The Corporate Sustainability Reporting Directive (CSRD) is the EU's most ambitious sustainability disclosure requirement to date. The first wave of large listed companies filed their initial CSRD reports in early 2025. The second wave — large non-listed EU companies with over 250 employees and €40M turnover — is reporting from financial year 2025. For many finance teams, the question is no longer whether they need to comply, but how to get it right under intense time pressure.
Understanding the Phased Scope
CSRD applies in waves based on company size and listing status:
- Wave 1 (FY2024) — Large listed EU companies already subject to NFRD (around 50,000 employees or listed)
- Wave 2 (FY2025) — Other large EU companies (250+ employees, €40M+ turnover, or €20M+ balance sheet)
- Wave 3 (FY2026) — Listed SMEs (with opt-out available until 2028)
- Wave 4 (FY2028) — Non-EU companies with significant EU operations (€150M+ EU net turnover)
Companies outside the EU with large EU subsidiaries should also note that consolidated CSRD reporting at group level can satisfy subsidiary-level requirements — but only if the group report is filed on time and covers the subsidiary's operations sufficiently.
The Double Materiality Assessment — Where Most Companies Struggle
At the heart of CSRD is the double materiality assessment (DMA). Unlike traditional financial materiality, double materiality requires companies to assess both:
- Impact materiality — how the company's activities affect people and the environment (inside-out perspective)
- Financial materiality — how sustainability matters create financial risks and opportunities for the company (outside-in perspective)
The DMA determines which of the European Sustainability Reporting Standards (ESRS) topics you must report on. Only topics identified as material need to be fully disclosed. However, the process of conducting and documenting the DMA is itself subject to limited assurance — so methodology and evidence matter as much as outcomes.
"The double materiality assessment is not a tick-box exercise. It is an evidence-based process that will be scrutinised by assurance providers, regulators, and investors alike."
The ESRS Framework: What You Are Reporting Against
CSRD reports must be prepared in accordance with the European Sustainability Reporting Standards (ESRS), issued by EFRAG. The framework comprises:
- ESRS 1 & 2 — General requirements and general disclosures (mandatory for all in-scope companies)
- Topical ESRS — Environment (E1–E5), Social (S1–S4), Governance (G1) — required only where material
ESRS 2 alone contains over 80 disclosure requirements covering governance, strategy, materiality process, and metrics. E1 (Climate Change) is treated as presumptively material — meaning companies that conclude it is not material must provide explicit reasoning. Most companies will report on E1, S1 (Own Workforce), and G1 (Business Conduct) as a minimum.
Building the Data Collection Process
The volume of quantitative and qualitative data points required under ESRS is substantial. Finance teams must build or adapt data collection processes that span HR, procurement, operations, legal, and facilities — functions that have never previously contributed to financial reporting. Key steps include:
- Map each ESRS disclosure requirement to the data owner and source system
- Assess data quality, coverage gaps, and estimation methodologies
- Establish internal controls over sustainability data with the same rigour as financial data
- Document assumptions, estimation bases, and any use of proxies
Assurance: Limited Now, Reasonable Later
CSRD requires limited assurance from the first year of application, with a pathway to reasonable assurance (the same standard as a financial audit) from 2028. In practice, limited assurance still requires auditors to examine your DMA methodology, data collection processes, and internal controls. Companies that treat CSRD as a narrative exercise rather than a controlled reporting process will find the assurance process difficult and time-consuming.
Common First-Year Mistakes to Avoid
- Starting the DMA too late — it needs to be completed before the reporting period to inform data collection
- Treating CSRD as a communications function rather than a finance-led controlled reporting process
- Underestimating the Scope 3 emissions data challenge — supplier engagement takes months
- Failing to align the sustainability report and the financial statements on key narrative disclosures
- Not engaging the audit committee early on DMA methodology and assurance scope