ESG reporting has moved a long way from the glossy, largely voluntary sustainability brochures of a decade ago. Investors now factor ESG performance into capital allocation decisions. Regulators are introducing mandatory disclosure requirements in multiple jurisdictions. Auditors are being asked to provide assurance over sustainability metrics with the same rigour once reserved for financial statements. Customers and partners increasingly expect the numbers behind a company’s sustainability claims to hold up to scrutiny.

All of this scrutiny rests on one assumption that rarely gets examined: that the underlying data is accurate, complete, and hasn’t been tampered with. Yet very little of the conversation around ESG reporting addresses how that data is actually protected, and who has the ability to change it.

The Governance Pillar Everyone Forgets

ESG is usually discussed as three separate pillars – environmental, social, and governance – but governance is often treated as the least tangible of the three, limited to board composition, executive pay, and anti-corruption policy. In practice, governance also has an operational dimension: how well a company controls its own systems and data.

Consider what modern ESG reporting actually depends on. Emissions data pulled from energy management systems. Supply chain compliance records maintained across multiple vendor portals. Health and safety incident logs. Diversity and workforce data drawn from HR platforms. Water and waste figures fed from facility-level monitoring tools. Every one of these data sources sits inside a system that someone, somewhere, has the ability to access, edit, or delete.

If that access isn’t tightly controlled, the integrity of the entire ESG report is only as strong as the weakest system feeding into it. A single unauthorised change to an emissions figure, whether malicious or accidental, can undermine a report that took months to compile – and once uncovered, that kind of discrepancy tends to attract exactly the sort of scrutiny that fuels greenwashing accusations, regulatory inquiries, and reputational damage that vastly outweighs the original error.

Why This Is a Governance Issue, Not Just an IT Issue

It’s tempting to file data protection under “IT’s problem.” But the governance implications are squarely a business leadership issue:

Accountability. When ESG disclosures are challenged, boards and executives are the ones answering to investors and regulators – not the systems administrators who set up access permissions years earlier.

Assurance readiness. As third-party assurance over ESG data becomes more common, auditors increasingly ask not just “is this number correct,” but “how do you know it hasn’t been altered, and by whom.” Companies that can’t answer this clearly face longer, costlier assurance processes.

Stakeholder trust. Investors and partners who rely on ESG disclosures to make decisions are, in effect, trusting a company’s internal controls as much as its stated commitments. Weak data governance quietly undermines that trust even when nothing has gone wrong yet.

What Good Data Governance Looks Like in Practice

Companies that treat ESG data with the same rigour as financial data tend to share a few practices in common:

• Least-privilege access, so that only the people who genuinely need to edit sustainability or compliance data can do so, rather than broad, standing access across departments
• Clear audit trails, showing exactly who accessed or changed a given data set, and when
• Time-limited access, so permissions granted to a consultant, auditor, or temporary project team are automatically revoked once the work is done
• Segregation of duties, so the person compiling a report isn’t also the sole person able to alter the source data unchecked

These principles sit under the broader umbrella of privileged access management – controlling who holds elevated, administrative-level access to the systems that matter most. Businesses managing this at scale increasingly turn to purpose-built platforms; PAM solutions can provide the access controls and audit visibility needed to support this kind of data integrity, alongside the broader set of governance practices above.

Governance Maturity as a Trust Advantage

Companies are increasingly judged not just on what they claim to be doing for sustainability, but on how convincingly they can prove it. As disclosure requirements tighten and assurance becomes standard practice rather than the exception, the businesses best positioned to meet that bar will be the ones that have already built strong data governance into how their ESG reporting works – not the ones scrambling to reconstruct an audit trail after the fact.

Treating data integrity as part of responsible governance, rather than a technical afterthought, is quickly becoming one of the clearest signals of a mature, trustworthy sustainability program.