Why credible sustainability disclosure begins with governance, risk management, controls and reliable data—not with writing the year-end report

Sustainability reporting is becoming more structured, more visible and more consequential. Organisations may need to address IFRS S1 and IFRS S2, Bursa Malaysia sustainability requirements, Malaysia’s National Sustainability Reporting Framework (NSRF), GRI disclosures and stakeholder expectations linked to the United Nations Sustainable Development Goals (SDGs). The SDGs are not themselves a corporate reporting standard, but many organisations use them to frame their sustainability priorities and contributions. Malaysia’s NSRF uses the ISSB Standards as the baseline for sustainability disclosure, while Bursa Malaysia has enhanced its reporting framework in response to the NSRF.

Yet there is a persistent management problem. In many organisations, sustainability is still treated largely as an annual reporting exercise. Near the end of the reporting period, departments are asked to provide figures, spreadsheets are reconciled, explanations are prepared, missing evidence is chased, and the sustainability report or statement is assembled for approval.

This approach may produce a report. It does not necessarily produce effective sustainability management.

IFRS S1 points in a different direction. It calls for disclosure about governance processes, controls and procedures; strategy; processes for identifying, assessing and monitoring sustainability-related risks and opportunities; and performance through metrics and targets. IFRS S2 applies the same broad architecture specifically to climate-related risks and opportunities.

Malaysia’s NSRF guidance for Boards reinforces this direction. Among the questions it asks are whether there is a cross-functional team, whether sustainability data has the appropriate reporting boundary, whether financial impacts have been assessed, whether sustainability risks are integrated into enterprise risk management, whether metrics are being tracked, whether material information is assurance-ready, and whether appropriate training and capacity building are in place.

The message for directors is important: credible reporting is the output of an effective management process. It should not be treated as a substitute for that process.

The problem is not that sustainability reports are annual. The problem is when sustainability management is annual.

Why the Year-End Reporting Model is Weak

A year-end approach creates several predictable weaknesses. Data may be collected too late to correct underlying problems. Definitions may differ across business units. Evidence may be incomplete. Sustainability information may sit outside the internal control environment applied to financial information. Material risks may be identified only when the report is being written, rather than when management still has time to respond.

The same problem arises with targets. A company may disclose an emissions, safety, workforce, diversity, water or supply-chain target at year-end, but if performance against that target is not monitored during the year, the target has limited management value.

There is also a governance risk. Directors may receive a polished report without having sufficient visibility into how the underlying information was generated, who owns each metric, what controls were applied, whether assumptions were challenged, and whether negative developments were escalated promptly.

As sustainability information moves towards greater assurance, a weak year-end process can also become expensive and difficult to defend. Assurance requires evidence, traceability, consistent methodologies and effective controls. If these have to be reconstructed after the event, management spends time explaining gaps rather than managing performance.

A Board should therefore ask a different question—not simply “Is the sustainability report ready?” but “Do we have a management system that makes the report reliable?”

From Reporting to a Sustainability Management System

A Sustainability Management System (SMS) provides a practical way to make that shift. An SMS is not another disclosure standard, nor should it create another organisational silo. It is a management framework that connects sustainability requirements with the way an organisation is governed and operated.

The framework can follow the familiar Plan–Do–Check–Act (PDCA) logic.

• Plan — Understanding the organisation’s context, applicable reporting and stakeholder requirements, material sustainability-related risks and opportunities, reporting boundaries, objectives, targets, responsibilities and resources.
• Do — Embedding those requirements into operational processes. This includes policies, procedures, responsibilities, competence, procurement, investment decisions, supplier management, operational controls, data collection, documentation and evidence.
• Check — Monitoring performance throughout the year. Management should know whether controls are working, whether objectives are being achieved, whether data is complete and reliable, whether risks are changing, and whether corrective action is required. Internal audit and other forms of independent review can provide additional challenge.
• Act — Formal management review, corrective action and continual improvement. The organisation learns from performance, incidents, audit findings, stakeholder concerns and changing risks, and then adjusts objectives, controls, resources and strategy.

When this cycle operates throughout the year, disclosure becomes the final output of a functioning system rather than a year-end data-gathering project.

What Should the Board do?

The Board does not need to manage every sustainability metric. Its role is to ensure that the organisation has the governance, capability and discipline needed to manage sustainability-related risks and opportunities in the same way it manages other matters that can affect enterprise value, resilience and long-term performance. Board oversight should therefore focus on direction, accountability, challenge and assurance rather than operational detail.

1. Who is accountable? Is there clear Board oversight, a designated senior management owner and defined responsibilities across functions?
2. Is sustainability integrated with strategy and enterprise risk management? Are material sustainability-related risks and opportunities considered in strategic planning, capital allocation and business decisions?
3. Are there effective controls? Does management have documented processes, ownership, review and approval controls for material sustainability information?
4. Can the data be trusted? Are definitions, boundaries, methodologies, source records and evidence sufficiently robust to support internal review and, where required, external assurance?
5. Are objectives managed during the year? Does the Board receive meaningful performance information early enough for action, rather than only at reporting time?
6. Is there independent challenge? Do internal audit, risk, compliance or other assurance functions test whether the system and controls are working?
7. Does management review lead to improvement? Are weaknesses, missed targets, emerging risks and audit findings converted into corrective actions, resources and changes to the system?

These questions move the Board away from reviewing sustainability merely as a communications product and towards governing it as a business system. They also help directors distinguish between a report that is polished and a system that is genuinely controlled, evidence-based and capable of improvement.

The Board’s Role: Make Sustainabiltiy Cross-Functional

Boards should recognise that sustainability cannot be delivered by the sustainability department alone. The information required for credible reporting may originate from finance, operations, engineering, human resources, procurement, supply-chain management, risk, compliance, facilities, information technology and subsidiaries. The Board’s task is not to coordinate these functions itself, but to ensure that clear ownership, accountability and reporting lines exist across them.

Climate-related financial effects may require input from finance and strategy. Scope 3 emissions may depend on procurement and suppliers. Workforce indicators depend on HR systems. Environmental performance depends on operational data. Governance disclosures depend on Board and management processes. When these responsibilities are fragmented, the Board may receive information that is late, inconsistent or difficult to challenge.

The Board should therefore require management to establish cross-functional ownership and make clear that sustainability responsibilities belong to the business, not merely to the team that writes the report. It should also expect regular reporting on material risks, performance against objectives, control weaknesses, data quality and corrective actions. This gives directors visibility throughout the year rather than only when the annual sustainability disclosure is presented for approval.

This approach also avoids duplication. An SMS can be integrated with existing enterprise risk management, internal control, budgeting, strategic planning, internal audit and established management systems. Organisations already operating systems such as ISO 9001, ISO 14001 or ISO 45001 will recognise many of the underlying disciplines: defined responsibilities, operational control, documented information, competence, monitoring, audit, management review and continual improvement. For the Board, integration means sustainability is governed through established business disciplines rather than treated as a separate reporting project.

The objective is not to build a second organisation around ESG. It is to integrate sustainability into the organisation that already exists.

Data Should Be Managed, Not Merely Collected

For Boards, one of the most important areas is sustainability data governance. A number appearing in a sustainability report should have an owner, a definition, a reporting boundary, a methodology, a source, supporting evidence, a review process and a record of approval. Changes to methodologies should be controlled and explained. Estimates should be supported. Information received from subsidiaries and suppliers should be subject to appropriate checks.

This is increasingly important because sustainability information interacts with financial decisions. IFRS S1 focuses on sustainability-related risks and opportunities that could reasonably be expected to affect an organisation’s cash flows, access to finance or cost of capital over the short, medium or long term.

Sustainability information therefore should not be regarded as a parallel narrative detached from financial management. Boards do not need to become technical specialists in every emissions factor or social indicator. They do, however, need sufficient understanding to challenge whether the system producing the information is reliable.

Integration is the Real Objective

The most important change is conceptual. Sustainability should not be seen simply as a collection of separate reporting frameworks. IFRS S1 and S2, Bursa Malaysia requirements, GRI and SDG-related commitments may have different purposes and audiences, but an organisation should not have to build a separate management process for every framework.

A well-designed SMS can provide the common management backbone: governance, identification of risks and opportunities, objectives, controls, reliable data and evidence, monitoring, internal audit, management review and continual improvement. The reporting requirement may change. The underlying management discipline should remain.

This is how sustainability becomes integrated with business management rather than added to the organisation at the end of the year.

From a Better Report to a Better-Managed Organisation

Boards are rightly being asked to pay closer attention to sustainability disclosure. But the strongest response is not simply to improve the report. It is to improve the system behind the report.

An effective Sustainability Management System can help the Board establish clear accountability, integrate sustainability into risk and strategy, strengthen internal controls, improve data reliability, support assurance and establish a cycle of continual improvement. It also gives directors a more systematic basis for oversight: defined responsibilities, regular information, evidence of control effectiveness, independent challenge and a clear record of management response.

The result should be more than better ESG reporting. It should be a better-managed organisation—one that can identify sustainability-related risks earlier, respond to opportunities more systematically and provide stakeholders with information that reflects how the business is actually governed and operated.

For directors, the practical question is therefore not “How do we produce a better sustainability report at year-end?” It is: “What management system do we need throughout the year so that a credible sustainability report becomes the natural outcome?”

Further reading — Beyond ESG Reporting: Implementing a Sustainability Management System.
A practical, step-by-step guide to designing, documenting, implementing, monitoring and continually improving a Sustainability Management System, connecting governance, risk, controls, reliable data, internal audit and management review.

The article was written by Amargit Singh.

Photo by Paula Prekopova on Unsplash.