obligations
Board and executive oversight: clear ownership, meaningful KPIs and reporting lines that help directors ask the right questions
Avoiding unsupported sustainability claims in reports, bids and marketing
What your leadership team will be able to answer
Are we in scope for CSRD or CSDDD, and when does each obligation start for us?
Do our ESG, health and safety and data protection teams give leadership one picture of risk, or three?
Is our materiality assessment defensible, and has the board challenged it?
What controls sit behind the numbers we publish, and who assures them?
Which of our public sustainability statements could we not evidence today?
The regulatory frame
Reporting for EU undertakings above 1,000 employees and EUR 450m net turnover, with limited assurance.
Omnibus in force 18 Mar 2026; transposition by 19 Mar 2027
The reporting standards, being simplified. A limited assurance standard is due by 1 Jul 2027.
Simplified standards pending
Human rights and environmental due diligence for groups above 5,000 employees and EUR 1.5bn turnover. Penalties capped at 3% of worldwide turnover.
Applies from 26 Jul 2029
Dates reflect the position as of September 2026. Every engagement begins with a current regulatory review.
What you leave with
A clear scope position under the revised CSRD and CSDDD, and the frameworks your customers and investors expect
A board-level challenge of your materiality assessment
A map of the controls and assurance behind your published figures
A review of public sustainability claims, flagging any you cannot evidence
An ESG governance structure, KPIs and reporting plan, bringing ESG, EHS and data protection into one view