The register lives in data sets
Data sets hold the datapoint list, owners and emission factors as reference tables that fill each year’s checklist. Update a factor once and next year’s cycle starts from the current edition.
This free ESG reporting checklist is for sustainability leads, controllers and the site, HR and procurement owners who supply the numbers. It suits companies in scope of the Corporate Sustainability Reporting Directive (CSRD), companies reporting voluntarily, and suppliers answering customer and bank questionnaires. It runs one reporting cycle: basis and boundary, double materiality, the datapoint list and its owners, collection, evidence and review, assurance and sign-off. The output is a register naming a source, an owner and a reviewer for every reported figure.
EU sustainability reporting was rewritten twice in a year. The ‘stop-the-clock’ Directive (EU) 2025/794, published on 16 April 2025, postponed the second and third waves by two years. The Omnibus I Directive (EU) 2026/470, published on 26 February 2026 and in force since 18 March 2026, then cut the scope itself, removed listed SMEs, dropped sector-specific standards and abandoned the move to reasonable assurance. Member States must transpose its CSRD changes by 19 March 2027.
Fewer companies must report, but more are asked for data. Banks, insurers and large customers still want emissions and workforce figures from their suppliers, and the work of collecting, checking and approving those figures is the same whatever the basis. That shared work is what this checklist runs.
Who: EU companies above both thresholds, and non-EU groups with €450m of EU turnover and an EU subsidiary or branch above €200m.
When: financial years from 2027 for EU companies not already reporting, 2028 for non-EU parents.
Standard: the revised ESRS in Delegated Regulation (EU) 2026/1563, mandatory from financial year 2027, with limited assurance.
Who: any undertaking outside mandatory scope, including SMEs answering requests from customers, lenders and investors.
Standard: Delegated Regulation (EU) 2026/1560, in force since 24 September 2026, based on the July 2025 VSME Recommendation.
Value chain cap: from financial year 2027, mandatory reporters cannot require more than the standard’s short list of datapoints from suppliers averaging 1,000 employees or fewer.
Companies that reported from financial year 2024 and remain above the new thresholds carry on. A July 2025 ‘quick fix’, Delegated Regulation (EU) 2025/1416, lets them defer ESRS E4, S2, S3 and S4 and the anticipated financial effects for 2025 and 2026. For 2026 they may use the existing ESRS, the existing ESRS with selected reliefs, or the revised set, and must say which. Those below the new thresholds leave scope from 2027, and Member States may exempt them for 2025 and 2026: check your national law.
This template covers the reporting cycle, not the management systems behind it. Running an environmental management system has its own ISO 14001 checklist, and the financial statement audit its own external audit preparation checklist.
Seven phases, one checklist per reporting year. The reporting basis you choose first decides which phases appear.
The first task records the reporting basis, the reporting lead and the approver. A mandatory basis shows Phases 2 and 6.
Shown when the basis is CSRD with ESRS. Voluntary reporters skip it and work from the standard’s modules.
Each collection task is assigned to the data owner named in the register, with a due date from the data cut-off.
Shown when the basis is CSRD with ESRS. Voluntary reporters can add it if a lender or customer asks for assurance.
The sign-off is an approval assigned to the approver named in Phase 1; publication waits for it.
The table links each requirement to its source and to the phase that produces the evidence. National transposition can add detail, so treat the table as a starting point, not legal advice.
| Requirement | Source | Applies to | Evidenced in |
|---|---|---|---|
| Scope thresholds | CSRD as amended by Directive (EU) 2026/470 | Over 1,000 employees and €450m turnover | Phase 1 |
| Standard and version | Delegated Regulations (EU) 2023/2772, 2025/1416 and 2026/1563 | Existing ESRS to 2026; revised ESRS from 2027 | Phase 1 |
| Double materiality | ESRS 1 | Mandatory reporters | Phase 2 |
| Voluntary reporting | Delegated Regulation (EU) 2026/1560; Recommendation (EU) 2025/1710 (VSME) | Undertakings outside scope | Phases 3 and 4 |
| Value chain cap | Directive (EU) 2026/470; voluntary standard Annex II | Requests to suppliers averaging 1,000 employees or fewer, from 2027 | Phase 3 |
| Greenhouse gas emissions | ESRS E1; GHG Protocol Corporate Standard and Scope 2 Guidance | Where climate is material | Phase 4 |
| Own workforce and business conduct | ESRS S1 and G1 | Where material | Phase 4 |
| Placement | Accounting Directive Arts. 19a and 29a | Mandatory reporters | Phase 7 |
| Limited assurance | CSRD; Commission standard due by 1 July 2027; CEAOB guidelines (2024) | Mandatory reporters | Phase 6 |
Several things were still moving at the time of review. The revised ESRS were published on 21 September 2026 and enter into force on 10 November 2026. The Commission has not yet adopted its limited assurance standard, which is due by 1 July 2027, so engagements rely on the CEAOB’s 2024 guidelines and the IAASB’s ISSA 5000. Transposition of Omnibus I differs by Member State until March 2027. The same directive moved the separate due diligence regime, the CSDDD, to July 2029 for companies with more than 5,000 employees and €1.5bn turnover. Nothing on this page is legal advice.
Data sets hold the datapoint list, owners and emission factors as reference tables that fill each year’s checklist. Update a factor once and next year’s cycle starts from the current edition.
Conditional logic shows the materiality and assurance phases only for a CSRD report. A supplier answering a customer on the voluntary standard sees the same collection and review steps without them.
Owners and reviewers are assigned per task, evidence is attached where the number is entered, and the final sign-off is an approval. When the assurance provider asks who produced a figure and who checked it, the activity trail answers.
CheckFlow is not a carbon accounting tool, an ESG data platform or an assurance provider. It does not calculate emissions or tag your report. It runs the cycle, assigns the work and keeps the evidence, alongside whatever calculation tools you use. The rest of the reporting calendar can run on CheckFlow’s compliance checklist software.
The ISO 14001 checklist keeps the environmental data sources under control all year, and the ISO 45001 checklist does the same for the safety figures. The External Audit Preparation Checklist runs alongside the assurance work, the Vendor Risk Assessment Checklist collects supplier evidence, and the Annual Compliance Calendar Checklist holds the reporting dates.
After Omnibus I, EU companies with more than 1,000 employees and more than €450m net turnover, both tests met, and non-EU groups with more than €450m of EU turnover and an EU subsidiary or branch above €200m. Listed SMEs are no longer in scope. Companies newly caught report for financial years from 2027, and non-EU parents from 2028. Your Member State’s transposition, due by 19 March 2027, sets the details that bind you.
A topic is material if it matters from either direction. Impact materiality asks how the company affects people and the environment, judged by severity and likelihood. Financial materiality asks how sustainability matters affect the company’s cash flows, performance and cost of capital. The revised ESRS keep the principle but allow a top-down approach and reasonable, supportable information available without undue cost or effort.
VSME is the voluntary sustainability reporting standard for SMEs that EFRAG developed and the Commission recommended in July 2025. The EU voluntary standard that took effect on 24 September 2026 is based on it. Nobody has to use it. Its practical value is the value chain cap: from financial year 2027, a CSRD reporter cannot require more than the standard’s short list of datapoints from a supplier averaging 1,000 employees or fewer, for its own CSRD report. Requests made under other laws are not limited.
Yes, limited assurance by the statutory auditor or, where the Member State allows it, an independent assurance services provider. Omnibus I removed the planned step up to reasonable assurance. The Commission must adopt a limited assurance standard by 1 July 2027; until then providers follow national rules, the CEAOB’s September 2024 guidelines and, increasingly, ISSA 5000, which applies to periods beginning on or after 15 December 2026.
Some do. The UK published its Sustainability Reporting Standards, UK SRS S1 and S2, based on the ISSB’s IFRS S1 and S2, in February 2026; the ISSB standards themselves took effect for periods beginning on or after 1 January 2024, wherever a jurisdiction adopts them. The FCA’s final rules of 30 September 2026 apply UK SRS to listed companies on a comply-or-explain basis for periods beginning on or after 1 January 2027. In California, first Scope 1 and 2 reports under SB 253 were due by 10 November 2026 under CARB’s revised timetable at the time of review, while SB 261 climate-risk reporting remained blocked by a Ninth Circuit injunction pending appeal.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.