CSRD gap analysis checklist: what to review before reporting

A CSRD (Corporate Sustainability Reporting Directive) gap analysis is the bridge between "we may be in scope" and "we know what evidence we need". It should identify reporting duties, missing data, weak controls, unclear owners and topics that need management decisions.

Quick answer: a CSRD gap analysis should review legal scope, ESRS (European Sustainability Reporting Standards) topic coverage, double materiality, data availability, controls, assurance readiness, governance, policies, targets and supplier information. The output should be an action plan, not just a red-amber-green spreadsheet.

Use this checklist with the CSRD guide, main CSRD guide, double materiality guide and ESG assurance explainer.

CSRD gap analysis structure

Gap analysis phases

1. Scoping: identify entities, EU exposure, timelines, existing reports and responsible teams.
2. Materiality: compare current topic coverage with a documented double materiality process.
3. Data inventory: list available metrics, systems, owners, source evidence and data gaps.
4. Controls review: check review, approval, version control and methodology documentation.
5. Action planning: convert gaps into owners, deadlines, priorities and dependencies.

Documents to collect

• Group structure and entity list.
• Existing sustainability reports, policies and targets.
• Emissions inventories and calculation methodology.
• Supplier questionnaires and procurement policies.
• Risk registers and board papers covering climate or ESG (environmental, social and governance) topics.
• HR, health and safety, diversity and workforce data.
• Compliance records, incident logs and grievance processes.
• Evidence for any public green claims.

Gap register example

Prioritise by reporting risk

Not every gap has the same urgency. A missing policy for a non-material topic is less urgent than weak evidence for a material climate metric. A supplier data gap that affects a major customer relationship may be commercially urgent even if the company is not directly in CSRD scope.

30, 60 and 90 day plan

In the first 30 days, confirm scope, assign owners and collect existing reports, policies and data exports. By day 60, run the materiality and data gap review, then identify the gaps that threaten reporting or assurance most directly. By day 90, agree a remediation plan, launch supplier data requests where needed and build the evidence folder structure.

Good output format

A useful gap analysis should give each gap an owner, priority, deadline, dependency and evidence requirement. It should also distinguish between "we do not have the data", "we have the data but not the control", and "we have the control but not the disclosure wording".

RACI (responsible, accountable, consulted and informed) ownership model

Evidence examples by ESRS area

What not to do

Do not let the gap analysis become a consultant report that sits outside the reporting process. It should become a working tracker. Each gap needs an owner, deadline and proof of closure. It should be reviewed in the same cadence as other reporting readiness work.

Do not overfocus on disclosure wording before fixing the data. Wording can be polished late. Missing owners, weak controls and absent evidence need more time.

How to decide what to fix first

Prioritise gaps that affect material topics, external claims, assurance readiness or customer requirements. A missing biodiversity policy may matter if the company has land-use impacts. It may be lower priority for a software company with no obvious biodiversity exposure. A weak Scope 3 data process may be urgent if large customers are already asking for supplier emissions.

A simple priority score can combine materiality, deadline, evidence weakness, commercial risk and remediation effort. This keeps the plan practical rather than turning every missing document into a top-priority task.

Board update format

A CSRD gap analysis should produce a board-level update that is short enough to use. The update should not list every missing file. It should summarise the scope conclusion, the most material reporting risks, the biggest evidence gaps, the decision points requiring leadership judgment and the resources needed before the next reporting milestone.

A useful board update can use five headings: scope, materiality, data readiness, assurance readiness and commercial exposure. Under each heading, include the current status, the highest risk gap, the owner and the next decision required. This helps the work move from a sustainability exercise into normal governance.

Customer and supplier exposure

Some companies are not directly in scope for CSRD but still face CSRD-style requests from customers, lenders or parent companies. The gap analysis should therefore ask who may request data from the company, what they are likely to request and which answers are already credible. This is especially important for UK suppliers selling into EU groups.

The practical output is a customer response pack: entity boundary, emissions summary, data quality note, policies, reduction actions and approved wording for common questions. That pack can reduce tender friction even before formal reporting applies.

FAQ

Is a CSRD gap analysis only for companies directly in scope?

No. It can also help suppliers, subsidiaries and UK companies with EU customers understand which data requests may be coming and which evidence gaps could affect commercial relationships.

Should the gap analysis happen before double materiality?

The two are linked. A preliminary gap review can show what data exists, but the double materiality assessment should determine which topics need the most detailed reporting work.

Useful sources

• European Commission: corporate sustainability reporting
• EFRAG: ESRS
• EFRAG: materiality assessment guidance