ESG & CSRD Reporting Data Collection Checklist Template

The sustainability statement goes to the auditor in three weeks, and the Scope 3 figure still lives in a spreadsheet passed between three people. Nobody can say which emission factors it used.

This free ESG reporting checklist is for sustainability leads, controllers and the site, HR and procurement owners who supply the numbers. It suits companies in scope of the Corporate Sustainability Reporting Directive (CSRD), companies reporting voluntarily, and suppliers answering customer and bank questionnaires. It runs one reporting cycle: basis and boundary, double materiality, the datapoint list and its owners, collection, evidence and review, assurance and sign-off. The output is a register naming a source, an owner and a reviewer for every reported figure.

Use This Template Free See Live Example
No Credit Card Required

Last reviewed: October 2026

Who Reports What After Omnibus I

EU sustainability reporting was rewritten twice in a year. The ‘stop-the-clock’ Directive (EU) 2025/794, published on 16 April 2025, postponed the second and third waves by two years. The Omnibus I Directive (EU) 2026/470, published on 26 February 2026 and in force since 18 March 2026, then cut the scope itself, removed listed SMEs, dropped sector-specific standards and abandoned the move to reasonable assurance. Member States must transpose its CSRD changes by 19 March 2027.

Fewer companies must report, but more are asked for data. Banks, insurers and large customers still want emissions and workforce figures from their suppliers, and the work of collecting, checking and approving those figures is the same whatever the basis. That shared work is what this checklist runs.

Mandatory: CSRD with ESRS

More than 1,000 employees and €450m turnover

Who: EU companies above both thresholds, and non-EU groups with €450m of EU turnover and an EU subsidiary or branch above €200m.

When: financial years from 2027 for EU companies not already reporting, 2028 for non-EU parents.

Standard: the revised ESRS in Delegated Regulation (EU) 2026/1563, mandatory from financial year 2027, with limited assurance.

Voluntary: the EU voluntary standard

Built on VSME, for everyone else

Who: any undertaking outside mandatory scope, including SMEs answering requests from customers, lenders and investors.

Standard: Delegated Regulation (EU) 2026/1560, in force since 24 September 2026, based on the July 2025 VSME Recommendation.

Value chain cap: from financial year 2027, mandatory reporters cannot require more than the standard’s short list of datapoints from suppliers averaging 1,000 employees or fewer.

Wave 1 reporters, financial years 2025 and 2026

Still reporting, with more relief and a choice of version

Companies that reported from financial year 2024 and remain above the new thresholds carry on. A July 2025 ‘quick fix’, Delegated Regulation (EU) 2025/1416, lets them defer ESRS E4, S2, S3 and S4 and the anticipated financial effects for 2025 and 2026. For 2026 they may use the existing ESRS, the existing ESRS with selected reliefs, or the revised set, and must say which. Those below the new thresholds leave scope from 2027, and Member States may exempt them for 2025 and 2026: check your national law.

This template covers the reporting cycle, not the management systems behind it. Running an environmental management system has its own ISO 14001 checklist, and the financial statement audit its own external audit preparation checklist.

What the ESG Reporting Checklist Covers

Seven phases, one checklist per reporting year. The reporting basis you choose first decides which phases appear.

Phase 1

Phase 1: Basis, Scope & Boundary

The first task records the reporting basis, the reporting lead and the approver. A mandatory basis shows Phases 2 and 6.

  • Choose the reporting basis for this cycle — mandatory CSRD with ESRS, the voluntary standard, or another framework a customer or regulator asks for
  • Test the CSRD thresholds on the latest figures — average employees and net turnover, both of which must be exceeded; check how your Member State has transposed them
  • Record which standard and version applies — for 2026, existing ESRS, existing ESRS with reliefs or the revised set; the statement must say which
  • Set the reporting boundary — the same undertakings as the financial statements, plus the value chain where a topic is material
  • Plan the timetable back from publication — board approval, assurance fieldwork, data cut-off and owner deadlines
Phase 2

Phase 2: Double Materiality Assessment

Shown when the basis is CSRD with ESRS. Voluntary reporters skip it and work from the standard’s modules.

  • Decide whether to refresh or redo last year’s assessment — acquisitions, new markets or new products justify a fuller rework
  • List impacts, risks and opportunities across operations and value chain — use the topical standards E1 to E5, S1 to S4 and G1 as a prompt list
  • Score impact materiality — severity by scale, scope and how hard the harm is to remedy, with likelihood for potential impacts
  • Score financial materiality — likely effects on cash flows, performance, position or cost of capital over short, medium and long term
  • Record stakeholder input and the reasoning — the assurance provider will test how you reached the list, not only the list
Phase 3

Phase 3: Datapoint Register & Owners

  • Build the datapoint register from the material topics — general disclosures always, topical datapoints where material, or the voluntary standard’s modules
  • Assign an owner and a separate reviewer to every datapoint — the person who produces a number should not be the one who checks it
  • Load the emission factor tables — source, edition year and units for each factor, kept the same all year
  • Fix definitions, units and estimation methods — headcount or full-time equivalents, period-end or average, and when an estimate is acceptable
  • Answer customer and lender questionnaires from the register — and from 2027 decline requests beyond the value chain cap if you are a protected supplier
Phase 4

Phase 4: Collect the Data

Each collection task is assigned to the data owner named in the register, with a due date from the data cut-off.

  • Collect Scope 1 activity data — fuels, fleet, refrigerant top-ups and process emissions, site by site
  • Collect Scope 2 on both methods — location-based from meter data and market-based from supplier contracts and certificates
  • Screen the Scope 3 categories and collect the material ones — flag spend-based estimates so they can be replaced by supplier data later
  • Collect own-workforce data from HR systems — headcount by contract and gender, turnover, training and work-related injuries
  • Collect business conduct and other material data — anti-corruption training, confirmed incidents, payment practices, energy, water and waste
Phase 5

Phase 5: Evidence, Controls & Review

  • Attach source evidence to every reported figure — invoices, meter readings, HR extracts and supplier letters, not a summary spreadsheet
  • Reconcile shared figures to the financial statements — revenue, energy spend, headcount and the boundary must agree with the annual accounts
  • Review movements against last year — explain every large change and record any restatement of a prior figure
  • Challenge the estimates and judgements — a second reviewer checks Scope 3 methods, proxies and the materiality conclusions
  • Draft the sustainability statement or report — in the structure the chosen standard sets, with each figure traced to the register
Phase 6

Phase 6: Limited Assurance Readiness

Shown when the basis is CSRD with ESRS. Voluntary reporters can add it if a lender or customer asks for assurance.

  • Agree scope, timetable and access with the assurance provider — the statutory auditor or, where your Member State allows it, an independent assurance provider
  • Hand over the materiality process file — limited assurance covers how material information was identified, not only the figures
  • Provide the register, evidence and control records — the provider samples datapoints and traces them back to source
  • Log findings and agree each adjustment — with owner, decision and date, before the statement is finalised
Phase 7

Phase 7: Approval, Publication & Lessons

The sign-off is an approval assigned to the approver named in Phase 1; publication waits for it.

  • Approver signs off the report — reviews the statement, the open findings and the materiality conclusions, then records Approved or Not approved
  • Publish the report in the right place — under the CSRD, a clearly identified section of the management report; voluntary reports go to those who asked
  • Archive the register, evidence and approvals for the cycle — next year’s comparatives and any restatement start here
  • Hold a lessons-learned review — late owners, weak sources and estimates to replace with measured data next year

Reporting Requirements Mapped to the Checklist

The table links each requirement to its source and to the phase that produces the evidence. National transposition can add detail, so treat the table as a starting point, not legal advice.

Requirement Source Applies to Evidenced in
Scope thresholdsCSRD as amended by Directive (EU) 2026/470Over 1,000 employees and €450m turnoverPhase 1
Standard and versionDelegated Regulations (EU) 2023/2772, 2025/1416 and 2026/1563Existing ESRS to 2026; revised ESRS from 2027Phase 1
Double materialityESRS 1Mandatory reportersPhase 2
Voluntary reportingDelegated Regulation (EU) 2026/1560; Recommendation (EU) 2025/1710 (VSME)Undertakings outside scopePhases 3 and 4
Value chain capDirective (EU) 2026/470; voluntary standard Annex IIRequests to suppliers averaging 1,000 employees or fewer, from 2027Phase 3
Greenhouse gas emissionsESRS E1; GHG Protocol Corporate Standard and Scope 2 GuidanceWhere climate is materialPhase 4
Own workforce and business conductESRS S1 and G1Where materialPhase 4
PlacementAccounting Directive Arts. 19a and 29aMandatory reportersPhase 7
Limited assuranceCSRD; Commission standard due by 1 July 2027; CEAOB guidelines (2024)Mandatory reportersPhase 6

Several things were still moving at the time of review. The revised ESRS were published on 21 September 2026 and enter into force on 10 November 2026. The Commission has not yet adopted its limited assurance standard, which is due by 1 July 2027, so engagements rely on the CEAOB’s 2024 guidelines and the IAASB’s ISSA 5000. Transposition of Omnibus I differs by Member State until March 2027. The same directive moved the separate due diligence regime, the CSDDD, to July 2029 for companies with more than 5,000 employees and €1.5bn turnover. Nothing on this page is legal advice.

Why Run the Reporting Cycle in CheckFlow?

1

The register lives in data sets

Data sets hold the datapoint list, owners and emission factors as reference tables that fill each year’s checklist. Update a factor once and next year’s cycle starts from the current edition.

2

One template for every basis

Conditional logic shows the materiality and assurance phases only for a CSRD report. A supplier answering a customer on the voluntary standard sees the same collection and review steps without them.

3

Every figure has a name beside it

Owners and reviewers are assigned per task, evidence is attached where the number is entered, and the final sign-off is an approval. When the assurance provider asks who produced a figure and who checked it, the activity trail answers.

CheckFlow is not a carbon accounting tool, an ESG data platform or an assurance provider. It does not calculate emissions or tag your report. It runs the cycle, assigns the work and keeps the evidence, alongside whatever calculation tools you use. The rest of the reporting calendar can run on CheckFlow’s compliance checklist software.

The ISO 14001 checklist keeps the environmental data sources under control all year, and the ISO 45001 checklist does the same for the safety figures. The External Audit Preparation Checklist runs alongside the assurance work, the Vendor Risk Assessment Checklist collects supplier evidence, and the Annual Compliance Calendar Checklist holds the reporting dates.

Frequently Asked Questions

Which companies must report under the CSRD now?

+

After Omnibus I, EU companies with more than 1,000 employees and more than €450m net turnover, both tests met, and non-EU groups with more than €450m of EU turnover and an EU subsidiary or branch above €200m. Listed SMEs are no longer in scope. Companies newly caught report for financial years from 2027, and non-EU parents from 2028. Your Member State’s transposition, due by 19 March 2027, sets the details that bind you.

What is double materiality?

+

A topic is material if it matters from either direction. Impact materiality asks how the company affects people and the environment, judged by severity and likelihood. Financial materiality asks how sustainability matters affect the company’s cash flows, performance and cost of capital. The revised ESRS keep the principle but allow a top-down approach and reasonable, supportable information available without undue cost or effort.

What is VSME, and does a supplier have to use it?

+

VSME is the voluntary sustainability reporting standard for SMEs that EFRAG developed and the Commission recommended in July 2025. The EU voluntary standard that took effect on 24 September 2026 is based on it. Nobody has to use it. Its practical value is the value chain cap: from financial year 2027, a CSRD reporter cannot require more than the standard’s short list of datapoints from a supplier averaging 1,000 employees or fewer, for its own CSRD report. Requests made under other laws are not limited.

Does a CSRD report need assurance?

+

Yes, limited assurance by the statutory auditor or, where the Member State allows it, an independent assurance services provider. Omnibus I removed the planned step up to reasonable assurance. The Commission must adopt a limited assurance standard by 1 July 2027; until then providers follow national rules, the CEAOB’s September 2024 guidelines and, increasingly, ISSA 5000, which applies to periods beginning on or after 15 December 2026.

Do UK or US companies face similar reporting rules?

+

Some do. The UK published its Sustainability Reporting Standards, UK SRS S1 and S2, based on the ISSB’s IFRS S1 and S2, in February 2026; the ISSB standards themselves took effect for periods beginning on or after 1 January 2024, wherever a jurisdiction adopts them. The FCA’s final rules of 30 September 2026 apply UK SRS to listed companies on a comply-or-explain basis for periods beginning on or after 1 January 2027. In California, first Scope 1 and 2 reports under SB 253 were due by 10 November 2026 under CARB’s revised timetable at the time of review, while SB 261 climate-risk reporting remained blocked by a Ninth Circuit injunction pending appeal.

Is CheckFlow free for this template?

+

14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.

Sign Off Sustainability Data You Can Trace to Source

Free trial — no credit card required.