CSRD gap analysis checklist: evidence, controls and reporting risks
CSRD gap analysis checklist for companies preparing evidence, controls, assurance readiness, supplier data and reporting decisions under ESRS.
A CSRD (Corporate Sustainability Reporting Directive) gap analysis is not a paperwork exercise. It is the test of whether a company can prove its sustainability story with the same discipline it applies to financial reporting: scope, evidence, controls, owners and decisions.
Quick answer
A useful CSRD gap analysis answers four questions: are we in scope, which European Sustainability Reporting Standards (ESRS) topics are material, what evidence and controls already exist, and which gaps could affect reporting, assurance or customer trust. The output should be a prioritised delivery plan, not a red-amber-green spreadsheet with no owner.
The central mistake is to treat CSRD readiness as a disclosure-writing job. Wording matters late in the process. The harder work comes earlier: deciding which entities are in scope, proving the materiality process, finding source data, assigning owners, documenting estimates and creating a review trail that an assurance provider can inspect.
What changed and why gap analysis still matters
The first companies subject to CSRD apply the rules for the 2024 financial year, with reports published in 2025. The European Union's stop-the-clock Directive postponed application for companies that would previously have reported for the first time for financial years 2025 or 2026. The Commission has also proposed wider simplification through the Omnibus package, including a narrower focus on larger companies, and adopted a quick-fix for wave one companies while broader ESRS revisions continue.
That creates an awkward but important point for companies: timing uncertainty is not the same as evidence certainty. A company may move out of direct near-term scope, but still face customer, lender, parent-company or investor questions shaped by CSRD. A good gap analysis should therefore separate direct legal duty from commercial exposure and evidence readiness.
The four outputs that matter
| Output | Question answered | What good looks like |
|---|---|---|
| Scope memo | Which entities, subsidiaries, branches and value-chain relationships matter? | A dated scope view, source assumptions and owner for future changes. |
| Materiality map | Which sustainability topics need detailed assessment under ESRS? | Documented double materiality process, evidence sources and decision rationale. |
| Data and control register | Can each metric be sourced, reviewed and explained? | Data owner, system, method, evidence location, control owner and known weaknesses. |
| Remediation tracker | Which gaps need action before reporting or assurance? | Priority, owner, deadline, dependency and proof of closure for each gap. |
CSRD gap analysis checklist
| Area | Questions to ask | Output |
|---|---|---|
| Scope | Which EU entities, non-EU parent links, listed status, thresholds, exemptions and customer relationships matter? | Scope conclusion with assumptions and next review date. |
| Timeline | Which reporting year, transposition rule, stop-the-clock effect or customer deadline applies? | Milestone calendar that separates legal reporting from customer data requests. |
| Materiality | Has double materiality been assessed, evidenced and approved? | Material topic list with stakeholder, impact, risk and opportunity rationale. |
| ESRS coverage | Which ESRS disclosure requirements are relevant after materiality decisions? | Disclosure requirement map, including omitted topics and reasons. |
| Data | Which metrics are measured, estimated, missing or held outside central systems? | Data inventory and data quality score. |
| Controls | Who prepares, reviews, approves and signs off each material data point? | Control owner matrix and evidence folder. |
| Assurance | Can the company show method, source files, approvals and version history? | Assurance readiness plan and evidence sample. |
| Supplier evidence | Which suppliers or customers create data pressure even where the company is outside direct scope? | Supplier request plan and customer response pack. |
| Claims | Which public climate, social, nature or governance claims rely on weak evidence? | Claims review list with wording changes and substantiation files. |
Documents to collect first
Start with documents that prove the boundary of the project. That usually means group structure, entity lists, ownership charts, EU revenue or listing exposure, reporting calendars, existing annual reports, sustainability reports, policies, targets, risk registers and board papers.
Then collect the operational evidence: emissions inventories, calculation methods, energy data, supplier questionnaires, procurement policies, workforce data, incident records, grievance processes, compliance logs and evidence behind public green claims. The purpose is not to create a giant folder. It is to find which data points can survive review and which only exist as narrative.
Gap register example
| Gap | Risk | Owner | Priority | Next action |
|---|---|---|---|---|
| No documented materiality threshold. | Disclosure decisions may be hard to defend. | Sustainability and finance. | High | Agree scoring method and board validation route. |
| Scope 3 supplier data is incomplete. | Climate disclosure may rely too heavily on estimates. | Procurement. | High | Segment suppliers and launch a targeted data request. |
| Workforce metrics use inconsistent definitions. | Group reporting may be unreliable. | People team. | Medium | Standardise definitions and evidence exports. |
| Policies are not linked to actions or targets. | The report may become narrative-heavy. | Legal and operations. | Medium | Map policy commitments to evidence of implementation. |
Prioritise by reporting risk
Not every gap deserves the same urgency. A missing policy for a non-material topic is less urgent than weak evidence for a material climate metric. A supplier data gap may be commercially urgent even where the company is not directly in CSRD scope, because a major customer may still need data for its own reporting.
| Priority signal | Why it matters | Typical response |
|---|---|---|
| Material topic | The issue affects the sustainability statement or a key judgement. | Assign a senior owner and evidence deadline. |
| Assurance weakness | The data exists, but the source, method or approval trail is weak. | Create method notes, source files and review controls. |
| Customer pressure | A buyer, lender or parent company needs information before legal reporting starts. | Build a reusable response pack and approve wording. |
| Public claim risk | The company has made a claim that the evidence file does not support. | Substantiate, qualify or remove the claim. |
| Slow remediation | The fix depends on systems, suppliers or governance decisions. | Start early and track dependencies. |
30, 60 and 90 day plan
In the first 30 days, confirm scope, assign owners and collect existing reports, policies and data exports. By day 60, run the materiality and data gap review, then identify the gaps that threaten reporting, assurance or customer requests most directly. By day 90, agree a remediation plan, launch supplier data requests where needed and build the evidence folder structure.
The plan should be short enough to govern. A useful tracker includes the gap, risk, owner, evidence needed, deadline, dependency, status and proof of closure. If it cannot be reviewed in a monthly project meeting, it is probably too complicated.
Ownership model
| Workstream | Responsible | Accountable | Consulted |
|---|---|---|---|
| Materiality assessment | Sustainability lead | Finance director or board sponsor | Risk, legal, operations, people team, procurement. |
| Climate data | Sustainability and facilities | Finance | Procurement, logistics, information technology. |
| Workforce data | People team | People director | Legal, finance. |
| Supplier data | Procurement | Operations or commercial director | Sustainability, legal. |
| Assurance readiness | Finance | Finance director | Sustainability, internal audit, legal. |
Evidence examples by ESRS area
| Area | Evidence examples | Typical weakness |
|---|---|---|
| Climate | Emissions inventory, transition actions, energy data, target methodology. | Scope 3 estimates with unclear assumptions. |
| Pollution and resources | Permits, waste records, material use, incident logs. | Operational data held locally with no group standard. |
| Own workforce | Workforce metrics, policies, training records, grievance processes. | Definitions differ between entities. |
| Value-chain workers | Supplier codes, audit results, risk screening, remediation records. | Supplier policies exist but implementation evidence is thin. |
| Business conduct | Anti-bribery policy, training, whistleblowing records, board oversight. | Policy exists but no monitoring evidence. |
Customer and supplier exposure
Some companies are not directly in scope for CSRD but still face CSRD-style requests from customers, lenders or parent companies. The gap analysis should therefore ask who may request data from the company, what they are likely to request and which answers are already credible. This is especially important for UK suppliers selling into EU groups.
The practical output is a customer response pack: entity boundary, emissions summary, data quality note, policies, reduction actions and approved wording for common questions. That pack can reduce tender friction even before formal reporting applies.
Practical next step
Facing a CSRD-style customer request, supplier questionnaire, Scope 3 data request or green-claims review? ClearerWeb is a quick 22-question audit that gives you a useful answer without wasting your afternoon.
In a few minutes, you get a free snapshot of your exposure, readiness and evidence gaps. The full report turns those answers into a more detailed action plan.
ClearerWeb is owned by the same publisher as The Planet Brief. It is a compliance preparation tool, not legal advice.
What not to do
Do not let the gap analysis become a consultant report that sits outside the reporting process. It should become a working tracker. Each gap needs an owner, deadline and proof of closure. It should be reviewed in the same cadence as other reporting readiness work.
Do not overfocus on disclosure wording before fixing the data. Wording can be polished late. Missing owners, weak controls and absent evidence need more time.
Board update format
A CSRD gap analysis should produce a board-level update that is short enough to use. It should summarise the scope conclusion, the most material reporting risks, the biggest evidence gaps, the decision points requiring leadership judgement and the resources needed before the next reporting milestone.
A useful board update can use five headings: scope, materiality, data readiness, assurance readiness and commercial exposure. Under each heading, include the current status, the highest risk gap, the owner and the next decision required. This helps the work move from a sustainability exercise into normal governance.
FAQ
Is a CSRD gap analysis only for companies directly in scope?
No. It can also help suppliers, subsidiaries and UK companies with EU customers understand which data requests may be coming and which evidence gaps could affect commercial relationships.
Should the gap analysis happen before double materiality?
The two are linked. A preliminary gap review can show what data exists, but the double materiality assessment should determine which topics need the most detailed reporting work.
Does Omnibus mean companies can stop preparing?
No. It may change timing or scope for some companies, but it does not remove customer pressure, investor expectations or the need to substantiate sustainability information. Treat simplification as a reason to focus the work, not to abandon evidence.
CSRD and ESRS changes to monitor
Watch for final European Union decisions on CSRD or ESRS simplification, revised ESRS, national transposition changes and new European Financial Reporting Advisory Group (EFRAG) guidance on materiality, value-chain information or small-business reporting. Those updates can change timing, scope and the evidence a company should prioritise.
Useful sources
- European Commission: corporate sustainability reporting
- European Commission: CSRD implementation FAQ
- European Commission: ESRS quick-fix update
- European Commission: VSME recommendation
- EFRAG: ESRS
Data checked
Checked on 24 June 2026 against European Commission corporate sustainability reporting pages, ESRS material from the European Financial Reporting Advisory Group (EFRAG), the CSRD stop-the-clock update, the ESRS quick-fix update and the Commission's Voluntary Sustainability Reporting Standard for non-listed small and medium-sized enterprises (VSME) recommendation.
Information only
This guide is for general information only. It is not legal, accounting, regulatory, tax, procurement, investment or financial advice. Corporate Sustainability Reporting Directive (CSRD) scope, European Sustainability Reporting Standards (ESRS), national transposition, customer requests and assurance expectations can change. Check current official sources and professional advice before relying on this for compliance, reporting or tender decisions.