ESG Due Diligence for Investors: Key Risk Checklist

When sustainability data, controls or evidence are incomplete, an assurance review can uncover gaps in disclosures. In Singapore, SGX-listed issuers must subject their sustainability reporting process to internal review. Preparing early helps identify weaknesses before an independent assurance engagement begins.

An internal review is more than a final check of reported figures. It examines how data is collected, who is responsible, which methods are used and whether evidence supports the disclosures. Unclear foundations can leave issues that need attention during assurance work.

This guide explains the internal controls to assess, what a readiness assessment should cover, how limited and reasonable assurance differ, and when to engage a provider. You’ll find practical steps to judge where your organisation stands and what to prioritise before assurance begins.

What Internal Controls Are Needed for Sustainability Data?

Prepare reported emissions and other material ESG disclosures alongside the methods, source records, approvals and controls behind them. For each metric, define what is included, how it is calculated and who checks the supporting evidence.

A sound control process traces reported information from its source to the final disclosure. It also helps reviewers spot missing records, inconsistent assumptions and unexplained changes before reporting is complete.

Completeness and Accuracy Checks

Internal controls should test whether reported data is complete, accurate and consistent with source records. For example, reconcile energy consumption against invoices and meter records, then investigate missing sites, unusual changes and duplicate entries. Record who performed each check and how exceptions were resolved.

Define the reporting boundary and data request for each business unit. Compare submissions with the reporting framework and prior-period records. Explain material changes instead of carrying figures forward without review. Formal collection policies and documented review procedures make these checks repeatable.

Data Governance and Documentation

Assign an accountable owner to each data stream, with named preparers and reviewers. A governance register can capture metric definitions, calculation methods, source documents, approval dates and changes to assumptions. Keep evidence in a controlled location and retain version histories so reviewers can trace disclosures to their origins.

Collection policies should set submission deadlines, evidence requirements, escalation routes and review responsibilities. If teams use spreadsheets, manage access and versions, and arrange independent review. Documenting responsibilities shows reviewers how data moved from its source through calculation and approval.

Build reporting time into the control design. Work backwards from the publication date: set departmental submission deadlines, allow time for validation and reserve a review window for unresolved exceptions. If a supplier or business unit submits late, record the delay and its effect on the disclosure rather than silently omitting the data.

• Document each metric’s boundary, method and source record.
• Name the data owner, preparer and reviewer.
• Log reconciliations, exceptions, corrections and approvals.
• Retain evidence supporting reported emissions and disclosures.

A sustainability assurance readiness review can assess data quality, methodologies, governance, documentation and internal controls before an independent assurance opinion. Use the findings to assign owners and deadlines to control gaps, then track their closure through the reporting cycle.

Why Does Sustainability Assurance Readiness Matter?

A readiness assessment can identify reporting gaps before they affect disclosures, assurance work or deadlines. Involving finance helps align sustainability information with existing review and approval processes.

There is no single cost for sustainability assurance in Singapore. Fees depend on the reporting scope, assurance level, data complexity and maturity of existing controls.

CSRD Assurance Preparation

For organisations preparing for CSRD-related reporting, first determine which entities and disclosures are in scope. Map each relevant disclosure to its reporting criteria, data owner and supporting evidence. This makes missing records, unclear responsibilities and undocumented methods easier to identify.

Where ESRS reporting and independent assurance apply, build the preparation plan around those requirements. Review how business units gather information, approve changes and retain evidence. A readiness assessment can help prioritise gaps before assurance work begins, rather than leaving them until publication is close.

Reporting Controls and Segregation of Duties

Separate sustainability data preparation from its review and approval. For example, an operations team can provide activity data, finance can reconcile supporting records, and an authorised reviewer can approve the disclosure. This creates a clear review trail and avoids relying on one person to prepare and approve the same information.

Document each control, its owner, the evidence it produces and how exceptions are escalated. Finance can review definitions, reconciliations and reporting-period cut-offs, while sustainability leads coordinate disclosure requirements. The aim is a repeatable process with clear accountability, not an extra sign-off that leaves underlying data unchecked.

Finance can be left out when sustainability reporting sits outside established financial processes. Involve finance early to align reporting definitions, review estimates and reconcile figures against operational records. This also helps clarify which teams prepare, check and approve each disclosure.

In Singapore, SGX-listed issuers must subject their sustainability reporting process to internal review. This is distinct from external assurance. Set a reporting calendar with collection deadlines, review windows and escalation dates, then align milestones with the organisation’s financial year-end and publication schedule.

Apply the same discipline to reporting obligations across multiple jurisdictions. Identify applicable entities and disclosures, assign accountable owners, and document how each figure was prepared and approved. Map finance responsibilities against sustainability controls to identify gaps before the next reporting cycle.

If you need help structuring that work, discuss a sustainability reporting readiness assessment and define practical next steps for your organisation.

What is the difference between limited and reasonable assurance?

Limited and reasonable assurance differ in the depth of work and the conclusion reported. Limited assurance provides a lower level of confidence; reasonable assurance involves more extensive procedures and a stronger conclusion. Neither means every sustainability figure is checked in the same way as in a financial statement audit.

For limited assurance, the provider reports whether anything came to their attention indicating that the information is incorrect. This is a negative-form conclusion. For reasonable assurance, the provider concludes whether the information is correct in all material respects. In short, limited assurance reports whether the work identified an issue; reasonable assurance provides a positive conclusion.

The distinction affects preparation. A limited assurance engagement may focus on selected disclosures, evidence trails, interviews and analytical procedures. Reasonable assurance generally calls for more persuasive evidence and deeper testing of relevant reporting processes. For example, a provider reviewing emissions data may examine calculation methods, source records, controls and the basis for estimates. The scope and procedures depend on the applicable standard and engagement.

There is no single assurance timeline for every organisation. Regulatory obligations depend on the reporting regime, company scope and reporting period, not simply on whether limited or reasonable assurance is chosen. In Singapore, SGX-listed issuers must subject their sustainability reporting process to internal review. This is distinct from external assurance, so an internal review requirement should not be treated as a deadline for limited assurance.

For a first-time limited assurance engagement, plan provider discussions 5-6 months before the target report publication date. For first-time reasonable assurance, allow 7-9 months before publication. These planning periods support scoping, evidence preparation and engagement work; first-time engagements may also need an additional 1-2 months for provider selection and contracting.

Organisations moving from limited to reasonable assurance should discuss the change with their provider at least 12 months in advance. The transition can require broader evidence, stronger controls and more mature data processes. A reporting team should identify which disclosures will be covered, who owns the supporting evidence and what control improvements must be completed before the engagement.

• Limited assurance: a conclusion based on whether anything came to the provider’s attention that indicates incorrect information.
• Reasonable assurance: a conclusion on whether information is correct in all material aspects.

Choose the assurance level that fits the applicable regulatory requirement and the organisation’s reporting maturity. Agree the scope, standard, evidence expectations and publication timetable with the assurance provider. A readiness assessment can show whether selected disclosures and supporting records are prepared for that level.

Sustainability assurance readiness assessments

Assess sustainability assurance readiness by comparing reporting processes, evidence and controls with the intended assurance level. Then prioritise gaps by materiality, risk and the work required to close them.

Start by defining the reporting boundary, material disclosures and target standard, such as ISAE 3000 or ISSA 5000. This sets the scope for the assessment and keeps the review focused on information stakeholders will rely on.

Readiness Assessment and Gap Analysis

A gap analysis tests whether reported information has clear methods, reliable source data, accountable owners and review evidence. It should also examine governance, documentation and controls across each material data stream. Compare current practice with the intended assurance level, then record each gap, its impact and an accountable owner.

Organizations beginning assurance are commonly at Level 1 or Level 2 maturity. More than eight in ten STI constituents and larger non-STI companies had conducted or considered readiness assessments. These figures signal active preparation, but your own assessment must test your processes, not assume peer practices mean your disclosures are ready.

Readiness Self-Assessment Dimensions

Rate each material reporting area against practical evidence, not policy statements alone. Check whether definitions are consistent, calculations can be reproduced, source records are retained and reviewers can show their work. Include governance and stakeholder expectations, and note where estimates or manual transfers create additional review needs.

Calibrate the assessment to the assurance target. Level 3 across all material data streams is the target for initial limited assurance readiness; Level 4 is the target for reasonable assurance readiness. A higher target demands stronger evidence and more mature processes across the selected disclosures.

Steps for Assessing Readiness

First, define the reporting framework, assurance standard and disclosures in scope. Then map data owners, source records, calculation methods and review controls for each material metric. Test a sample from source to disclosure, record exceptions, and assign owners and deadlines for corrective work.

Finally, reassess unresolved gaps before engaging for assurance. Organizations starting from minimal reporting may need 6-12 months for limited assurance readiness. Moving from limited to reasonable assurance typically requires an additional 6-12 months. Scope 1 and Scope 2 data alone may take 3 to 6 months where infrastructure is mostly in place.

Use the findings to sequence work by assurance level and data maturity. Level 1 ad hoc reporting typically needs 6-12 months to reach limited assurance readiness and 12-18 months to reach reasonable readiness. Level 2 defined reporting typically needs 9-12 months for reasonable readiness, while Level 3 managed maturity typically needs 6-9 months.

Assurance provider engagement timing

Choose an independent provider whose eligibility, experience and proposed work fit your reporting scope. In Singapore, providers of prescribed external limited assurance must be registered audit firms or accredited testing, inspection and certification firms.

Assess the provider’s proposed work against the assurance standard, intended level, disclosures and evidence requiring review. Confirm the scope, timetable, reporting responsibilities and how findings will be communicated. The engagement should fit your reporting framework and data maturity, not just the publication date.

Timing depends on whether this is your first engagement and the level of assurance sought. Organisations starting from a baseline typically need 3-6 months to prepare for limited assurance, or 6-12 months for reasonable assurance. Adding Scope 3 and targeting reasonable assurance typically requires 9 to 18 months, depending on value-chain complexity and internal-control maturity.

For a first-time engagement, allow time for provider selection and contracting before fieldwork begins. First-time assurance engagements should allow an additional 1-2 months for provider selection and contracting. For first-time limited assurance, engage the provider 5-6 months before the target report publication date. For first-time reasonable assurance, allow 7-9 months before publication.

Recurring work has a different planning rhythm. Engage a provider 3-4 months before a recurring limited assurance reporting period ends, or at least 3-4 months before the target publication date. Starting discussions early gives both sides time to agree the framework, evidence requests and reporting milestones before the review period closes.

Before appointing a provider, prepare a concise scope brief covering the reporting period, disclosures, assurance level and applicable standard. Summarise data owners, existing controls, available evidence and known gaps. This helps providers define the engagement around the actual work, rather than assumptions about your processes.

• Eligibility: Confirm the provider meets the applicable Singapore category for prescribed external limited assurance.
• Scope: Specify disclosures, reporting period, framework and assurance level.
• Evidence: Agree how records, calculations and control documentation will be provided.
• Timing: Set milestones for selection, evidence preparation, review and publication.

If you plan to move from limited to reasonable assurance, discuss the transition with your provider at least 12 months in advance. Use the lead time to align the stronger assurance objective with control improvements and evidence collection. For help structuring your preparation, Contact Us.

ContentFactory: ESG Readiness & Materiality Assessments

ContentFactory helps organisations turn assurance gaps into a practical ESG readiness plan. Its ESG Readiness & Materiality Assessments clarify which disclosures matter, where evidence or controls need work, and what to prioritise before engaging an independent assurance provider.

For organisations preparing for external review, mandatory sustainability assurance readiness support focuses on preparation, not issuing an assurance opinion. You can also address emissions data through GHG Emissions Calculation and Carbon Accounting, or organise disclosures across frameworks with Multi-Framework Sustainability Reporting.

Turn to ContentFactory when you need a structured assessment, clearer ownership of reporting gaps or a workable sequence for strengthening sustainability information. Contact ContentFactory to discuss your organisation’s next steps.

Turn your readiness findings into a clear work plan

Set the next step before the next reporting cycle begins. Record which disclosures need attention, who owns each action, what evidence is required and when progress will be reviewed. This turns sustainability assurance readiness into assigned work your team can track.

ContentFactory supports this work through ESG Readiness & Materiality Assessments, GHG Emissions Calculation and Carbon Accounting, and Multi-Framework Sustainability Reporting. Use assessment findings to set a sustainability assurance readiness plan, then sequence actions by disclosure priority and ownership. A clear process also helps your team track progress between reporting cycles.

Bring your reporting scope and current priorities to a conversation. You can discuss a practical next step with ContentFactory and keep assurance preparation focused on your organisation’s needs. Contact Us to start planning and move forward with a clearer path.

Frequently Asked Questions

What Happens When Organizations Are Not Ready?

An assurance provider may identify unsupported disclosures, missing records or limitations affecting the conclusion. Your organisation must then assess the information affected, document the issue and decide how to correct or explain it. For example, if a supplier cannot provide evidence for a reported figure, record the data limitation and its effect on the disclosure. Clear escalation responsibilities help teams address issues without obscuring material information.

Do Singapore companies need to prepare for ESG assurance?

Singapore companies should first identify which reporting and assurance requirements apply to their organisation. SGX-listed issuers must subject their sustainability reporting process to internal review, which is distinct from external assurance. Where prescribed external limited assurance applies, the provider must be a registered audit firm or an accredited testing, inspection and certification firm. Other organisations can also prepare for assurance expectations from investors, customers or lenders.

How does assurance help reduce greenwashing risk?

Independent assurance can test whether selected claims and metrics are supported by evidence that matches their wording. For example, a claim about reduced emissions should state its boundary, period and calculation basis clearly. If evidence supports only part of a broad statement, narrow or qualify it before publication. Assurance does not certify an organisation as sustainable, so precise claims and balanced disclosures remain important.

How long does it take to get ESG audit ready?

Preparation time depends on reporting maturity, data scope, evidence access and control quality. An organisation starting from a baseline typically needs 3-6 months to prepare for limited assurance, or 6-12 months for reasonable assurance. Treat these as planning ranges, not fixed deadlines. Begin by defining the disclosures in scope, then identify work that depends on supplier information, new calculations or changes to internal review.

Is a readiness review required before assurance?

No. An organisation can proceed directly to assurance if its reporting processes, controls and supporting evidence are sufficiently mature. A separate review can still test whether these elements work together before fieldwork begins. To assess sustainability assurance readiness, trace a disclosure from its original record to its final published form. Note any missing approval, unclear calculation or unexplained adjustment, then decide whether to address the gap before engagement.

What ESG reporting criteria and frameworks are used?

The organisation selects reporting criteria based on its reporting obligations, intended audience and disclosed topics. Frameworks such as ISSB, GRI and ESRS offer different structures for sustainability disclosures. The assurance provider’s standard governs how the engagement is performed, with ISAE 3000 and ISSA 5000 among the standards used for sustainability assurance. Align the chosen framework, reporting boundary and assurance scope before preparing evidence.

What are the most common reasons companies fail an ESG assurance engagement?

Evidence gaps, inconsistent definitions and undocumented estimates can prevent a provider from supporting a disclosure. Another risk is a mismatch between the reported boundary and the records collected from business units or suppliers. Before submission, compare reported figures with source records, document material assumptions and explain significant changes between periods. Keep a record of unresolved limitations so responsible teams can address them transparently.

What does sustainability assurance readiness mean?

Sustainability assurance readiness means having a defined reporting scope and criteria, supported by processes that allow an independent provider to examine selected disclosures. In practice, the organisation can identify who prepared each figure, how it was calculated, which records support it and who reviewed it. Readiness is not the assurance conclusion. It describes how prepared the organisation is to provide clear, traceable information for an assurance engagement.