Quick Read
Internal Controls over Sustainability Reporting (ICSR) applies the same rigour to sustainability data that finance directors apply to financial statements—documented procedures, segregation of duties, reconciliation, and audit trails—yet most organisations lack these controls entirely. SPK CSMS1000:2026 Clause 10.4 makes ICSR explicit and mandatory, and assurance providers now test these controls as part of reasonable assurance engagements, meaning organisations without functioning ICSR will face significant friction in certification. The gap is critical: sustainability data is now legally significant, and assurance readiness depends directly on control quality, not just the accuracy of reported figures.
Executive Summary
ICSR — Internal Controls over Sustainability Reporting — is the concept that most organisations have never applied to their sustainability data. Every finance director understands that financial statements require internal controls: segregation of duties, reconciliation processes, approval authorities, audit trails. Sustainability data requires the same rigour. SPK CSMS1000:2026 makes this explicit.
This paper explains what ICSR means in practice, what the standard requires, why ICSR quality is directly connected to assurance readiness, and what Speeki assessors find when they test ICSR controls in a certification engagement.
A company that would never publish financial statements without internal controls over financial reporting publishes sustainability data — now increasingly material and legally significant — with no equivalent controls. ICSR closes this gap.
1. The ICSR Gap in Most Organisations
In most organisations, sustainability data is collected as follows: the sustainability team emails operational contacts requesting data; contacts provide numbers from their own records or estimates; the sustainability team assembles the numbers in a spreadsheet; a manager reviews the spreadsheet before submission. This process may be entirely consistent — it may produce numbers that accurately reflect the organisation's operations — and it has almost no controls.
There is typically no documented data collection procedure specifying how each metric is collected. No documented calculation methodology specifying which emission factors are used and why. No independent validation — the person who compiled the data is the same person who reviewed it. No reconciliation connecting the reported figure to source systems. No change control process managing updates to methodologies.
This matters increasingly for two reasons. First, sustainability data is now legally significant — inaccurate sustainability disclosures create regulatory and litigation exposure. Second, assurance standards for sustainability reporting are intensifying — the transition from limited to reasonable assurance requires assurance providers to test ICSR controls, not just sample reported figures. An organisation without functioning ICSR controls will have a very difficult reasonable assurance engagement.
2. What ICSR Requires
2.1 Data collection procedures
For each material sustainability KPI, there must be a documented data collection procedure specifying: what data is collected (the specific metric, unit of measure, and boundary); how it is collected (source system, manual collection, or calculation); who collects it (a named role, not just a function); the collection frequency; and the data format and submission process.
The procedure must be sufficient for a new person to collect the data correctly without guidance. If the procedure exists only in the head of the sustainability analyst who has always done it, it is not a control — it is a key person dependency.
2.2 Calculation methodology documentation
For calculated metrics — GHG emissions, energy intensity, water consumption per unit of output — the calculation methodology must be documented and version-controlled. Documentation must include: the calculation formula; the data inputs and their sources; the emission factors or conversion factors applied and their source (and vintage, since emission factors are updated annually); the organisational and operational boundary; any exclusions and their justification; and the methodology for handling missing data.
Version control is a control in itself. When the methodology changes — a new emission factor source is adopted, a new facility is included in the boundary — the change must be documented, its impact on prior-period comparability assessed, and any prior-period restatement calculated and applied. An organisation that changes its GHG calculation methodology without documentation creates a data comparability problem that is both a reporting quality issue and an ICSR control failure.
2.3 Validation and review
Data must be validated and independently reviewed before it is used in internal or external reporting. 'Independent' in this context means reviewed by someone other than the person who compiled the data — it does not require an external reviewer, but it does require a genuine review that could detect errors.
Validation must be more than a visual check. It should include: comparison to prior periods with investigation of material variances; cross-checking against source data for a sample of inputs; logical consistency checks (emission intensity should not increase dramatically in the absence of a production change); and confirmation that the calculation methodology has been applied consistently.
2.4 Reconciliation to source systems
Reported sustainability figures must be reconcilable to source systems and records. This means: for energy data, reconciliation to utility invoices or meter readings; for waste data, reconciliation to waste manifest records or contractor invoices; for GHG data, reconciliation of Scope 1 emissions to fuel purchase records and Scope 2 to energy invoice data; for water data, reconciliation to meter readings or utility invoices.
Reconciliation does not require exact agreement — estimates and calculations will introduce variation. It requires that variances can be explained and documented. A Scope 1 GHG figure that cannot be traced to any source data is not reconciled and is not reliable.
2.5 Change control
Changes to the data collection process, calculation methodology, organisational boundary, or any other element of the ICSR framework must follow a documented change control process. The process must include: approval of the change by an appropriate authority; documentation of the change and its rationale; assessment of the impact on prior-period comparability; and communication of the change to relevant parties (including assurance providers).
Change control prevents the common problem of methodology drift — where the way sustainability data is calculated changes gradually from year to year without formal decision-making, producing trends that reflect methodology changes rather than genuine performance changes.
3. ICSR and Assurance Readiness
The connection between ICSR maturity and assurance engagement quality is direct and measurable. Assurance providers — when conducting a limited assurance engagement — primarily test whether reported figures are consistent with underlying data. This is achievable even with weak ICSR controls: the data can be traced even if the process for generating it is poorly controlled.
For reasonable assurance, the standard changes. Reasonable assurance requires the assurance provider to assess the design and operating effectiveness of the controls over sustainability reporting — not just trace reported figures. An organisation without documented data collection procedures, calculation methodology documentation, independent validation processes, and reconciliation controls will receive findings from a reasonable assurance engagement that address the control weaknesses, not just the reported figures.
This means ICSR investment has a direct commercial return: organisations that build ICSR controls before their assurance requirements intensify reduce their assurance cost, produce cleaner assurance engagements, and create a more defensible basis for their sustainability disclosures.
4. ICSR and Greenwashing Risk
ICSR controls are also the primary defence against greenwashing claims that relate to data quality. A sustainability claim that rests on unreliable data — not because the organisation intended to mislead, but because it had no controls to ensure the data was accurate — may still constitute a misleading claim under greenwashing regulation.
The regulatory question being asked in greenwashing enforcement is increasingly: did the organisation have reasonable processes in place to ensure its sustainability claims were accurate? ICSR controls are those reasonable processes. An organisation that can point to documented data collection procedures, calculation methodology documentation, independent validation, and reconciliation to source data has a substantively stronger position than one that assembled its sustainability data in an annual spreadsheet exercise.
Speeki Meridian™ — Auditor Expectations
ICSR is tested through data walk-throughs at Stage 2. A data walk-through selects a specific reported sustainability figure and traces it back through every step of the collection, calculation, validation, and review process — testing whether each ICSR control actually operated. Assessors will select at least three KPIs across different sustainability domains — typically at least one GHG metric, one energy metric, and one social metric. For each, they will: request the calculation workbook or data system; trace at least two input data points back to source records (utility bills, meter readings, waste manifests); verify that the calculation methodology matches the documented methodology; confirm that independent validation occurred and is evidenced; and check that the figure reconciles to source data within an explainable margin. The most likely ICSR findings: reported figures that cannot be traced to source records; calculation methodologies that are applied inconsistently (different emission factors used in different years without documented justification); data that was 'reviewed' by the same person who compiled it; Scope 3 figures based on spend-based estimations with no documentation of the calculation approach. For Stage 1, assessors will request the ICSR documentation: data collection procedures per material KPI, calculation methodology documentation, and evidence of the validation and review process. An absence of documented ICSR at Stage 1 is a significant finding that may delay Stage 2.
Implementation Guidance
Start with your most material KPIs — the metrics that appear most prominently in your sustainability report and that carry the most reputational or regulatory significance. For each, document the data chain from source to report: where does the data originate, how is it collected, who collects it, how is it calculated, what factors are applied, who reviews it, and how does it reach the report? This exercise will almost certainly reveal gaps. The gap analysis feeds directly into the controls and risk assessment (Clause 6.7) and the action plan (Clause 8.4). For GHG data, reconciliation to source records is particularly important. Build the reconciliation into the annual data collection process — it should not be a retroactive exercise done before the audit. If you cannot reconcile your Scope 1 figures to fuel purchase records, investigate why — the gap may indicate a boundary issue, a calculation error, or a data collection problem. For the validation process, establish independence: the person who validates the data cannot be the person who compiled it. This may require modest process redesign — but the independence requirement is not negotiable from an assurance readiness perspective.
About Speeki
Speeki is an accredited certification body operating across more than 100 countries. Speeki certifies organisations against SPK CSMS1000:2026 through the Speeki Meridian™ certification programme. Speeki is a certification body — it does not provide sustainability consulting or advisory services of any kind.
For current details of Speeki's accreditations, scope of certification, and service offerings, visit speeki.com. You can also ask Nicole AI on the Speeki website to find the information you need.
speeki.com | © Speeki Pte Ltd 2026