12 CSRD Readiness Checks Every CFO Should Run This Quarter

CSRD is not another voluntary framework. It is a mandatory disclosure regime with independent assurance, and the mid-market companies caught in its scope are the ones least prepared. If your calendar has a CSRD reporting year in the next 24 months, the following 12 checks are what separates a clean first report from a scramble.

Run these this quarter. Not next quarter.

What is CSRD, in one paragraph?

The EU Corporate Sustainability Reporting Directive requires in-scope companies to publish detailed sustainability information following the European Sustainability Reporting Standards (ESRS), with independent limited assurance. Coverage spans climate, pollution, biodiversity, resource use, workforce, communities, consumers, and governance. For most mid-market B2B companies, ESRS E1 (climate) is the largest lift, though the double materiality assessment can pull in other standards. The regulation has been through revision cycles, so confirm current timelines with EU counsel; do not assume last year's schedule is current.

Check 1: is your reporting timeline confirmed in writing?

Someone in your organization should be able to state, in one sentence, when your first CSRD report is due, what fiscal year it covers, and which EU legal entity is the reporting unit. If nobody can, that is the first problem.

The scope of CSRD has been shaped by multiple regulatory updates (including the Omnibus package). Regulatory timelines shift. What does not shift is that a mid-market company selling into the EU with meaningful revenue and any EU subsidiary should have a legal opinion on file about whether and when they are in scope. Not an assumption. An opinion.

Check 2: have you drawn the consolidation boundary?

CSRD reports at the group level. If your organization has multiple legal entities, joint ventures, or minority stakes, the consolidation boundary needs to be defined the same way your financial statements define it.

• Operational control: you consolidate 100% of entities you operate.
• Financial control: you consolidate based on ownership percentage.
• Equity share: you consolidate proportionally.

Pick the same approach used in your financial statements. Mismatches between financial and sustainability boundaries are one of the top three findings in early assurance reviews.

Check 3: has your double materiality assessment been completed?

Double materiality is not a checkbox. It is a structured assessment covering all ESRS topics against both financial impact on the company and impact of the company on people and environment. The assessment output determines which standards apply.

Skipping this step or doing it superficially is the fastest path to an assurance finding. If you cannot show the assessment as a documented deliverable with stakeholder input and quantitative screening, redo it.

Check 4: are your Scope 1 and 2 emissions measured for the reporting year?

Scope 1 (direct fuel combustion) and Scope 2 (purchased electricity, heat, steam) are the non-negotiable minimum. Both should be measured using activity data, not estimates, for the reporting year.

• Fuel volumes from utility bills and fleet records.
• kWh from utility bills, split by location and by grid region.
• Location-based and market-based Scope 2, both reported. Not one or the other.

If either is estimated, document why and specify the plan to move to activity data. Assurance can accept estimates in year one with a documented plan; not with silence.

Check 5: have you evaluated all 15 Scope 3 categories?

Notice the word evaluated. Not reported. ESRS E1 requires you to consider all 15 GHG Protocol Scope 3 categories and disclose (a) which are material, (b) the emissions from the material ones, and (c) the justification for excluding immaterial ones.

Companies that report on the three easy categories and stay silent on the other 12 fail this check. The justification for exclusion has to be quantitative. "We do not sell physical products, so Category 11 (use of sold products) is not applicable" is fine. "We think it is small" is not.

Check 6: is your ESRS E1 datapoint coverage above 80%?

ESRS E1 has roughly 100 to 110 specific datapoints depending on which subtopics apply. Coverage below 80% at the first draft stage means late scrambling, missed narrative disclosures, and assurance friction.

Track datapoint completion the way you would track close percentages during month-end. Weekly. With owners. Datapoints without an owner do not get filled.

Check 7: is your methodology documented as a standalone appendix?

Every material figure in your report should trace to a methodology note that explains (1) the calculation approach, (2) the emission factor source and version, (3) the boundary decisions, and (4) any estimates or exclusions.

The methodology appendix is often 20 to 40 pages for a first CSRD report. Most companies underestimate this by 10x. If your appendix draft is under five pages, you have not documented enough.

Check 8: does every material figure have a source-level audit trail?

An audit trail is not "the number came from the sustainability team." It is a link from the reported figure back to a source document (invoice, utility bill, cloud usage report), an emission factor with a citation, and a reproducible calculation.

Spreadsheets can hold this at small scale. Beyond 5,000 transactions or so, you need a system that stores the trail with each line, because assurance reviewers will sample lines and ask you to walk them back.

Check 9: is your assurance provider engaged?

Limited assurance for CSRD requires an accredited provider. Booking one in the last quarter before your reporting deadline is not how this works. Engage assurance during Q1 or Q2 of the reporting year. Two reasons.

• Assurance providers have capacity constraints. Late engagement means the mid-tier options are gone.
• A pre-assurance readiness review three to six months before the report is due catches gaps while they are still fixable.

Check 10: are your internal controls documented?

CSRD is a disclosure regulation, and disclosure regulations expect internal controls. You need documented processes for how sustainability data enters your systems, who approves it, how corrections are made, and how estimates are reviewed.

Finance already has this framework for financial data (SOX-style controls if you are US-listed, similar frameworks elsewhere). Extend the same framework to sustainability data. This is where finance leadership on CSRD matters most.

Check 11: are your narrative disclosures drafted?

CSRD is not just numbers. ESRS requires narrative disclosures on governance, strategy, impacts, risks, and opportunities, policies, actions, and targets. Narrative drafts should be circulating by the end of Q2 of the reporting year.

Late narrative drafts collide with legal review at the worst time. General counsel needs at least four weeks to review climate transition plans, target claims, and forward-looking statements.

Check 12: has legal reviewed your climate claims?

Any claim about a target, a transition plan, or a decarbonization commitment that appears in your CSRD report is a public statement. In the EU it is subject to greenwashing regulations. In the US, similar SEC scrutiny applies to public companies.

Legal review is non-negotiable on:

• Net-zero and reduction target language
• Transition plan feasibility statements
• Product carbon footprint claims
• Renewable energy claims (especially unbundled RECs)

If your legal team has not seen the sustainability narrative, the report is not ready.

The mistake to avoid

The most expensive CSRD mistake is treating the report like a marketing deliverable owned by the sustainability team. It is a regulated disclosure with audit consequences, owned by the CFO office, with sustainability as a subject-matter contributor. Companies that run it that way finish their first report in the timeline. Companies that run it the other way end up in the assurance conversation nobody wants, six weeks before the deadline, discovering that the audit trail was never built. Run the 12 checks now, while you still have time to fix what fails.