Mandatory Sustainability Metrics Reporting Has Arrived in America, via Europe

Sustainability reporting in the United States has traditionally been guided by a variety of voluntary standards and frameworks. But such reporting will soon be mandatory for some U.S.-headquartered businesses—by way of Europe and the scope of its Corporate Sustainability Reporting Directive. This initiative, which seeks to bring sustainability reporting up to the level of traditional financial reporting, will have a global impact as its scope expands over time and across jurisdictions. CPAs should become familiar with its requirements in order to advise affected entities, whether an employer, client, or potential business opportunity.

Mandatory sustainability metrics (SM) reporting and third-party assurance of those metrics has arrived in the United States due to the European Union’s Corporate Sustainability Reporting Directive (CSRD). Close to 50,000 companies globally will be directly affected. Over 3,000 of those companies are U.S.-headquartered businesses (https://tinyurl.com/5fufzeh6). Those numbers become much higher once value chain–related disclosures are considered.

The SMs involved go well beyond a narrow climate-related focus. This is evident from looking at the European Sustainability Reporting Standards’ (ESRS) topical standards, which are required for compliance with the CSRD. Those 10 topical standards, ranging from climate change and biodiversity to business conduct and affected communities, require companies to assess the materiality of 70 disclosures, in addition to the 12 general disclosures detailed in ESRS 2. This required assessment is unique to ESRS; it is unlike the materiality assessment guidance companies have seen before from either the International Sustainability Standards Board (ISSB), the successor to the Sustainability Accounting Standards Board (SASB), or the Global Reporting Initiative (GRI).

Overall, the CSRD seeks to bring comprehensive sustainability reporting up to the standards of control and reliability expected of traditional financial reporting, with a conceptual framework familiar to CPAs: comprehensive, comparable, relevant (aka material), understandable, faithful representations. Its required use of third-party assurance represents additional engagement opportunities for CPAs, whether a company is directly within the scope of the CSRD or caught up in the numerous value chain disclosures also assessed.

Background

For years, sustainability [sometimes referred to as environmental, social, & governance (ESG)] reporting has been guided by various voluntary reporting frameworks, such as SASB, GRI, and the Taskforce on Climate-related Financial Disclosures (TCFD). That is about to change to mandatory reporting, thanks to a number of international and domestic initiatives. This article focuses on one such international initiative with consequences for U.S. entities, the EU’s CSRD.

Some elements of this overall transformation of sustainability reporting from a strictly voluntary “best practices” exercise to a mandatory compliance exercise became evident in 2023. This was the year in which:

• ▪ The European Corporate Sustainability Reporting Directive (CSRD) went into effect on January 5, 2023.
• ▪ The IFRS Foundation’s International Sustainability Standards Board (ISSB) issued its first two sustainability standards. Those two IFRS sustainability standards are now in the process of being explicitly adopted, individually, by each jurisdiction that is a member of the International Organization of Securities Commissions (IOSCO). Such adoption does not occur automatically based on a jurisdiction’s prior acceptance of IFRS for financial accounting purposes.
• ▪ The SEC completed its public consultation period prior to adopting a finalized version of its climate-related disclosure rule on March 6, 2024 (https://www.sec.gov/newsroom/press-releases/2024-31). Almost immediately thereafter, March 15, 2024, a federal appellate court imposed a temporary stay on enforcement of these new requirements, and on April 4, 2024, the SEC agreed to stay these new climate-related disclosure requirements pending a review by the Eighth Circuit U.S. Court of Appeals. As of this writing, this appeal has yet to be concluded.
• ▪ California enacted two new climate-related disclosure bills on October 7, 2023 (https://tinyurl.com/y685dvfe).

Both the CSRD and the California laws create mandatory disclosure requirements for both publicly traded and privately held companies. The sustainability disclosure standards from the ISSB are in the process of being adopted across the globe, much as the IASB’s standards had to be adopted on a jurisdiction-by-jurisdiction basis in the past. Each of these jurisdictions is being encouraged to provide the same enforcement as they have the IASB standards via their own individual Securities Commissions. Some evidence of this may be seen in the IOSCO’s July 25, 2023, media release (https://www.iosco.org/news/pdf/IOSCONEWS703.pdf). The requirements in the ISSB sustainability standards may go beyond publicly traded businesses, given separate jurisdiction-by-jurisdiction regulatory and capital provider actions. The SEC’s climate-related disclosure rule is directed towards publicly traded companies; here again, enforcement relies on the regulation of public securities exchanges.

Thus far, both the SEC’s climate-related disclosures regulation and the California climate-related disclosure laws have been challenged in U.S. courts, leading many businesses to take a wait-and-see approach before investing in compliance efforts.

In contrast, relief via U.S. courts, or courts in other jurisdictions, is considered very unlikely with respect to the CSRD and ISSB standards. Both of these standards ask for much more than climate-related disclosures alone. It is also worth noting that compliance with CSRD and its related European Sustainability Reporting Standards (ESRS) would almost, if not completely, satisfy compliance with the ISSB standards. The implication of this lopsided interoperability between CSRD and ISSB’s S1 and S2 is that more businesses and their advisors are focused on the challenge of complying with the CSRD.

The timeline for that compliance is truly short, with some U.S.–headquartered businesses already required to issue reports on fiscal years starting on or after January 1, 2024—in 2025, at the same time, and as part of, their fiscal 2024 financial statements. While those earliest reports will likely be limited to their European-based subsidiaries or branches, by the time they issue their fiscal 2028 reports in 2029, CSRD compliance will mean coverage of their full global consolidated operations.

Scope

CPAs should ask themselves if their business or their client’s business is directly in scope, and, if so, when does mandated reporting begin?

Given the aforementioned time-line, it is critical that all businesses with a presence in Europe, including U.S.-headquartered businesses, act now to determine if they are already in scope of the CSRD. This is accomplished by answering the following questions:

• ▪ Does the entity have any debt or equity securities listed on an EU-regulated market? If yes, then it is subject to CSRD, with limited exemptions available.
• ▪ Does the entity own an EU entity that meets the definition of a “large” undertaking? This is determined based on that entity exceeding at least two of the following three metrics on two consecutive balance sheet dates:
  • Total assets of €25 million (about $28 million as of Dec. 31, 2023)
  • Net turnover (revenue) of €50 million (about $55 million as of Dec. 31, 2023)
  • Average of 250 employees.

   

• ▪ Does the entity have more than 500 employees?

A company (aka undertaking) answering yes to these first three questions is already obligated to report under CSRD for their fiscal year beginning after January 1, 2024, when they issue those reports in 2025.

A company that answers no to questions one and three must then consider question two for both an individually owned EU entity and for ownership of an EU holding company or an EU intermediate entity that is the parent of a “large” group, determined on a consolidated basis as exceeding at least two of the following three metrics on two consecutive balance sheet dates:

• ▪ Total assets of €25 million (about $28 million as of Dec. 31, 2023)
• ▪ Net turnover (revenue) of €50 million (about $55 million as of Dec. 31, 2023)
• ▪ Average of 250 employees.

A company that answers yes to question two for ownership of either a single EU entity or an EU holding company or EU intermediate parent company and its subsidiary entities will be obligated to report under CSRD for their fiscal year beginning after January 1, 2025, when they issue those reports in 2026.

During these early years, CSRD allows for reporting at various different levels to achieve compliance. These levels include:

• ▪ the individual scoped-in entity level or parent/holding company level,
• ▪ using an artificial consolidation of scoped-in entities, and
• ▪ the global consolidated level.

By the time reports for fiscal years starting after January 1, 2028, are issued in 2029, non-EU headquartered companies will be required to issue a CSRD compliant report at their global consolidated level if:

• ▪ At least one entity in their consolidated group is within the scope of CSRD, or
• ▪ At least one EU branch generated net revenue greater than €40 million (about $44 million)
• ▪ And, in addition to one of the above being true, their consolidated net revenues generated in the EU exceeds €150 million (about $165 million) for each of their last two consecutive fiscal years.

Even this most distant future period mentioned in Exhibit 1 is not far away. For more about the subtleties of being within scope and choices of levels at which to report, see PricewaterhouseCoopers’ “Worldwide impact of CSRD—are you ready” (https://tinyurl.com/mr3hjn3s).

What Does Being in-Scope Mean?

The process of determining whether an entity is in scope and for which reporting periods will likely be handled by a company’s CFO and general counsel. In contrast, the ability to issue a CSRD-compliant report will require a cross-functional task force with representatives from the sustainability team, finance, IT, investor relations, legal, and others—particularly those with oversight responsibility for the entities with a reporting obligation (https://tinyurl.com/2y2zek6p).

To understand why a cross-functional team will be needed, consider what is expected from a CSRD-compliant report.

First, stated simply, it requires an entity (aka undertaking) to issue a sustainability report using the ESRS as part of its annual mandatory financial filings. While many large businesses have some experience issuing separate sustainability reports using a variety of voluntary standards, very few issue those sustainability reports simultaneously with their annual financial filings. Beyond this timing challenge, most businesses have never before encountered a sustainability reporting framework as extensive as that represented by the ESRS, let alone one that is now mandatory.

There is some comfort in knowing that the ESRS was written in consultation with groups that many businesses have some experience with, such as the GRI standards and the ISSB standards (which encompass the SASB standards and the recommendations of the TCFD). Still, while these consultations may have yielded some interoperability with GRI and ISSB, the ESRS requires a greater level of detail, covers a broader array of sustainability topics, and it introduces an innovative approach for determining materiality.

As shown in Exhibit 2, ESRS currently consists of two cross-cutting mandatory standards, five environmental topical standards, four social topical standards, and one governance topical standard.

Unlike the general disclosures covered in ESRS 2, all of the topical standards are only required once they are deemed material based upon the reporting entity’s double materiality assessment.

Beyond these twelve existing standards, new sector (aka industry) specific standards are expected to be issued by 2026. Non–EU company-specific standards are also expected by then. Even though those non–EU company-specific standards are expected to be somewhat less demanding, few are advised to wait until then before preparing to issue reports under the currently available standards.

The names of these topical standards indicate that the ESRS goes well beyond concern over climate change. Even though only one of those topical standards mentions “value chain” in its title, all of them, other than ESRS S1, Own Workforce, include value chain–related metrics for disclosure. Of the nearly 1,100 data points defined for disclosure, given that an entity’s double-materiality assessment process determines it to be material, nearly 200 are value chain related.

The CSRD and ESRS have set out to require reports with information that has the primary qualitative characteristics of being relevant and faithful representation, along with the enhancing qualitative characteristics of comparability, verifiability, and understandability. These characteristics match the expectations of FASB’s own conceptual framework. Indeed, this new European regulatory initiative sets out to bring sustainability related reporting up to the same exacting standards as have existed for traditional required annual financial reporting.

For a company to determine what topics, along with their related disclosures and data-points, they are required to disclose, they must first perform a “double materiality” assessment. A double materiality assessment involves looking at sustainability matters from both an—

• ▪ inside-out perspective of impacts from the company’s activities and actions on individuals, society, and/or the environment, and
• ▪ an outside-in perspective of financial risks and opportunities to the company itself from social, environmental, and governance performance.

A “double materiality” assessment must consider an entity’s dependencies on natural, human, and social resources, and it must include stakeholder input as well as considerations from across an entity’s value chain. Sustainability topics deemed material as a result of this assessment are referred to as an entity’s Impacts, Risks, and Opportunities (IRO), and, therefore, they will be the topics included in that company’s sustainability report.

The ESRS’s existing twelve standards (Exhibit 2) provide eighty-two possible disclosures, supported by 1,100 data points (Governance & Accountability Institute, Resource, “CSRD Requirements for Non-EU Companies”). The good news is that each company gets to decide, based on their own double materiality assessment, which of those disclosures and related data points require inclusion in their CSRD-compliant report. There are some exceptions, primarily: the general descriptive disclosures in ESRS 2, the climate change related disclosures in ESRS E1, and other items defined as “principle adverse indicators” (PAI) by Europe’s Sustainable Finance Disclosure Regulation (“Principal Adverse Impact (PAI) Disclosures under the SFDR,” Deloitte Netherlands, https://tinyurl.com/y7zj9nh8).

Once a company has completed its double materiality assessment and determined its other mandatory disclosures, it is positioned to conduct a “gap analysis” between the disclosures understood as required for CSRD compliance and the metrics they already track, either for their existing voluntary sustainability reporting or for their own management purposes. From this point, other significant tasks are as follows:

• ▪ Identify a source, or sources, for the identified missing disclosures and data points; this includes communicating with relevant members of their value chain.
• ▪ Strengthen the control and quality assurance environment around all sustainability disclosures to meet the standards expected for traditional annual financial reporting.
• ▪ Prepare to provide the EU’s Taxonomy disclosures simultaneously with their annual ESRS and financial reports (PricewaterhouseCoopers, “European Union regulations beyond CSRD,” https://tinyurl.com/kkfxbhbm).
• ▪ Build the necessary capacities across the cross-functional participants in their organization and encourage the same from their auditors and other value chain–related stakeholders.
• ▪ Integrate the additional, higher quality, sustainability-related metrics into their strategic and tactical managerial processes.
• ▪ Prepare for the now-required third-party assurance—initially only limited assurance but anticipated to become reasonable assurance engagements equivalent to those required for annual financial statement audits.

Other Resources

Given the natural limits on the length, and therefore depth, of any article, in addition to the complexity of compliance with CSRD, Exhibit 3 provides a list of freely accessible resources. These resources will provide interested readers with the depth required to fully understand the challenges and opportunities that compliance with CSRD presents.

Being Proactive

Mandatory sustainability reporting has come to the United States via Europe’s recent Corporate Sustainability Reporting Directive. Compliance may not be easy, and deadlines will not be delayed by the U.S. court system. Compliance with this regulation will require considerable work and capacity-building, across numerous functions, within a scoped-in business entity. Even among those entities expecting to report in 2025, based on 2024 data, only a third have completed their double materiality assessment (PricewaterhouseCoopers, “Global CSRD Survey 2024—The Promise and Reality of CSRD Reporting,” https://tinyurl.com/mr9pdn8j).

While time may be short, there is still an opportunity to learn what CSRD compliance means for a CPA’s business or clients’ businesses. If you know that an entity is a vendor to or buyer from a European-based business, proactively assisting them with their compliance efforts regarding their value chain will likely be rewarded by efficiencies and a strengthened relationship. Even if a client or employer is not already a vendor to or buyer from a European-based business, CPAs should not let the appearance of complexity, or geographic distance, deter them from at least becoming conversant in the EU’s CSRD. New assurance and advisory engagements may be only one new vendor contract away.