ESG Assurance: Who Checks the Claims?
A project can report lower emissions, better local content, safer labor conditions, improved waste recovery, or verified responsible sourcing. The harder question is simple: who checked the claim, and could someone else reproduce it from the evidence?
That question is moving from the sustainability team to the boardroom, the project controls room, the procurement function, and the audit committee. IFRS S1 and IFRS S2 from the International Sustainability Standards Board link sustainability-related risks and opportunities to enterprise value and financial reporting. GRI Standards focus on impact reporting and require clarity about reporting boundaries and methods. The GHG Protocol remains the core reference point for many greenhouse gas inventories. ISO 14064-3 and ISAE 3000 are widely used for greenhouse gas and nonfinancial assurance work.
The direction is clear. Sustainability reporting can no longer rely on broad narratives and spreadsheet summaries that sit outside normal project controls. In high-risk, capital-intensive industries, sustainability data increasingly needs the same discipline applied to cost, schedule, quality, safety, and financial information.
Sustainability Information Now Carries Commercial Risk
For major projects, sustainability information affects more than the annual ESG report. It can influence financing, tender scoring, regulatory approvals, contract incentives, community commitments, insurance reviews, and investor confidence.
A transmission project may report biodiversity offsets and recycled material use. A mining operation may disclose water withdrawals, tailings management controls, land rehabilitation progress, and local procurement. An offshore construction contractor may claim reduced vessel emissions through route planning and alternative fuels. An EPC contractor may submit embodied carbon calculations for steel, concrete, and modular equipment.
These claims can affect real decisions.
A lender may rely on the information when assessing alignment with environmental and social standards. The IFC Performance Standards and World Bank Environmental, Health, and Safety Guidelines are widely used in project finance and emerging-market infrastructure. Procurement teams may use emissions data in bid evaluations. Regulators may compare reported data with permit conditions. Investors may assess whether companies are managing climate, safety, community, and governance risks.
That raises the bar for ESG assurance. It is not enough to ask whether the report reads well. The more important test is whether the reported information is complete, consistent, traceable, and supported by evidence.
Financial auditors have long worked with concepts such as materiality, control design, sampling, documentation, professional skepticism, and evidence sufficiency. Sustainability assurance is moving in the same direction, but many project environments are not ready.
The evidence base is often scattered across contractors, suppliers, site logs, laboratory reports, weighbridge tickets, invoices, vessel fuel records, inspection forms, environmental monitoring files, HR systems, and manual spreadsheets. Some of it is strong. Some of it is weak. Some of it cannot be recreated after the fact.
Who Checks Sustainability Claims On Major Projects?
Different checks serve different purposes. Confusion starts when organizations treat them as interchangeable.
A contractor self-declaration is not the same as independent assurance. A client review is not the same as audit evidence. A dashboard is not the same as a controlled data set. Each has a role, but each has limits.
Approach | What it can do | Where it often falls short |
Internal verificationreview information before releasing it | Checks reasonableness, completeness, and alignment with project procedures | May lack independence, technical depth, or authority to challenge delivery teams |
Contractor self-declarations | Captures data close to the activity and supplier base | Relies on the contractor’s methods, controls, and incentives |
Client review | Tests submissions against contract requirements and owner expectations | Often focuses on format, not underlying source evidence |
Independent assurance | Provides external review against defined criteria and assurance standards | Scope may be narrow, late, or limited to selected indicators |
Audit evidence | Supports a conclusion through records, testing, and traceability | Weak when records are incomplete, inconsistent, or created after the event |
Digital traceability | Improves lineage, timestamps, access control, and repeatability | Does not fix poor methodology or inaccurate source inputs |
Internal Verification
Internal verification remains the first line of defense. In a mature project, sustainability data owners check information before release. Environmental teams review emissions, waste, water, and biodiversity data. Procurement validates local content and supplier claims. HSE teams review incident, health, and labor indicators. Project controls may reconcile activity data with cost, schedule, and work package records.
Good internal verification asks practical questions:
Does the reported number tie back to a defined reporting boundary?
Is the method consistent with the selected standard or contract requirement?
Can the source records be found and reviewed?
Has the data owner documented assumptions, estimates, and exclusions?
Do the numbers make sense against production, fuel use, procurement volume, or site activity?
The weakness is independence. Internal teams may face pressure to meet targets, preserve commercial relationships, or avoid late changes to reporting. They may also lack access to contractor systems. A project sustainability manager may receive monthly waste totals but not the weighbridge tickets, disposal certificates, or waste contractor reconciliations behind them.
Internal verification helps. It does not remove the need for stronger assurance where claims are material.
Contractor Self-declarations
Contractor self-declarations are common because contractors control much of the activity. On EPC, construction, marine, utilities, and mining projects, contractors often generate the first layer of sustainability data.
Examples include:
Diesel use by equipment class
Concrete mix designs and cement replacement
Steel quantities and recycled content
Waste segregation and disposal routes
Worker accommodation checks
Local hiring and local supplier spend
Vessel fuel consumption and port call records
Training completion and workforce demographics
Self-declarations can be useful when contracts define methods, evidence, and audit rights. They are weak when the project asks for monthly ESG numbers without specifying how they must be measured.
A contractor may report “low-carbon concrete” based on supplier marketing material rather than batch plant records or environmental product declarations. A marine contractor may report fuel savings based on planned vessel routes rather than actual bunker delivery notes and engine logs. A fabrication yard may claim local content using invoice addresses rather than beneficial ownership, workforce location, or value-added criteria.
The issue is not bad faith in every case. It is often poor definition. If contract language only says “report sustainability performance,” each contractor may interpret the requirement differently.
Client Review
Client review adds discipline when it is tied to governance. Owners can compare contractor submissions across packages, check anomalies, and challenge unsupported claims. They can link sustainability performance to quality, HSE, procurement, and project controls processes.
In practice, clients often review too late. By the time ESG data reaches the monthly report, the project team may be focused on schedule recovery, claims, change orders, and commercial closeout. Sustainability information gets checked for completeness and presentation, not evidence quality.
A client reviewer may ask whether all fields are completed. An assurance-minded reviewer asks whether the number can be traced back to source records and whether the method is defensible.
That distinction matters. A spreadsheet with every cell filled can still be unreliable.
Where Assurance Breaks Down
Sustainability assurance usually fails before the assurance provider arrives. The root cause is poorly designed evidence.
Poor Source Evidence
A strong claim starts with strong source evidence. For greenhouse gas reporting, activity data may come from fuel invoices, meter readings, electricity bills, fleet records, production data, refrigerant logs, or procurement quantities. The GHG Protocol requires organizations to define boundaries, scopes, calculation methods, emission factors, and data quality considerations. If activity data is weak, the calculation will be weak.
For project-level claims, source evidence might include calibrated meter records, signed delivery tickets, laboratory reports, chain-of-custody documents, pay records, inspection forms, training logs, waste transfer notes, and third-party certificates.
Weak evidence includes screenshots with no timestamp, PDF summaries with no underlying data, supplier brochures, unapproved estimates, manual totals without preparer review, and records that cannot be tied to a reporting period.
The same standard applies outside carbon. A responsible-sourcing claim needs evidence on the supplier, the material, the chain of custody, and the criteria used. A claim about workforce welfare needs inspection evidence, worker grievance records, corrective actions, and closure verification, not only a policy statement.
Inconsistent Methodologies
Projects often collect similar ESG data using different methods across contractors, packages, or regions. One contractor reports waste by volume. Another reports by weight. One includes subcontractor fuel. Another excludes it. One counts local employment by residence. Another counts nationality. One uses market-based electricity emissions factors. Another uses location-based factors. Both may be acceptable in the right context, but not if the project combines them without disclosure.
GRI Standards emphasize reporting principles such as accuracy, balance, clarity, comparability, completeness, sustainability context, timeliness, and verifiability. Those principles are hard to meet when project teams use inconsistent definitions.
This problem becomes acute in joint ventures and large programs. An infrastructure authority may collect data from multiple design-build contractors. A mining company may combine construction data, operational readiness data, community investment data, and supplier data. If each workstream uses its own definitions, reported performance becomes hard to trust.
Unclear Reporting Boundaries
Boundaries decide what is in and out. They affect every sustainability metric.
On an LNG project, does construction diesel include subcontractor generators? Does marine fuel include support vessels outside the main installation spread? Does water withdrawal include temporary camps? Does local procurement include imported equipment purchased through a local agent? Does a safety metric include subcontracted security workers? Does an emissions intensity metric include commissioning flaring?
IFRS S2 requires climate-related disclosures that help users understand governance, strategy, risk management, and metrics and targets. Clear boundaries arecan't manage cost forecasts, critical path progress, weld quality, or safety incidents wit essential because users need to know what the data represents. The same logic applies to broader sustainability reporting.
Unclear boundaries create two risks. Reported data may omit material activity. It may also include activity that makes performance look better or worse without explanation.
Supplier Claims That Cannot Be Verified
Many project ESG claims depend on supplier data. Embodied carbon, recycled content, human rights due diligence, conflict minerals, certified timber, renewable electricity, and product-level environmental claims often sit outside the owner’s direct systems.
The problem is not that supplier data is unusable. The problem is that supplier statements vary in quality.
An environmental product declaration may be based on recognized product category rules and third-party verification. A generic product brochure may not. A certificate may apply to a manufacturing site, not the specific batch supplied. A supplier may claim renewable electricity, but the contractual instrument or market basis may not match the reporting method.
Scope 3 greenhouse gas reporting is especially exposed to this issue. The GHG Protocol’s Corporate Value Chain standard allows different calculation approaches, including supplier-specific data and secondary data. Higher-quality supplier data is useful, but only when the source, method, period, and boundary are clear.
Manual Spreadsheets And Weak Audit Trails
Spreadsheets remain common because they are flexible. They are also fragile.
Common weaknesses include overwritten formulas, unclear file versions, hidden tabs, copy-and-paste errors, undocumented adjustments, and no review trail. In project environments, spreadsheets often move by email between contractors, owners, consultants, and joint venture partners. By the time a number reaches the corporate ESG report, the original preparer may have left the project.
This is uncomfortable but familiar. Major projects would not manage cost forecasts, critical path progress, weld quality, or safety incidents through uncontrolled spreadsheets alone. Sustainability data should not be the exception.
Digital systems do not guarantee accuracy. They can improve control if they preserve source records, user access, timestamps, calculation logic, approval status, and change history.
Selective Reporting And Incomplete Records
Selective reporting is not always deliberate. Teams report what they can measure and omit what they cannot. That produces a bias toward easy metrics.
A project may disclose avoided emissions from modular design but omit increased transport emissions. It may report tons of waste diverted from landfill but not outcomes for hazardous waste treatment. It may report local procurement spend but not payment terms or subcontractor labor practices. It may report renewable power use for offices but not diesel use on remote construction fronts.
Incomplete records also create assurance limits. If a project cannot produce fuel records for a key contractor, the assurance provider may need to qualify the conclusion, limit the scope, or rely on estimates. That may be acceptable if disclosed and immaterial. It is not acceptable to present a material claim as verified fact.
What Counts As Sufficient Evidence?
Evidence is sufficient when it supports the claim, fits the method, covers the reporting period, and an independent reviewer can assess it.
That sounds simple. On projects, it requires discipline.
A carbon calculation should tie activity data to emission factors and formulas. A biodiversity claim should tie field observations, baseline studies, mitigation actions, and monitoring outcomes. A local content metric should tie procurement spend, supplier classification, contract value, and payment evidence. A worker welfare claim should link requirements to inspections, grievances, corrective-action closure, and worker feedback where appropriate.
The IAASB’s ISAE 3000 standard, used for many nonfinancial assurance engagements, focuses on assurance over subject matter against suitable criteria. That means the organization must define what it is assuring and against which criteria. ISO 14064-3 provides principles and requirements for validating and verifying greenhouse gas statements. Both reinforce a basic point: assurance depends on criteria and evidence, not confidence language.
Reasonable people can disagree on some estimates. Sustainability reporting often relies on estimates, especially for Scope 3 emissions, embodied carbon, land impacts, and social value. Estimation is not the problem. Undocumented estimation is.
A good estimate explains the method, assumptions, data sources, exclusions, and sensitivity. A weak estimate appears as a single number with no trail.
Materiality Should Shape The Depth Of Assurance
Not every data point deserves the same assurance effort. Materiality helps decide where to focus.
In financial reporting, materiality considers whether information could influence decisions. ISSB standards use a financial materiality lens for sustainability-related risks and opportunities that could affect enterprise value. GRI uses an impact materiality lens, focused on significant impacts on the economy, environment, and people. Many companies must manage both lenses because investors, regulators, lenders, communities, and customers ask different questions.
For project assurance, materiality has practical dimensions:
Financial impact
Could the claim affect financing terms, contract incentives, penalties, insurance, or valuation?
Regulatory exposure
Does the metric relate to permits, legal compliance, climate disclosure rules, or consent conditions?
Stakeholder significance
Would communities, workers, lenders, or regulators view the issue as important?
Operational risk
Could poor data hide a safety, environmental, labor, supply chain, or asset integrity problem?
Reputational sensitivity
Is the claim public, prominent, or likely to be challenged?
A minor internal metric may need management review only. A public net-zero construction claim, a sustainability-linked financing metric, or a responsible sourcing statement for critical minerals may justify independent assurance.
Materiality also affects sampling. A large emissions source, high-risk supplier, sensitive habitat, or labor-intensive contractor should receive more attention than a low-risk, low-value activity. That is how assurance teams avoid wasting effort while still addressing the claims that matter.
When Independent Assurance Is Justified
Independent assurance adds value when the claim is material, complex, public, disputed, or tied to financial consequences. It also helps when data comes from many contractors or suppliers and management needs confidence in the system.
Independent assurance is not a branding exercise. It should test defined subject matter against suitable criteria. It should describe the scope, level of assurance, limitations, and responsibilities. Limited assurance provides a lower level of confidence than reasonable assurance. Both can be useful, but they are not the same.
High-risk project examples include:
Greenhouse gas inventory data used in corporate climate disclosures
Sustainability-linked loan metrics tied to project performance
Embodied carbon claims for major infrastructure bids
Local content commitments in resource development agreements
Waste diversion claims on large demolition or construction programs
Responsible sourcing claims for battery minerals, steel, cement, timber, or marine fuels
Biodiversity net gain or habitat restoration claims linked to permits
Workforce welfare claims across labor supply chains and remote camps
Independent assurance is strongest when it starts early. Late assurance often becomes a document hunt. The assurance provider finds missing records, unclear boundaries, weak methods, and inconsistent contractor submissions after decisions have already been made.
Early assurance can review control design before reporting begins. It can test whether contracts require the right evidence. It can check whether systems preserve audit trails. It can flag reporting gaps while the project can still fix them.
That is more useful than confirming at year-end that the evidence is incomplete.
Build Assurance Into Contracts And Project Governance
For capital projects, the contract is one of the strongest ESG governance tools. If assurance requirements are not in the contract, owners often struggle to obtain evidence later.
Contractual ESG requirements should define the data, methods, frequency, evidence, system access, audit rights, and record-retention period. They should also cover subcontractors and suppliers where relevant.
A strong EPC or construction contract might require fuel data by equipment type; source documents for fuel deliveries; emissions calculation methods aligned with the GHG Protocol; waste records with disposal-facility evidence; material quantities tied to approved takeoffs; and supporting documentation for product-level environmental claims.
A marine contract might require bunker delivery notes, engine logs, vessel activity data, port records, and documentation for alternative fuels. A mining services contract might require metered diesel, maintenance records, workforce accommodation inspections, water cart logs, and evidence of local employment.
Vague clauses create disputes. Precise clauses create predictable reporting.
Project governance matters just as much. Sustainability metrics should sit within normal management routines. That means named data owners, segregation of duties, review steps, change control, escalation rules, and linkage to risk registers.
For example, if a project reports falling emissions while diesel spend rises and production activity is unchanged, that variance should trigger review. If a contractor reports high waste diversion but cannot produce facility receipts, payment approval or performance scoring should be affected. If a supplier fails to support an embodied carbon claim, the procurement team should not keep using that claim in external tender submissions.
Assurance findings must change decisions. If they do not, they become paperwork.
Digital Traceability Improves Control, But It Is Not A Substitute For Judgment
Digital traceability can strengthen ESG verification. Metered data, integrated procurement systems, document control platforms, material passports, chain-of-custody tools, satellite data, laboratory information systems, and automated calculation engines can reduce manual handling. They can also preserve metadata that assurance providers need.
The benefit is repeatability. A reviewer can see where a number came from, who approved it, what method was used, and whether the source record changed.
For example, a utilities project may connect material quantities from procurement records to environmental product declarations and installation work packs. A manufacturing expansion may link electricity data from meters, production volumes, and grid emission factors. A port construction project may connect dredging records, vessel fuel logs, turbidity monitoring, and permit thresholds.
Digital tools also help with exception management. They can flag missing evidence, unusual values, expired certificates, unsupported supplier claims, and late submissions.
Still, technology cannot correct a flawed boundary or a weak method. It cannot make a nonrepresentative supplier declaration reliable. It cannot decide whether an estimate is material. Human judgment remains central.
Good digital traceability answers three questions:
Where did this data originate?
What happened to it before it was reported?
Can the result be reproduced by an independent reviewer?
If the answer to the third question is no, the system is not yet assurance-ready.
The Leadership Questions That Matter
Senior leaders do not need to review every fuel invoice or supplier certificate. They do need to know whether the project’s sustainability information can withstand scrutiny.
Useful questions include:
Can each key ESG claim be independently reproduced from source records?
Is there evidence behind each material metric, not only a summary spreadsheet?
Do reporting boundaries match the way the project is built, operated, and contracted?
Are contractor and supplier claims tested, or simply accepted?
Are methods consistent across packages, regions, and reporting periods?
Has materiality been used to focus assurance effort where the risk is highest?
Does independent assurance cover the claims that matter most, or only the easiest data?
Do assurance findings affect procurement, payment, design, schedule, or management action?
Can the project explain estimates, exclusions, and limitations without undermining the claim?
Would the evidence satisfy a regulator, investor, lender, board committee, or court process?
These questions move sustainability reporting from communications to governance.
They also protect management. Poor sustainability data can lead to misstated disclosures, contractual disputes, regulatory challenges, investor criticism, and loss of trust. Strong data can support better decisions. It can show where emissions are concentrated, where labor risks sit in the supply chain, where waste costs can be reduced, and where design changes may improve performance.
That is why ESG data quality isn't just a compliance issue. It is a project management issue.
What Stronger ESG Assurance Looks Like In Practice
Strong assurance starts with clear claims. If a project cannot define the claim, it cannot assure it.
A claim such as “we reduced construction emissions” is too vague. A stronger version states the boundary, baseline, period, method, and covered sources. For example, it may cover site diesel and purchased electricity for defined construction packages over a stated reporting period, calculated using specified emission factors, with exclusions disclosed.
Strong assurance also separates evidence types. A supplier certificate may support product eligibility. It may not prove that the certified product was delivered to the project. A purchase order may show intent. It may not prove installation. A weighbridge ticket may show waste movement. It may not prove final treatment unless linked to disposal or recycling facility evidence.
The level of assurance should match the risk. Low-risk internal metrics may need management review and spot checks. Public claims tied to financing, climate reporting, permits, or major stakeholder commitments need deeper testing and often independent assurance.
The timing should match the project cycle. During design, assurance may focus on methods, baselines, and specifications. During procurement, it may focus on supplier evidence and contract clauses. During construction, it may focus on source records, controls, and contractor reporting. During commissioning and handover, it may focus on completeness, exclusions, and transition to operational reporting.
The strongest programs connect sustainability assurance with existing controls. Project controls already check quantities, earned value, change orders, and forecast accuracy. Quality teams already manage inspection and test records. HSE teams already investigate incidents and verify corrective actions. Procurement already manages vendor qualification and contract compliance. Finance already understands reconciliations and audit trails.
Sustainability should use that discipline instead of building a parallel reporting world.
The Professional Takeaway
Credible sustainability reporting depends on more than polished disclosures. It depends on whether the underlying evidence can withstand scrutiny.
For high-risk and capital-intensive projects, the test is practical. Can the data be traced to source records? Are methods consistent? Are boundaries clear? Are supplier claims verifiable? Are estimates documented? Does independent assurance cover the claims that matter? Do findings change decisions?
ESG assurance is strongest when it is built into contracts, systems, governance, and project routines from the start. It is weakest when teams try to verify broad claims after the records are incomplete and the commercial decisions are already made.
The market is moving toward sustainability information that is decision-useful, comparable, and capable of challenge. The organizations that adapt fastest will not be those with the longest reports. They will be the ones that can show, metric by metric, claim by claim, that the evidence holds.
