The Hidden Sustainability Risk: Missing Governance Infrastructure

Most organizations have made significant investments in their sustainability programs. They have conducted double materiality assessments, purchased sustainability software, built data collection workflows, defined key performance indicators (KPIs) and published reports aligned with multiple standards and frameworks. Some have also started pursuing limited assurance.

Yet many remain just one staff departure, audit cycle or regulatory update away from major disruption.

The problem is not the investment itself, but what it failed to address. Many companies have focused on sustainability implementation, but far fewer have built the governance needed to sustain it.

The gap the data reveals

The KPMG ESG Assurance Maturity Index 2025, based on responses from 1,320 senior executives across 143 countries, presents a stark picture. Two years into the index, 76% of businesses are still at early or mid-level environmental, social and governance (ESG) maturity. The global readiness score has also declined slightly, from 47.7 to 46.9, while the gap between leaders and beginners remains wide at nearly 35 points.¹

What matters most is not the headline score but what sets leaders apart. The difference is not the software organizations use or the number of metrics they track. Governance and skills together make up 50% of KPMG’s maturity weighting, and these are precisely the areas where the gap between leaders and beginners is greatest.

KPMG’s finding on operational integration is especially revealing: Only 5% of companies globally have fully embedded sustainability targets across operational functions, supported by monitoring and incentives. Even where reporting appears mature, many organizations still lack the mechanisms needed to translate targets into action, including clear ownership, accountability, decision rights and evidence trails.

Additionally, research from European Sustainability Reporting Standards (ESRS) implementation surveys points to the same gap. A 2025 academic study of 312 EU companies found that only 37% had fully established double materiality assessment processes by the end of 2024. Another 54% described themselves as “partially prepared.”² In many cases, this partial preparedness reflects gaps in the underlying governance infrastructure needed to support reporting, including clear ownership of sustainability topics, documented processes and controls, defined accountability, and auditable evidence to substantiate disclosures. These are companies subject to mandatory reporting requirements, not voluntary early adopters.

What sustainability governance means in practice

When sustainability teams talk about governance, there is a tendency to default to board-level oversight — whether a sustainability committee meets regularly or whether sustainability reporting appears on the audit committee agenda. These things matter, but they are not the full picture.  

In practice, sustainability governance is the operating structure that keeps reporting reliable, defensible and durable over time. That includes:

Clear ownership models. Each disclosed metric needs defined accountability: who provides the data, who reviews it and who approves it for reporting or assurance. Without documented Responsible, Consulted and Informed (RACI) structures and named owners, these responsibilities are interpreted differently each cycle or left unresolved entirely.

Documented processes and methodologies. Companies need a clear record of how key sustainability calculations and judgments are made, such as Scope 2 emissions methods, Scope 3 Category 1 allocation approaches and estimates for missing supplier data. These decisions are often scattered across individual knowledge, spreadsheets or old email threads. When staff change or auditors request evidence, the rationale must be accessible, consistent and defensible.  

Internal controls. Sustainability data moves across systems, teams and geographies before it appears in a sustainability statement. Without review controls, approval workflows, quality checks and evidence retention requirements, data integrity depends on individual judgment rather than a repeatable process. For example, the Corporate Sustainability Reporting Directive’s (CSRD) shift to mandatory limited assurance, and eventually reasonable assurance, assumes that testable controls are in place.

Change management and maintenance processes. Regulations evolve, methodologies are updated, and materiality assessments need to be refreshed. For instance, sustainability programs built around earlier ESRS expectations are already adapting to the European Commission's Omnibus simplification package. Without documented processes to track regulatory changes, assess their impact and implement updates in a controlled way, organizations remain reactive. Strong governance infrastructure enables a more systematic response.

Yet the value of governance extends beyond compliance. Governance infrastructure is what transforms sustainability data from a reporting output into a management tool. Clear ownership, documented methodologies, effective controls and maintained evidence trails help support trusted, consistent and decision-ready data. When organizations have confidence in the integrity of their sustainability information, they can be better positioned to use it to manage performance, identify improvement opportunities, support investment decisions and demonstrate progress to stakeholders.

Governance investments are often dismissed as overhead — documentation for its own sake or progress that adds bureaucracy. The evidence suggests otherwise.

PwC’s 2025 Global Sustainability Reporting Survey found that organizations already reporting under CSRD or the International Sustainability Standards Board (ISSB) are increasingly using the data they collect for commercial value, not just disclosure. Close to 70% of surveyed companies reported gaining significant or moderate business benefits from their sustainability data. PwC’s parallel investor survey found that 61% of investors globally would increase their investment in companies demonstrably using sustainability data for performance management.³ These findings suggest that organizations with more mature reporting capabilities are increasingly using sustainability data to inform business decisions rather than treating it solely as a reporting requirement.

Moreover, KPMG’s findings on CSRD Wave 1 reporters reinforce this point. Among these companies, 60% expect to grow market share or expand their client base, 54% anticipate higher profitability, and nearly half expect lower costs.⁴ These are not typical compliance outcomes. While the survey does not directly attribute these benefits to governance practices, it highlights the growing importance of sustainability information that is supported by clear ownership, documented methodologies and robust evidence trails. These foundations can improve reporting preparedness, reduce manual reconstruction of information, and support more efficient assurance activities.

There is also the assurance cost argument. According to estimates from the European Financial Reporting Advisory Group (EFRAG), first-year limited assurance costs for listed companies range from €108,000 to €162,000. For reasonable assurance, that range rises to €246,000 to €394,000.⁵ These costs are not fixed. They are heavily influenced by how much reconstruction work the assurance provider needs to do. When controls are established, documented and supported by evidence, they can significantly reduce the need for substantive testing. Well-governed sustainability programs are typically better prepared for assurance activities, supported by clearer documentation, stronger evidence trails, and more efficient responses to assurance requests.

The regulatory resilience argument is also increasingly material. Reporting requirements continue to evolve, and the CSRD Omnibus simplification has materially changed scope thresholds and disclosure timelines for many companies. In this environment, governance infrastructure provides a foundation for managing change by maintaining documented methodologies, decision rationales, ownership structures and regulatory monitoring processes. Without these elements, organizations may need to reconstruct prior decisions and reassess implementation approaches when requirements change.

A practical governance framework

Building governance does not require reinventing the sustainability program. It requires systematizing what is already in place. The following five-step framework offers a practical starting point.

Step 1: Define ownership and accountability

Map each material topic and disclosed metric to named owners: who collects the data, reviews it, approves it for reporting and escalates issues when needed. A documented RACI model should be the baseline. Clear governance structures, with defined remits and regular meeting cadences, help connect individual accountability to broader oversight. Board-level priorities should also flow through to operational responsibilities so data owners understand how their role supports the organization’s sustainability goals.

Step 2: Document processes and methodologies

For each disclosed metric, companies should document the calculation methodology, data sources, estimation approaches and allocation decisions in a format that a new team member, auditor or regulator can follow. Process maps should show how data is collected, reviewed, aggregated and reported. Methodology documents also need version control, including effective dates, change history and approval records.

Step 3: Establish internal controls

Controls do more than catch errors; they create a defensible record that the process was followed. In this context, internal controls may include review checkpoints, management approvals before consolidation, automated data quality checks in reporting platforms and evidence retention requirements for source data. The Committee of Sponsoring Organizations of the Treadway Commission (COSO) framework, widely used in financial reporting, offers a useful structure for sustainability controls, but it should be adapted to the specific characteristics of sustainability data. 

Step 4: Build governance maintenance processes

A sustainability governance framework quickly loses relevance if it is not maintained. Annual reviews of material topics, methodologies and ownership assignments help keep it current. Systematic regulatory monitoring helps organizations identify changes before they create compliance gaps, rather than relying on individuals to spot updates. Trigger-event protocols, such as significant acquisitions, scope changes or key personnel departures, help governance adapt to organizational change instead of falling behind it.

Step 5: Prepare for audit and assurance

Audit readiness should be built throughout the reporting cycle, not left until the end. Evidence repositories should be organized for quick retrieval, and sample-based control testing should take place before the assurance engagement begins to identify gaps early. Pre-assurance walkthroughs with internal audit or an external adviser can help teams review the evidence trail. For organizations moving from limited to reasonable assurance, the required increase in control rigor is significant and should be planned well ahead of the reporting cycle.

Where organizations stand and what to do next

Most organizations that assess their sustainability programs reach a similar conclusion: reporting capabilities are often more mature than the governance structures that support them. This is not a failure of intent but a predictable result of  programs built around regulatory deadlines, stakeholder pressure and urgent disclosure requirements rather than long-term system design.

The practical question for many organizations is where to start. In most cases, the highest-priority interventions are ownership documentation, methodology documentation and regulatory monitoring. Together, these elements help establish clear accountability, support consistent reporting practices and enable organizations to respond more effectively to evolving regulatory requirements.

This distinction is particularly important because governance challenges are often mistaken for technology challenges. Many organizations have invested significantly in sustainability software, expecting improved reporting capabilities to resolve broader governance issues. However, technology and governance serve different purposes.

Organizations that have invested significantly in sustainability software should be aware that technology is not a substitute for governance. Reporting platforms can automate data flows, but they do not define data ownership, verify calculation accuracy or document methodological assumptions. Governance sits above the technology layer; it is not built into it by default.

Within this context, building enterprise sustainability governance infrastructure requires capabilities that go beyond initial sustainability implementation. It brings together internal control design, process documentation, change management, reporting readiness, and technical expertise across sustainability standards, reporting requirements, and the evolving regulatory landscape. These capabilities provide the practical foundation for the governance framework described above, translating accountability structures, documented methodologies, and regulatory monitoring processes into repeatable reporting practices and day-to-day operations.

The goal is not compliance for its own sake. It is to build the infrastructure that  makes sustainability commitments credible, durable and capable of generating operational and commercial value.