Everything you need to know about CSRD: new guide

What is the Corporate Sustainability Reporting Directive (CSRD)?

The Corporate Sustainability Reporting Directive (CSRD) is a new EU legislation that mandates large and listed organisations to publish reports on social and environmental risks and their impact.

CSRD reporting refers to the process of preparing and submitting sustainability reports in accordance with the requirements set out in the directive. It would involve companies gathering relevant ESG data, measuring their sustainability performance, and disclosing that information in a standardised format. The CSRD is intended to replace the current Non-Financial Reporting Directive (NFRD) and expand the scope and depth of sustainability reporting obligations.

What are the objectives of CSRD?

The objectives of CSRD aims to help investors, consumers, policymakers and other stakeholders evaluate non-financial performance and encourage a more responsible approach to business.

CSRD will dramatically increase the number of businesses that are subject to mandatory ESG disclosures from 15,000 to over 50,000. It will also impact non-EU companies, called third-country companies, that have substantial activity in the EU. Businesses need to prepare now as successful reporting will require a holistic approach that involves the entire organisation.

Who needs to comply with CSRD?

Public-interest entities (PIEs): PIEs are companies with securities listed on EU regulated markets. This includes listed companies such as publicly traded companies and state-owned entities.

Large companies: The CSRD extends reporting obligations to large companies that meet specific size criteria. The exact criteria are yet to be determined and will be based on thresholds related to employee headcount, balance sheet total, and/or revenue.

What are the 4 stages of sustainability reporting?

  1. Planning and Strategy: Establishing sustainability goals and developing a strategy
  2. Data Collection and Measurement: Gathering relevant ESG data and tracking progress
  3. Reporting and Communication: Preparing and sharing a sustainability report
  4. Verification and Assurance: Optional third-party assessment of report accuracy

What is the difference between CSRD and SFDR?

The main differences between the Corporate Sustainability Reporting Directive (CSRD) and the Sustainable Finance Disclosure Regulation (SFDR) can be summarised as follows:

  1. Scope:
  • CSRD: Targets large public-interest entities (e.g., listed companies, banks) operating in the EU.
  • SFDR: Applies to a broader range of financial market participants, including asset managers and investment advisors.
  1. Reporting Content:
  • CSRD: Focuses on comprehensive sustainability reporting, covering environmental, social, and governance (ESG) factors.
  • SFDR: Concentrates on sustainability-related disclosures in the financial sector, specifically addressing sustainability risks and adverse impacts.
  1. Reporting Obligations:
  • CSRD: Introduces new reporting requirements to harmonise non-financial reporting standards within the EU.
  • SFDR: Requires financial market participants to disclose sustainability information, including integration of sustainability risks and adherence to specific sustainability benchmarks.
  1. Timeline and Implementation:
  • CSRD: Became effective in January 2023
  • SFDR: Became effective in March 2021, with a phased implementation approach.

How do I comply with CSRD?

  1. Determine if your organisation falls within the CSRD’s scope.
  2. Evaluate current reporting practices and identify gaps.
  3. Familiarise yourself with the CSRD requirements and guidelines.
  4. Develop or update reporting protocols aligned with CSRD.
  5. Implement robust data collection and management processes.
  6. Enhance data quality and consider external assurance.
  7. Establish governance and internal controls for reporting.
  8. Engage stakeholders and consider their feedback.
  9. Stay informed about regulatory updates related to the CSRD.
  10. Seek professional guidance to ensure compliance.

VinciWork’s CSRD reporting guide

Our new in-depth guide explains the directive and gives a comprehensive overview of all you need to know about it, including what it means for your company now and what you need to do to get ready. Don’t get left behind – find out everything you need to know and how this new directive will affect your organisation by downloading our free guide.

Download the guide

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

“In a world older and more complete than ours they move finished and complete, gifted with extensions of the senses we have lost or never attained, living by voices we shall never hear.”

Picture of James

James

VinciWorks CEO, VInciWorks

Spending time looking for your parcel around the neighbourhood is a thing of the past. That’s a promise.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

How are you managing your GDPR compliance requirements?

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.

GDPR added a significant compliance burden on DPOs and data processors. Data breaches must be reported to the authorities within 72 hours, each new data processing activity needs to be documented and Data Protection Impact Assessments (DPIA) must be carried out for processing that is likely to result in a high risk to individuals. Penalties for breaching GDPR can reach into the tens of millions of Euros.