Building Audit-Ready Sustainability Reporting with ICS

As sustainability reporting becomes more regulated and subject to greater scrutiny, annual data collection alone is no longer enough. Companies need a robust internal control system (ICS) for ESG reporting that supports the accuracy, completeness and traceability of sustainability information.

For many organizations, ESG data still sits across spreadsheets, enterprise systems, supplier inputs and local teams. Ownership can be unclear, definitions may vary by function and review processes are often informal. This creates risk when sustainability information is used for regulatory reporting, investor communications, climate targets or external assurance.

Regulatory developments such as the Corporate Sustainability Reporting Directive (CSRD), assurance expectations and investor-focused disclosure frameworks are increasing pressure on companies to demonstrate that the data behind their disclosures is reliable. The underlying processes, controls and governance must be documented, repeatable and defensible.

A well-designed ICS translates scattered sustainability inputs into structured, validated and auditable information flows. It helps organizations move from reactive reporting to a control-enabled operating model that supports compliance, audit readiness, better decision-making and stakeholder trust.

In financial reporting, internal controls help organizations maintain accurate, complete and timely reporting. The same discipline is now needed for ESG disclosures, which increasingly inform risk management, strategy, capital allocation, procurement decisions and stakeholder engagement.

Controls create structure. They clarify who collects data, which methodologies apply, how information is reviewed, what evidence is retained and how issues are escalated. When designed and operated effectively, internal controls contribute to more consistent, efficient and audit-ready sustainability reporting.

Controls also help manage complexity. Sustainability topics often involve multiple systems, qualitative evidence, supplier data, estimates and cross-functional inputs. A control framework helps organize this complexity and creates a single source of truth that leadership, auditors and external stakeholders can trust.

An ICS is not only a compliance requirement. It can become business infrastructure for reliable sustainability performance management. Investing in controls can help companies reduce manual rework, shorten review cycles, improve data quality and strengthen confidence in reported results.

Better data supports better decisions. Reliable ESG information helps organizations prioritize investment, track progress against targets, identify operational risks, and respond to customers, investors and regulators with greater confidence.

Audit readiness becomes part of business as usual. Rather than preparing evidence at the end of the reporting cycle, teams can embed documentation, approvals and quality checks directly into their processes and systems.

Control frameworks such as Committee of Sponsoring Organizations of the Treadway Commission (COSO)[1] provide a useful foundation for governance, risk assessment, control activities, information and communication, and monitoring. For sustainability reporting, the challenge is translating those principles into practical controls that reflect ESG data realities.

The real shift happens when controls are embedded into day-to-day reporting workflows. This means understanding where data originates, how it moves through the organization, where manual adjustments occur and which points create the greatest risk of error or inconsistency.

In practice, effective ESG controls require:

• Clear mapping of ESG data sources, systems and reporting boundaries
• Defined roles for data owners, process owners, control owners and reviewers
• Documented methodologies, assumptions, exclusions and evidence requirements
• Preventive and detective controls for data accuracy, completeness and consistency
• Testing procedures to evaluate control design and operating effectiveness
• A remediation process for control deficiencies and recurring improvement

This operational focus turns ESG reporting from a last-minute exercise into a structured, repeatable process that can scale across reporting frameworks and business units.

ICS is especially relevant for organizations with high ESG data complexity, material sustainability disclosures, multiple reporting entities, global value chains or upcoming verification requirements. It is also valuable for companies already using, implementing or reviewing ESG software and seeking to improve auditability, workflow discipline and data governance.

Typical triggers include regulatory readiness, external audit findings, fragmented reporting processes, Scope 3 data challenges, manual spreadsheet-based workflows, inconsistent KPI definitions or limited confidence in the completeness of sustainability data.

Relevant functions often include sustainability, finance, risk, internal audit, legal, compliance, operations, procurement, IT and business unit data owners. Bringing these groups together is critical because ESG reporting is inherently cross-functional.

Most companies already have partial controls in place, such as spreadsheet checks, informal approvals or system-based validations. The opportunity is to connect these into a coherent control system that is risk-based, documented and aligned with reporting priorities.

Initial steps should focus on:

• Scoping material ESG disclosures and reporting entities based on regulatory requirements, business structure and risk exposure
• Assessing current governance and control maturity to identify gaps, duplications and high-risk areas
• Documenting key processes and controls including data flows, evidence requirements, review points and escalation routes
• Training teams and clarifying accountability so process owners and control owners understand their roles
• Testing control design and operating effectiveness and using results to remediate deficiencies before third-party review.

Companies should start where the reporting risk is highest, not where controls are easiest to implement. High-priority areas often include emissions data, workforce metrics, supply chain information, health and safety data, or disclosures subject to external review.

UL Solutions helps organizations design, document and operationalize internal control systems for sustainability reporting. Our approach combines ESG advisory expertise, technical software knowledge and compliance-focused delivery to help companies move from fragmented reporting processes to control-enabled, audit-defensible sustainability data infrastructure.

Our ICS support can include:

• ICS gap assessment and governance setup – Maturity assessment, entity scoping, disclosure prioritization, role definition and implementation road map
• Process and control documentation – Process maps, control matrices, evidence requirements, methodology documentation and escalation procedures
• Training and testing framework design – Capability building for data owners and reviewers, testing templates, sampling approach and deficiency classification
• Control testing and results evaluation – Assessment of control design and operating effectiveness, findings reports and prioritized recommendations
• Remediation audit preparation – Corrective action planning, retesting where needed and preparation of audit-ready control documentation

Where relevant, UL Solutions can also support the integration of controls into ESG data management systems, including ULTRUS® UL 360, by helping organizations align workflows, approvals, audit trails, role-based access and reporting outputs with control requirements.

Organizations benefit from an integrated advisory and technology approach, standards-driven delivery, practical ESG reporting expertise and a strong understanding of third-party verification expectations. This helps companies build control systems that are not only compliant, but also scalable, efficient and embedded into daily operations.

If your organization is preparing for regulatory disclosure, external verification, ESG software implementation or a more robust sustainability reporting cycle, now is the time to assess whether your controls are ready. UL Solutions can help you identify gaps, design practical controls and build an audit-ready ESG reporting foundation that supports compliance, confidence and long-term performance.