The pressure on companies to report their sustainability efforts has never been greater. Stakeholders, regulators, and investors are demanding transparency on everything from carbon emissions to social equity. Ambitious goals and glossy reports are becoming standard practice as organizations race to demonstrate their commitment to environmental, social, and governance (ESG) principles.
However, a landmark new report from ACCA and The Institute of Internal Auditors pulls back the curtain, revealing that the data underpinning these commitments is often alarmingly unreliable; built on informal processes, fragmented ownership, and a startling lack of rigor. This gap between ambition and reality creates significant hidden risks, from regulatory penalties to the erosion of public trust.
This article uncovers the five most impactful, and often ignored, truths about the state of sustainability data control. Based on the findings of the report, these insights reveal why achieving trustworthy reporting is a far more complex challenge than most organizations realize.
1. The Great Disconnect: We Know Controls Matter, But We're Not Acting On It
There is a massive gap between acknowledging the importance of internal controls for sustainability data and actually implementing them effectively. The report's survey data paints a stark picture of this disconnect: while a clear majority of professionals (63%) view these controls as highly important, a mere 29% rate their organization's current controls as highly adequate.
This "ambition to action" gap is compounded by a lack of executive support, with only 49% of respondents rating leadership support for these controls as high. This isn't just a statistical curiosity; it's a direct indicator of unmanaged risk, where companies are publicly committing to standards their internal data cannot actually prove.
2. Why You Can't Just "Copy and Paste" Financial Controls
A common mistake is to assume that the robust internal control frameworks used for financial reporting can simply be applied to sustainability data. The report argues this is a fundamental error because the two types of data are inherently different. This fundamental difference is precisely why the lack of specialized skills, a challenge we'll explore later, becomes so critical; new data demands new expertise.
There is, perhaps, a need to reframe the internal control discussion to be broader and to upskill process owners, management, internal auditors and others who have responsibilities for the three lines, raising awareness of what is achievable.
In practice, this means recognizing that sustainability information is not based on traditional double-entry accounting. It often comes from diffuse systems, relies heavily on manual inputs and estimates, and lacks the straightforward verification processes common in finance. While this is a challenge for large corporations, the report notes it is an even more acute problem for smaller entities within their value chains, who are often asked to provide data without having the resources to build robust control frameworks.
3. The Black Hole of Accountability: Who Actually Owns This Data?
The leadership gap highlighted earlier directly contributes to another foundational weakness: a black hole of accountability. The report finds that responsibility for sustainability data is often "unclear, fragmented, and informally assigned." Without a designated owner who is accountable for data accuracy and integrity, controls are nearly impossible to enforce.
This problem is made worse by the fact that responsibility frequently falls to personnel in functions like human resources and operations. As the report notes, these individuals "may not be fully conversant with the principles of internal control, especially in relation to external reporting objectives." Without clear, expert ownership, data integrity is compromised at its source, creating a domino effect of unreliability throughout the entire reporting process.
4. The Data Is Weaker Than You Think (And It Probably Lives in a Spreadsheet)
According to the report's survey, "Poor data quality" was identified as the top challenge, ranked as a "high or very high impact" by 59% of respondents. This isn't just a theoretical problem; it has real-world consequences that can undermine an entire reporting framework. The report shares a striking, verbatim anecdote that illustrates the point perfectly:
[An entity that I worked with was] reporting the same emissions data month in month out and it turned out that the receptionist did not understand what was being asked of her and thus their emissions data for the largest site was just a flat line for the last five years.
This issue is amplified by a widespread lack of dedicated tools. Instead of robust data management systems, many organizations rely on a precarious web of spreadsheets. This reliance on manual, error-prone systems means that even with the best intentions, the final numbers presented to stakeholders may be diluted, distorted, or simply wrong.
5. It's a Culture Problem, Not Just a Numbers Problem
These process-level failures, from informal accountability to spreadsheet-based data chains, are ultimately symptoms of a much deeper issue: internal culture. The report emphasizes that the biggest barrier to effective control is often a lack of authentic leadership. As one of its key messages states, "A successful implementation of internal control over sustainability data fundamentally relies upon the executive and management of the entity establishing sustainability objectives as core strategic objectives..."
The survey data confirms this cultural disconnect. A lack of skills (56%), resources (56%), and leadership guidance (50%) were all ranked as high-impact challenges by over half of the respondents. When data integrity isn't a core cultural value championed by leadership, even the most sophisticated controls become mere suggestions, easily bypassed or ignored.
TL;DR: From a House of Cards to a Foundation of Trust
Each of these truths, the disconnect between ambition and action, the misapplication of financial controls, the black hole of accountability, the reliance on weak data, and a deficient culture, represents a dangerously weak cement in the foundation of corporate sustainability reporting. Achieving trustworthy reporting is a complex, human-centric challenge that goes far beyond a simple compliance exercise.
The real question for leaders isn't if they will report on sustainability, but whether that story is built on a foundation of trust or a house of cards. The final question is not just one of choice, but of timing: will leaders reinforce this structure before it collapses under regulatory and stakeholder pressure?