Sustainability report: how to write your company’s first one

The minute

• Pick the standard before writing: GRI for broad impact, ISSB for investors
• Materiality sets the scope: report what matters to the business and to the reader
• Every indicator needs a stated method and period, otherwise it is a brochure

Why it matters: A report without method is advertising, and advertising with environmental data is exactly what greenwashing enforcement looks for.

Pick the standard

GRI looks at the company’s impact on the world; ISSB looks at the world’s risk to the company. Many organisations use both, starting with what the primary audience asks for.

The GRI Universal Standards took effect on 1 January 2023 and apply to any organisation, listed or not, in any jurisdiction. They require the reporter to describe actual impacts on the economy, the environment and people, regardless of whether those impacts affect the company’s own cash flows.

IFRS S1 and S2 (the ISSB standards) were issued in June 2023 and apply to annual reporting periods beginning on or after 1 January 2024. They are built for capital markets: the lens is whether a sustainability topic creates a financial risk or opportunity that a reasonable investor would want to know about.

The practical consequence is that a company reporting under GRI alone may disclose a water-pollution incident because it harms a community, while a company reporting under ISSB alone would disclose it only if the incident is material to enterprise value. When in doubt, starting with GRI satisfies the broader audience, and adding ISSB-aligned financial disclosures later is simpler than the reverse.

Run materiality

List candidate topics, listen to clients, staff and suppliers, then prioritise. The report covers material topics, not everything.

In practice this means three steps. First, build a long list of potential topics from sector guidance (GRI publishes sector standards for oil and gas, coal, and agriculture, among others) and from peer reports. Second, consult stakeholders: surveys, interviews, or structured workshops with the groups that are most affected. Third, score each topic on two axes (impact severity and likelihood for GRI, financial magnitude and likelihood for ISSB) and set a threshold. Topics below the threshold are documented as considered but excluded, which is itself a disclosure requirement under GRI 3.

One detail that first-time reporters overlook: materiality is not a one-time exercise. The topic list should be revisited each reporting cycle because operating conditions, regulation and stakeholder expectations shift.

Build the skeleton

Company profile, governance of the topic, material topics with indicators, time-bound targets and what was missed. The missed-targets section is what gives the rest its credibility.

A workable sequence for a first report looks like this:

1. Form a working group. At minimum one person from finance (to verify numbers), one from operations (to collect data) and one sponsor at board or C-suite level (to sign off on targets).
2. Define the base year. Every trend line needs a starting point. Choose the most recent year for which you have complete, auditable data. If you cannot audit a number, state the estimation method.
3. Set up data collection before writing. Spreadsheets work for a first cycle, but every cell needs a source tag: who measured it, with what instrument or system, over what period. Without that metadata, assurance later becomes expensive or impossible.
4. Write narrative only around the data. Each material topic gets its indicator, the method, the result, a target for the next period and, if the previous target was missed, an explanation. Filler paragraphs about corporate values do not count as disclosure.

A realistic timeline

For a company with a December year-end, a first cycle usually fits in six to eight months:

• Months 1 and 2: working group, choice of standard and materiality.
• Months 3 to 5: data collection, the GHG inventory and consolidation of social and governance indicators.
• Month 6: drafting, review by finance and legal, sign-off by management.
• Months 7 and 8: assurance where applicable, layout and publication.

Publishing alongside the financial statements helps show that sustainability and finance speak the same language.

Example: an indicator reported well

Instead of “we significantly reduced our emissions”, a good report shows: Scope 1 and 2 emissions in tCO2e for the year, compared with the base year; the boundary (sites included and consolidation approach); the emission factors used and their source; the Scope 2 method (location-based and market-based); the percentage change and what explains it; and the target for the next period. Five rows of a table do more for credibility than five pages of text.

Brazil: what changes in practice

Brazil’s securities regulator (CVM) adopted the ISSB standards through a resolution published in late 2023. Under that rule, listed companies could adopt IFRS S1 and S2 voluntarily for reporting periods starting from 1 January 2024. The mandatory adoption originally set for 2026 was revoked by CVM Resolution 244 of 29 May 2026: reporting remains voluntary, and from 1 January 2027 a listed company that chooses not to file a sustainability report must explain why in a market notice. The Brazilian Sustainability Pronouncements Committee (CBPS), which operates under the same structure as the CPC (the body that localises IFRS accounting standards in Brazil), is responsible for translating and issuing the local versions of S1 and S2.

For Brazilian companies that already report under GRI, the shift is not a replacement but an addition: CVM’s framework targets investor-grade financial disclosure, while GRI covers broader impact. Companies listed on B3 that participate in the Corporate Sustainability Index (ISE) have been publishing sustainability reports for years, but the rule raises the bar from voluntary narrative to standardised, comparable metrics for the companies that adopt it.

The consolidated text of Resolution 193 also requires assurance by an independent auditor registered with CVM: limited assurance up to the 2025 fiscal year and reasonable assurance for fiscal years beginning on or after 1 January 2026. Companies that opt in must declare explicit and unreserved compliance with the CBPS and ISSB standards and report for at least three consecutive years, as set by CVM Resolution 244. For the climate side, see TCFD and ISSB climate risk reporting.

The most common mistake

Treating the report as a communications project rather than a data project. When marketing leads the process, the result is long on narrative and short on traceable numbers. Enforcement bodies (and increasingly, courts) look for specific claims matched to specific evidence. A sentence like “we reduced emissions significantly” without a base year, a boundary definition and a calculation method is the kind of statement that triggers greenwashing complaints.

The fix is structural: data collection and methodology come first, narrative comes last, and the communications team formats but does not choose what to disclose.

What is still unresolved

Interoperability between GRI and ISSB is still a work in progress. Both bodies signed a cooperation agreement, and GRI published a correspondence map, but reporters who want a single document that satisfies both standards still face duplicate disclosures and conflicting materiality definitions. Whether a unified global baseline will emerge or reporters will continue to maintain parallel tracks is an open question that each reporting cycle makes more pressing.

Assurance standards are also catching up. The IAASB finalised ISSA 5000, a general standard for sustainability assurance, but adoption by national regulators is uneven and the market for qualified sustainability assurance providers remains small relative to demand.

Frequently asked questions

Does the report need assurance?

Not necessarily in year one. External assurance is usually driven by investors or sector regulation.

How long should it be?

Long enough to cover material topics with data. Hundred-page reports without numbers impress no one.

Can we publish only on our website?

Yes. What matters is traceability: every number with source, method and period.

Are the GRI Standards paid?

No. GRI makes the Standards available free of charge, in several languages, on its website.

Can a private company use the ISSB standards?

Yes. IFRS S1 and S2 are not limited to listed companies and help when a company is seeking credit or investors.

Read next: how to build your GHG inventory.

Read next: how to avoid greenwashing in reporting.

Primary sources: GRI Standards: Universal Standards in effect from 1 January 2023 (GRI, 2021); IFRS S1 General Requirements for Disclosure of Sustainability-related Financial Information (IFRS Foundation, 2023); CVM Resolution 193/2023 on ISSB-based sustainability reporting, consolidated text (CVM, 2026); ISSA 5000 General Requirements for Sustainability Assurance Engagements (IAASB, 2024).