EU Corporate Sustainability Reporting Directive (CSRD): Third-Party Risk Management Considerations

In November 2022, the European Union (EU) Parliament adopted the Corporate Sustainability Reporting Directive (CSRD), a new law that requires companies to report on environmental, social and governance (ESG) matters, including those that arise from their supply chains, as part of their regular company disclosures. This new reporting was developed to address long-standing concerns that non-financial reporting among EU firms was inconsistent and failed to produce reliable progress toward sustainability goals.

Firms required to report on the new standards include large EU companies with more than 250 employees and €40 million in turnover and/or more than €20 million in total assets, as well as all listed companies that have to report against existing Non-Financial Reporting Directive (NFRD) requirements. Reporting begins in January 2025 using 2024 data, so now is the time to consider how the mandate will impact your third-party risk management program.

This post examines the CSRD’s new sustainability standards and provides best practices recommendations for getting ahead of the inevitable third-party vendor and supplier ESG reporting requirements.

CSRD Reporting Standards

The European Financial Reporting Advisory Group (EFRAG), a supporting organization to the EU Council, has been tasked with helping to develop requirements that will inform reporting obligations. The requirements are called European Sustainability Reporting Standards (ESRS) and generally align with traditional environmental, social and governance (ESG) categories, including:

• Environment: climate change; pollution; water and marine resources; biodiversity and ecosystems; and resource use and the circular economy
• Social: own workforce; workers in the value chain; affected communities; and consumers and end users
• Governance: governance, risk management and internal control; and business conduct

In addition, the law includes “cross-cutting standards” including strategy and business model; governance and organization; impacts, risks and opportunities; implementation measures covering policies, targets, actions and action plans; allocation of resources; and performance measurement.

In general, reporting requirements must examine sustainability risk affecting the company, and the company’s impact on society and the environment. Disclosures should also:

• Be certified by an external auditor
• Align with EU Taxonomy
• Be delivered in a single management report that is machine readable

Companies will be required to publish separate sustainability statements as part of their regular management reports. Therefore, to address the reporting requirements against published targets, organizations will need to conduct a thorough due diligence process that includes not only their own internal initiatives, but also those of their third-party vendors, suppliers and partners.

Prepare for CSRD Compliance: Best Practices for ESG and Third-Party Risk Management

To better position your organization to report against your third parties’ ESG impacts, consider these four best practices:

1. Include ESG requirements in supplier contracts to enforce adherence

Since sustainability reporting will now be mandatory, include enforceable ESG provisions in your third-party vendor and supplier contracts. Centralizing ESG provisions in a platform will enable you to automatically create and track key performance indicators (KPIs) against acceptable ESG thresholds and alert suppliers proactively if they are falling short of agreed-upon measures, thereby reducing possible future reporting burdens.

2. Build a comprehensive supplier profile to centralize key ESG metrics

Centralizing key vendor metrics into a single source of the truth and making it available to all internal teams responsible for managing supplier relationships, improves accountability and simplifies reporting. ESG-specific data to centralize can include:

• Environmental: High-level ESG scores and any information on ecological violations
• Social: Modern Slavery statements and business insights
• Governance: Corruption Perception Index (CPI) scores, regulatory findings, and sanctions that could signal poor corporate governance