Building the sustainability data model

# Building the sustainability data model

In 2023, a German industrial group discovered that its Scope 3 emissions figure, the number it had published in three consecutive annual reports, was wrong by roughly 40%. The error wasn't fraud or negligence. It was architecture. The company had estimated purchased-goods emissions using an industry-average spend-based factor: multiply dollars spent by an emissions coefficient. When its assurance provider, preparing for CSRD's move from limited to reasonable assurance, traced the number back to source, they found the spend data pulled from a procurement system that netted rebates against gross purchases, understating volume, while the emission factors were three years stale. The CFO had signed off on a figure with a control environment that wouldn't have survived a first-year audit of accounts payable.

That is the shift you now manage. ESG data has crossed the line from marketing narrative to assured financial-grade disclosure. Under CSRD, ISSB, and California's SB 253, the number you publish is subject to the same expectations of completeness, accuracy, and auditability as revenue. The problem is that most companies built their sustainability reporting on spreadsheets maintained by a two-person team, while their financial data runs on a hardened ERP with segregation of duties, reconciliation, and a clean audit trail. Your job is to close that gap, to build a sustainability data model that a reasonable-assurance auditor and a skeptical short-seller can both stress-test without it collapsing.

Treating emissions data as a financial data problem

Start by refusing the framing that sustainability data is "different." The mechanics are identical to any financial consolidation: you have source transactions, a chart of accounts, a consolidation logic, and an output that ties to a control framework. The reason ESG reporting feels chaotic is that companies skipped the middle layer.

MapMapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.View full definition → it directly. Your financial chart of accounts has an analog: an emissions taxonomy aligned to the 15 GHG Protocol Scope 3 categories, each with defined boundaries. Your general ledger has an analog: an activity-data ledger where each record captures a physical quantity (kilowatt-hours, tonne-kilometers, kilograms of a purchased material) plus the emission factor applied and its source. Your consolidation entity structure, legal entities rolling into a group, maps to your organizational and operational boundary decisions, which determine what you consolidate and what you disclose as investees or joint operations.

The critical discipline is separating activity data from emission factors. An emissions number is always the product of a quantity and a factor: 10,000 liters of diesel × the diesel emission factor. When you collapse these into a single reported figure, you destroy auditability, because the auditor cannot test the two components independently. When you keep them separate, you can independently verify the diesel volume (against invoices, meter readings, fuel cards) and independently verify the factor (against a governed factor library with version control and effective dates). This is the single most important architectural decision you will make, and most companies get it wrong by buying a tool that outputs tonnes of CO2e without preserving the underlying quantities.

Build a factor library the way treasury builds an approved-counterparty list. It should be a governed, versioned reference table: every factor has a source (DEFRA, EPA, ecoinvent, supplier-specific), an effective date range, a unit, and an owner who approves changes. When you restate, and you will restate, as factors update annually, you need to reproduce the prior-period number exactly using the factors that were live at the time. That is the emissions equivalent of maintaining your prior-year trial balance.

The judgment call CFOs miss: the data model must be designed backward from the assurance opinion, not forward from data availability. Ask your assurance provider what evidence they will require for reasonable assurance on each Scope 3 category, then design the capture to produce that evidence as a byproduct of normal operations, not as a year-end scramble.

The scope 3 estimation ladder and the materiality of method

Scope 3 is where the data model earns its keep, because for most companies it represents 70-90% of the total footprint and is almost entirely outside your operational control. You cannot meter your suppliers' factories. So you make estimation choices, and those choices are now material accounting judgments that must be documented, consistent, and defensible.

Think of Scope 3 methods as a ladder from crude to precise:

Rung 1: Spend-based estimation

You multiply procurement spend by an economic emission factor (kg CO2e per dollar). This is the German group's approach, fast, complete, and coarse. It is acceptable for immaterial categories and as a first-year baseline, but it has a fatal flaw for management: it improves when you cut spend and worsens when prices rise, regardless of actual decarbonization. If your steel supplier switches to green steel but charges a premium, your spend-based number gets *worse*. You cannot run a reduction program on a metric that moves opposite to reality.

Rung 2: Average-data (activity-based)

You capture physical quantities, tonnes of steel, kilometers shipped, and apply industry-average factors per unit. This decouples the metric from price and lets you show genuine efficiency gains. The cost is a more demanding data model: you now need physical quantities from procurement and logistics systems, not just dollar amounts.

Rung 3: Supplier-specific data

You collect actual emissions data from individual suppliers tied to the specific products you buy. This is the only method that reflects your suppliers' own decarbonization and the only one that will survive scrutiny once a category becomes material. It is also the hardest to source and the least reliable, because supplier data qualitydata qualityThe degree to which data is fit for purpose: accurate, complete, consistent, timely, valid and unique. Poor quality data undermines analytics, reporting and AI.View full definition → is wildly uneven.

The framework for where to invest on the ladder is a materiality-weighted decision. Do not try to get supplier-specific data on all 15 categories, you will bankrupt your team on rounding errors. Instead:

1. Run a spend-based estimate across everything to establish where the emissions actually sit.

2. Identify the vital few categories and suppliers, typically the top 20% of suppliers drive 80% of purchased-goods emissions.

3. Climb the ladder only for those. For the long tail, stay on spend- or average-data and disclose the method.

Document your method by category in a policy that reads like a revenue-recognition policy: this is the accounting judgment layer, and consistency period-over-period is what assurance tests hardest. If you switch methods, you must be able to explain the change and, ideally, restate the comparative.

Building the supplier data supply chain

Supplier-specific data is a procurement problem disguised as a reporting problem, and this is where the CFO's cross-functional authority is decisive. You are asking thousands of suppliers, many of whom have no sustainability function, to give you audited-quality emissions data on the specific goods you purchased. Most will not respond. Those who do will send inconsistent, unverifiable numbers.

The winning move is to stop treating supplier ESG data as a survey and start treating it as a contractual data feed. Three levers:

Contract clauses. Embed emissions-data provision into procurement contracts at renewal, format, frequency, verification level, and audit rights. This converts a voluntary ask into a supplier obligation and gives you standing to demand quality. It works only if procurement and legal are aligned, which is the CFO's job to orchestrate.

Tiered data requests. Do not send every supplier the same 200-question survey. Segment by emissions materiality. Your top emitters get a detailed product-carbon-footprint request with verification requirements; the mid-tier gets a simplified activity-data request; the long tail gets no request at all and stays on secondary factors. This respects both your suppliers' capacity and your team's bandwidth.

A data-quality scoring layer. This is the piece almost everyone omits and the piece assurance providers love. For every Scope 3 data point, attach a quality flag: is it supplier-specific and verified, supplier-specific unverified, average-data, or spend-based estimate? Roll this up into a data-quality score for each category. This does three things: it tells you where your number is soft, it gives the auditor a risk mapmapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.View full definition →, and it lets you show progress by *improving data qualitydata qualityThe degree to which data is fit for purpose: accurate, complete, consistent, timely, valid and unique. Poor quality data undermines analytics, reporting and AI.View full definition →*, not just reducing emissions. A CFO who can present "we moved 60% of purchased-goods emissions from spend-based to supplier-specific this year" is demonstrating control-environment maturity in a way the board understands.

The practical build sequence: land the activity and factor architecture first, wire in the internal systems (ERP procurement, logistics, utilities, fleet/fuel), then layer supplier-specific feeds onto your top emitters. Do not start with a supplier portal before you can consolidate your own dataown dataData collected directly from your own customers and prospects through your own channels: your most reliable and privacy-compliant source.View full definition →, you will collect information you cannot process.

One caution on tooling: the carbon-accounting software market is crowded and immature. Buy tools that expose the underlying activity data and factor logic, integrate with your ERP, and produce an audit trail. Reject any black box that outputs a number you cannot decompose. If you cannot show the auditor how the number was built, you own an unassurable liability.

Governance, controls, and the assurance-ready close

The final layer is what turns a data model into a reportable system: a controls environment and a close process. You already run a financial close with cutoff procedures, reconciliations, review controls, and sign-offs. Extend it.

Build an ESG close calendar that mirrors the financial close, with defined data-collection windows, reconciliation steps, and management review before sign-off. The dangerous pattern is a sustainability team that collects data all year in an unstructured way and then assembles the report in a two-week panic. Reasonable assurance cannot be given on a panic.

Design controls at three points. First, at data entry: validation rules, completeness checks (did every facility report utilities?), and reconciliation of physical quantities to financial records, your reported diesel volume should reconcile to fuel expense in the GL, and a variance should trigger investigation. Second, at the factor layer: change control over the factor library, with approval and documentation. Third, at consolidation: a review control where an accountable owner reviews the movement in each category and can explain year-over-year variance, exactly as they would explain a swing in a P&L line.

The reconciliation discipline is worth dwelling on. The strongest control you can build is tying activity data back to financial data. Fuel emissions tie to fuel spend. Electricity emissions tie to utility payments. Business-travel emissions tie to the T&E system. Purchased-goods activity data ties to procurement volumes. Where a physical quantity has a financial twin, reconcile them, because your financial data is already assured, and using it as the anchor gives the whole model credibility it cannot earn on its own.

Finally, own the restatement policy. Emission factors update, methods improve, and acquisitions change the boundary. Decide in advance the threshold that triggers a restatement of prior periods, and document it. This is a governance decision the audit committee should ratify, precisely as they would for a financial restatement policy. When your emissions number moves, the board's first question will be "is this real reduction or a data change?", and your data model must answer it instantly.

Key Takeaways

• Separate activity data from emission factors at the point of capture. A reported emissions figure is always a quantity times a factor; storing only the product destroys auditability. Maintain a governed, versioned factor library with effective dates so you can reproduce any prior-period number exactly.

• Design the data model backward from the assurance opinion. Ask your assurance provider what evidence reasonable assurance requires for each Scope 3 category, then engineer normal operations to produce that evidence as a byproduct, not as a year-end reconstruction.

• Climb the Scope 3 estimation ladder only where it's material. Spend-based estimation across everything to find where emissions sit, then invest in supplier-specific data for the top 20% of suppliers that drive most of the footprint. Document method-by-category as a formal accounting-judgment policy.

• Convert supplier data from surveys into contractual feeds, and attach a data-quality score to every data point. Improving data qualitydata qualityThe degree to which data is fit for purpose: accurate, complete, consistent, timely, valid and unique. Poor quality data undermines analytics, reporting and AI.View full definition → is a reportable form of progress your board and auditor both understand.

• Reconcile emissions activity data to already-assured financial data wherever a physical quantity has a financial twin, and run an ESG close on a calendar with entry, factor, and consolidation controls. The credibility of the whole model rests on this anchor.