How to Know If Your Company Is Actually Ready for Mandatory Sustainability Reporting — Before Your Auditor Finds Out

Sustainability reporting has crossed a threshold. It is no longer a voluntary exercise for purpose-driven companies or a box-ticking exercise for communications teams. For a growing number of organisations across Europe and globally, it is a legal obligation — with assurance requirements, board accountability, and regulatory consequences attached.

Yet the most common challenge we encounter at ImpactMaker is not a lack of commitment. Companies are investing time, hiring sustainability managers, and building reporting processes. The challenge is a lack of structured starting point — and the consequences of getting that wrong are significant.

This post walks through what mandatory sustainability reporting actually requires, why most companies are underprepared in ways they don't realise, and what a structured readiness assessment looks like in practice.

The Regulatory Landscape Has Changed Permanently

Two regulatory frameworks now define the global baseline for mandatory sustainability disclosure:

• CSRD (Corporate Sustainability Reporting Directive): The EU's landmark legislation requiring companies to disclose across environmental, social, and governance topics under the European Sustainability Reporting Standards (ESRS). Already active for large listed companies, with scope expanding annually.
• ISSB Standards (IFRS S1 & S2): The global baseline for sustainability and climate-related financial disclosures, now being adopted as mandatory frameworks in the UK, Saudi Arabia, Singapore, Brazil, Australia, Japan, and beyond.

These are not parallel frameworks you can choose between. Depending on your entity structure, size, and jurisdiction, you may be subject to one, both, or required to align with one while voluntarily layering the other.

And crucially — the 2025 EU Omnibus package has introduced amendments that have shifted scope thresholds and timelines for certain categories of companies. If your understanding of your regulatory position is based on guidance from before mid-2025, it may be out of date.

Why Most Companies Are Preparing for the Wrong Things

The instinctive response to a new reporting obligation is to look at what other companies are disclosing and build something similar. This approach has two fundamental problems.

First, what other companies disclose reflects their materiality profile, their sector, their stakeholder base, and their regulatory scope — not yours. A manufacturing company with complex supply chains and a fintech firm with 200 employees face entirely different CSRD obligations, even if both fall within scope.

Second, sustainability reports are not the same as audit-ready disclosures. A well-written report that lacks documented data trails, a defensible double materiality methodology, and board-level governance structures will not survive assurance scrutiny — regardless of how polished it looks.

The Four Gaps We Find Most Often

• Scope misalignment: Companies either over-scope (preparing disclosures they are not required to make) or under-scope (missing mandatory data points that apply to their sector or size).
• Undocumented double materiality: Companies have conducted informal materiality assessments but lack the documented process and stakeholder evidence that assurance providers require.
• Data infrastructure gaps: Sustainability metrics are being pulled from disconnected spreadsheets and systems, with no consistent methodology, no data owners assigned, and no audit trail.
• Governance structure deficiencies: CSRD requires board-level sustainability oversight and clearly defined internal accountability. Many companies have neither formalised nor documented these structures.

What a Structured CSRD and ISSB Gap Analysis Actually Involves

A gap analysis for sustainability reporting is not a checklist exercise. Done properly, it is a structured review of your regulatory position, current state, and the specific delta between where you are and where you need to be.

There are three phases to a rigorous readiness assessment:

Phase 1: Regulatory Scoping

Before you can assess gaps, you need to know exactly which requirements apply. This means confirming your obligations based on entity type, employee count, turnover, listing status, and jurisdiction — not based on generic framework descriptions. For group structures, this includes mapping obligations across entities.

This phase also accounts for Omnibus amendments and applicable phase-in provisions. The scoping output is a confirmed regulatory brief: what you must disclose, under which standard, and by when.

Phase 2: Current-State Review

Once scope is confirmed, the next step is an honest assessment of where you currently stand. This covers existing sustainability reports and disclosures, data collection processes and systems, internal governance structures and board accountability, and HR and operational data relevant to social disclosures.

For CSRD-scope companies, this phase includes facilitating a double materiality assessment — mapping both impact materiality (your effects on people and planet) and financial materiality (sustainability risks and opportunities affecting enterprise value). This must be done with your team, not handed to you as a template, because the output must reflect your actual business reality.

Phase 3: Gap Analysis and Implementation Roadmap

The final deliverable is a written gap analysis — mapping every material gap between your current state and your required disclosures, scored by severity: critical, moderate, or informational.

This is paired with a phased implementation roadmap — a realistic plan covering governance structures, data infrastructure, reporting processes, and assurance preparation. Quick wins are identified separately from longer-term builds, and resource requirements are estimated honestly, not optimistically.

The Real Cost of Discovering Gaps During Assurance

Assurance is the moment of truth for sustainability disclosures. And it is not a forgiving process.

An assurance provider reviewing your CSRD disclosures will look for documented evidence at every stage: the methodology behind your double materiality assessment, the data trail behind every reported metric, the governance documentation demonstrating board-level oversight. If that evidence does not exist — or exists but cannot be verified — the options are a qualified opinion, an adverse finding, or a delayed report.

The practical consequences extend beyond the assurance process itself. Investors screening for governance quality treat compliance failures as signals of broader management risk. Customers and supply chain partners increasingly require their suppliers to meet the same reporting standards they are subject to. And the reputational exposure of a qualified assurance opinion under mandatory public disclosure is not recoverable with a press release.

Companies that conduct a structured gap analysis before their first reporting cycle find and fix these issues in a controlled environment. Companies that don't find them in front of their auditor.

Who Needs a Readiness Assessment Right Now

A readiness assessment is most valuable at specific inflection points. These include:

• Companies approaching their first CSRD reporting obligation — particularly those with 250–5,000 employees in EU-regulated markets who may now fall under revised Omnibus thresholds.
• Non-EU companies with significant EU revenue, listed securities, or subsidiaries that fall within CSRD scope.
• Companies in ISSB-adopting jurisdictions — including the UK, Singapore, Saudi Arabia, Brazil, and Australia — approaching their first mandatory climate disclosure.
• Companies in global supply chains facing customer ESG reporting requirements aligned to CSRD or ISSB standards.
• Companies that have already started reporting voluntarily but are uncertain whether their current approach meets mandatory standards.

If your reporting deadline falls within the next 18–24 months and you have not conducted a structured regulatory scoping exercise, you are almost certainly working without a complete picture of your obligations.

The Difference Between a Generic Consultant and a Regulatory Specialist

Sustainability advisory is a fragmented market. Many generalist consultants offer ESG services, and many of them are working from the same publicly available framework documents you could find yourself.

A readiness assessment of genuine value requires three capabilities that rarely exist in one team: deep familiarity with current regulatory texts (not prior guidance), practical experience with ESRS methodology and double materiality in real organisations, and the ability to translate regulatory requirements into operational actions that finance, legal, sustainability, and operations teams can actually implement.

It also requires staying current. The regulatory environment for sustainability reporting has moved faster in the past three years than in the previous decade. Omnibus amendments, jurisdictional adoption timelines, and assurance standard developments all affect what is required and when. Guidance that was accurate in 2023 may now lead companies in the wrong direction.

What Good Looks Like: The Outputs of a Quality Readiness Assessment

A quality readiness assessment produces five outputs that a company can use immediately:

• Regulatory Clarity: A confirmed, documented understanding of exactly which requirements apply to your specific entity — not based on general frameworks, but on your characteristics and jurisdiction, updated for current regulatory texts.
• Documented Gap Analysis: A written assessment of every material gap between your current state and your required disclosures, with severity scoring that allows you to prioritise investment.
• Realistic Roadmap: A phased implementation plan based on actual effort estimates — not aspirational timelines that collapse on first contact with internal resource constraints.
• Internal Alignment: A shared brief across finance, sustainability, legal, and operations — eliminating the siloed confusion that causes critical data to be missed.
• Credible Starting Point: Documentation that can be shared with assurance providers, auditors, or board members — establishing your compliance programme on a defensible foundation from day one.

A Practical Note on Timeline Realities

Implementation of a full CSRD programme — covering governance structures, data infrastructure, double materiality, and assurance-ready disclosures — typically requires 12–24 months for first-time reporters. This is not a worst-case estimate. It is the realistic range for organisations that start with a structured plan.

For companies whose first mandatory reporting deadline falls in 2026 or 2027, the assessment phase needs to happen now — not after the next board meeting, not after the next budget cycle. Every month of delay compresses the implementation window and increases the risk of a rushed, under-documented first disclosure.

The companies entering assurance with confidence in 2026 and 2027 started their structured preparation in 2024 and 2025. The companies that will struggle are the ones that assumed they had more time than they did.

Start With Clarity, Not Complexity

Sustainability reporting regulation is complex. But the right starting point is not. It is a structured answer to a straightforward question: given who we are and where we operate, what exactly do we need to do, where do we stand today, and what will it take to get there?

That question deserves a precise, expert-led answer — not a generic framework overview, not a checklist that may not apply to your situation, and not a consultant who will tell you what you want to hear.

ImpactMaker's ISSB / CSRD Readiness Assessment was built to answer exactly that question — for your specific entity, against current regulatory texts, with a roadmap your team can act on.

Ready to find out exactly where your company stands?

Book a free 15-minute discovery call with our regulatory specialists. We will confirm your scope, identify your most critical gaps, and outline what a structured readiness programme looks like for your situation.

Three packages available: Discover (€6,450) | Realize (€15,050) | Extension (€24,940)

Remote delivery. Worldwide scope. English, German & Spanish.

Visit: impactmaker.co/issb-csrd-readiness-assessment