The Growing Gap Between Sustainability Reporting & Sustainability

Key Takeaways

• Reporting Maturity Is Not Operational Progress: Companies can build sophisticated sustainability reporting, controls, and assurance without producing comparable changes in the underlying business.
• Better Data Can Make Performance Look Worse: Improvements in Scope 3 measurement can move reported emissions in either direction without any corresponding change in operations, making methodological changes critical to interpreting year-over-year results.   Pasted markdown
• Assurance Answers a Narrower Question: Sustainability assurance can increase confidence in reported information without establishing that the company's underlying sustainability performance is improving.   Pasted markdown
• Responsibility and Authority Can Diverge: Sustainability teams may own targets while the capital, procurement, operations, and supplier decisions needed to achieve them sit elsewhere in the organization.   Pasted markdown
• Disclosure Governance Is Not Sustainability Governance: GRC functions need to distinguish between governing whether sustainability information is reliable and governing what the organization actually does because of what that information reveals.

Deep Dive

Sustainability reporting used to be a document. At many large companies, it is now an institution, with its own staff, calendar, controls, and internal audit trail. The 2026 edition of the State of Play study from the IFAC, AICPA, and CIMA found that 97 percent of the world's largest companies disclosed some form of sustainability information in 2024, and 75 percent obtained some level of third-party assurance over it, up from 73 percent the year before and just 51 percent in 2019, the first year the study ran.

The OECD's Global Corporate Sustainability Report 2025 puts the disclosure side of that picture at a larger scale. Of the roughly 44,000 listed companies worldwide, about 12,900, representing 91 percent of global market capitalization, disclosed sustainability-related information in 2024, up from 86 percent of market capitalization two years earlier. Of those 12,900 companies, 5,458 obtained independent third-party assurance over at least part of what they disclosed, a group representing 81 percent of the market capitalization of companies making sustainability disclosures, though only 42 percent of those companies by number. A decade ago, most of this did not exist in anything like its current form.

What this institution has not settled, and cannot settle on its own, is whether the businesses running it are doing anything differently. That is not an argument that sustainability disclosure is dishonest, or that the people building these systems are acting in bad faith. Most companies report what they believe to be true, and most sustainability teams want their numbers to improve. The claim is narrower, and for a GRC audience, more useful. The systems that produce good disclosure and the systems that produce good outcomes are not the same systems, do not answer to the same incentives, and can improve on entirely separate timelines. Reporting maturity is not a proxy for operational change. The trouble begins when an organization starts treating it as one.

Scope 3 shows this most clearly, and shows how tangled the relationship between measurement and performance can get. Most large companies still rely on secondary data to build the bulk of their Scope 3 inventory, industry-average emissions factors applied to categories of spend or activity, rather than data drawn directly from suppliers.

A 2026 Carbon Action Report from EcoVadis and Kearney, covering carbon data from more than 56,000 companies, found that 40 percent share estimate-based Scope 3 data while just 4 percent report primary Scope 3 data. The same analysis found that companies relying on lower-reliability data reported a median Scope 3 footprint 2.5 times their operational emissions, compared with 6.8 times among companies with high-reliability or verified data, suggesting that poorer data may leave a substantial share of supply-chain emissions hidden.

A separate MIT Sloan analysis of the State of Supply Chain Sustainability report found that supplier data availability, cited by about 70 percent of respondents, was the leading obstacle to better Scope 3 data, ahead of a lack of standardized measurement methodology (53 percent), the complexity of the calculations (52 percent), limited internal expertise or resources (39 percent), and the cost of measurement tools (32 percent). The GHG Protocol's own guidance treats spend-based estimation as a starting point rather than an end state, and expects companies to migrate toward supplier-specific and activity-based data as their programs mature.

That migration does not move reported emissions in a predictable direction. Numbers move in whatever direction the truth happens to lie, and the truth was previously hidden inside the estimate. Novo Nordisk's 2023 Scope 3 restatement, disclosed as part of its first CSRD-aligned report, is a useful case. The company moved several categories, including contract manufacturing and capital goods, from spend-based emission factors to activity-based ones incorporating supplier-specific data where it was available.

According to an analysis of the restatement, the shift moved Novo Nordisk's reported 2023 Scope 3 figure sharply downward because the spend-based factors it had been using had specifically overstated emissions on its high-value pharmaceutical purchases, not because spend-based accounting overstates emissions as a general rule. Other companies making the same kind of transition have reported the opposite.

A 2026 study of Scope 3 reporting among global logistics companies found reported emissions climbing over time in ways the authors could not clearly separate from improvements in reporting scope and data accuracy, meaning some of the increase may reflect better measurement rather than worse performance. In both directions, the company's underlying operations had not necessarily changed at all. What changed was how well the company understood itself.

That complicates any simple reading of what the numbers show. A company with improving, tightly reconciled figures is not necessarily doing better. A company reporting worse or more volatile figures is not necessarily doing worse. It may simply be the company that stopped estimating and started measuring, a different kind of progress from the one a target-setting exercise is built to reward. A board that reads a clean year-over-year trend line as evidence of environmental improvement, without asking whether the trend reflects operational change or a change in methodology, is drawing a conclusion the data was never built to support.

Assurance was supposed to resolve this kind of ambiguity, and in a narrow sense it does, though the sense is narrower than most non-specialists assume. The IAASB's International Standard on Sustainability Assurance 5000, finalized in 2024, gives the profession its first standalone global baseline for these engagements, distinguishing limited from reasonable assurance through differences in the nature, timing, and extent of the procedures performed and the resulting level of assurance obtained.

A limited assurance engagement, still the dominant form, involves a narrower set of procedures, for instance obtaining an understanding of relevant internal controls without necessarily testing whether those controls operated effectively, and produces a conclusion expressed in negative form, stating that nothing has come to the practitioner's attention indicating the information is materially misstated. A reasonable assurance engagement involves deeper procedures and a much lower tolerance for engagement risk, and supports a conclusion expressed in positive form, closer to a financial statement audit opinion.

Of the 5,458 companies that obtained assurance in the OECD's 2024 dataset, 3,061, or 56 percent, had at least some information covered under limited assurance, and 918, or 17 percent, had at least some covered under reasonable assurance. The typical sustainability assurance opinion in circulation today is a negatively worded conclusion over a defined and often partial scope, not a positive opinion that a company's sustainability performance is sound.

That tends to get lost by the time the assurance opinion reaches a board pack or a press release. An assurance engagement tests whether disclosed figures were calculated consistently with a stated methodology and reconcile to source data. It says nothing about whether that methodology, however faithfully applied, describes a business getting better, worse, or simply better understood.

Auditors are not failing when they issue a clean limited assurance opinion on an emissions inventory built substantially on secondary data. That is the engagement as scoped. The risk sits one level up, in the gap between what the opinion technically covers and what it gets read as covering once it circulates as a general signal of sustainability credibility.

Materiality assessments have their own version of this problem. A double materiality assessment under CSRD requires judgment at nearly every step, starting with who gets consulted and which questions get put to them, running through how impact materiality and financial materiality get weighed against each other and what threshold separates a material topic from an immaterial one, and ending with how conflicting stakeholder views get reconciled into a single ranked list. None of that judgment is illegitimate.

A well-run materiality process is one of the more genuinely useful exercises a sustainability function performs, forcing an organization to think systematically about where it creates risk and impact rather than reacting to whichever issue is loudest that year. The governance question is not whether the process is rigorous. It is whether the assumptions underneath the rigor get revisited on their own terms from one cycle to the next, or simply inherited.

The deeper explanation for why reporting so often outpaces operational change is not a story about hypocrisy so much as one about incentives, the kind GRC professionals recognize from almost any other compliance discipline. Sustainability reporting has a filing date. It has an owner, usually a controller or a sustainability director with the disclosure calendar on their desk. It has a regulator who prescribes what must be disclosed and an auditor who tests whether it was disclosed correctly. Investors send questionnaires. Rating agencies want updated inputs. A board committee reviews the package before it goes out. Deadlines are the thing large organizations are, whatever their other faults, generally quite good at meeting.

Changing the underlying business answers to none of those pressures in the same way, and often does not answer to the same person. A sustainability director can be responsible for an emissions target without controlling the factories, procurement contracts, fleet, product design, or supplier relationships that determine whether the target gets met, let alone the capital budget that would fund the change. Retrofitting a facility requires capital that competes with every other project in the portfolio. Switching suppliers to lower-carbon alternatives can raise costs or introduce resilience risk that a procurement function has to weigh against a target it does not own. Redesigning a product touches engineering timelines measured in years.

Some of the technology needed to substitute for higher-emissions processes in heavy industry, shipping, or aviation remains immature or uneconomical at scale, so the lever is not available at any price a board would approve. It should not be surprising that a workstream with a hard deadline and a named owner outpaces one whose owner does not control the decisions required to move it.

Some of this shows up in the empirical literature on what researchers call ESG decoupling, the gap between what a company discloses and what it does. A 2026 study in Business Strategy and the Environment examined 2,759 U.S. publicly listed firms across 20,038 firm-year observations from 2002 to 2021 and found that sustainability committees were associated with greater overall ESG decoupling, though the effect ran in different directions by dimension. Environmental decoupling decreased while social and governance decoupling increased.

A 2023 study in the Journal of Environmental Management, examining 5,422 Chinese firm-year observations between 2012 and 2018, found that stricter environmental regulation was associated with a larger gap between environmental reporting and measured environmental performance, not a smaller one, and that the gap widened further among firms with greater bargaining power and fewer financial resources.

Neither study claims companies are lying about their numbers, and neither establishes a general law about how reporting and performance relate everywhere. What both demonstrate, in different populations, periods, and regulatory environments, is that reporting and operational performance can move independently, particularly where enforcement is weak or resources are constrained.

This is the difference that should organize how a GRC function reviews sustainability reporting. Disclosure governance asks whether the company's sustainability information is complete, accurate, consistently calculated, properly controlled, and adequately assured against a defined standard. Sustainability governance asks what the company did, in its operations, its capital allocation, and its supply chain, because of what that information revealed. A company can be excellent at the first without being anywhere close to excellent at the second, and building the first does not guarantee progress on the second. A mature organization eventually needs both.

For a board or an audit and risk committee, that should change what gets asked in a sustainability governance review, not just how thoroughly the existing questions get asked. A committee can receive an emissions inventory that reconciles perfectly to source systems, carries a clean limited assurance opinion, and reflects a methodologically sound materiality process, and still not know whether capital allocation changed because of any of it.

A Scope 3 figure can be calculated correctly and consistently for five straight years without anyone in the organization acquiring the budget, the supplier leverage, or the internal authority to actually change what is being measured. None of that is a failure of the reporting function. It is the reporting function doing exactly what it was built to do, which was never quite the same thing as changing the business.

The sustainability report for the year is finished. The figures reconcile to the general ledger and the supplier data behind them. The materiality assessment followed the process the committee approved last year, and the year before that. The assurance engagement raised no material issue. Nothing came to the practitioner's attention. The board reviewed the package and signed off. Every number in it can be defended. Whether the business beneath those numbers is any different is another matter.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.