Audit-Ready Sustainability: Decoding the Context Behind 26 Distinct ESG Risk Scores

Imagine two ESG providers assessing the same company on a 0–100 scale, where higher scores indicate stronger ESG performance. 

One gives the company 68, and the other gives it 84.

Neither score is necessarily wrong, yet each could influence supplier approvals, investment decisions, or regulatory disclosures in very different ways.

The challenge isn’t simply that ESG ratings disagree.

It's that most scores provide little insight into why they differ or what evidence lies behind the final number.

To make sense of those differences, this article breaks down how a modern ESG risk score is actually built, why providers routinely reach different conclusions, and what separates a score you can defend from one you're simply hoping holds up.

Inside the Score: Pillars, Themes, and Risk Criteria

An ESG risk score may appear to be a single number, but it is the result of a layered assessment. 

Rather than evaluating sustainability as one broad concept, modern ESG frameworks organize information into a hierarchy of pillars, themes, and individual risk criteria. 

This structure allows you to see a company's overall ESG performance as well as the specific factors driving the final score. 

At the highest level are the three familiar ESG pillars: Environmental, Social, and Governance.

Each pillar is divided into related themes, which are then assessed using measurable risk criteria:

This layered approach provides far more actionable insight than a single composite score. 

Instead of relying solely on an overall ESG rating, you can examine the specific criteria most relevant to your organization. 

For example, a procurement team may prioritize supplier labor practices, while a compliance team may focus on anti-corruption controls or board accountability. 

Evaluating these areas individually makes it easier to set targeted eligibility thresholds, identify gaps, and prioritize remediation efforts.

To organize these assessments consistently, many ESG providers use established taxonomies such as the United Nations Environment Programme Finance Initiative (UNEP FI) risk framework.

Rather than treating ESG as a collection of disconnected metrics, these taxonomies group sustainability risks into standardized categories that can be applied across industries, geographies, and use cases.

As Sean Kidney, CEO and co-founder of the Climate Bonds Initiative, an international nonprofit that develops science-based standards and taxonomies for sustainable finance, explains:

Although Kidney is referring to sustainable finance more broadly, the same principle applies to ESG risk assessments.

A common taxonomy gives organizations a shared language for evaluating companies, comparing suppliers, and communicating sustainability performance more consistently.

Standardized taxonomies also simplify regulatory reporting.

The same underlying ESG criterion, such as greenhouse gas emissions or board diversity, can be mapped to multiple reporting frameworks, including the:

• Corporate Sustainability Reporting Directive (CSRD)
• Sustainable Finance Disclosure Regulation (SFDR)
• Task Force on Climate-related Financial Disclosures (TCFD)

Instead of collecting the same information separately for each framework, organizations can capture data once and reuse it across multiple reporting obligations.

The industry is already moving in this direction.

In 2024, the UNEP FI released its ESRS Interoperability Package, which maps sustainability data collected through its Principles for Responsible Banking framework to CSRD reporting requirements through topic mappings, data-point mappings, conversion tools, and implementation guidance.

The initiative demonstrates how a shared taxonomy can reduce duplicate reporting while improving consistency, traceability, and audit readiness.

Why a Single ESG Number Isn't Enough

A single ESG score may seem like a simple way to compare companies, but that simplicity can be misleading.

The same organization can receive significantly different ESG ratings depending on which provider you consult.

A landmark study by researchers from the Massachusetts Institute of Technology Sloan School of Management found that the average correlation between major ESG ratings is just 0.54.

In practical terms, this indicates only moderate agreement: ESG providers often reach substantially different conclusions about the same company’s sustainability performance. 

By comparison, credit ratings from agencies such as Moody’s and S&P Global Ratings typically correlate at approximately 0.99, reflecting much stronger agreement on company risk.

The difference stems largely from what providers choose to measure, how they measure it, and how much weight they assign to each factor.

Unlike credit ratings, which assess a relatively standardized concept of default risk, ESG providers can define and measure sustainability risk in substantially different ways.

That means two providers can use credible data about the same company yet produce different ratings because they’re effectively answering different questions about ESG risk.

Importantly, this divergence isn’t evidence of poor-quality data or flawed analysis.

The disagreement comes from three structural differences in how providers define and measure ESG risk:

• Scope - providers evaluate different ESG topics or indicators.
• Measurement - providers assess the same issue using different metrics, data sources, or estimation techniques.
• Weighting - providers assign different importance to individual ESG factors when calculating the final score.

Among these, scope divergence accounts for the largest share of disagreement, followed by measurement, while weighting contributes a smaller but still meaningful portion.

In other words, two providers can analyze the same company using credible data and still reach different conclusions because they prioritize different aspects of sustainability performance.

For organizations making high-stakes decisions, that divergence has practical consequences.

A procurement team evaluating supplier risk, an investment firm screening portfolio companies, or a compliance office preparing a CSRD disclosure may all reach different conclusions depending on which ESG provider they use.

Without visibility into the underlying pillars, themes, and individual risk criteria, it’s difficult to determine whether a low score reflects weak environmental performance, governance concerns, labor practices, or simply a different assessment methodology.

The question, then, is not which ESG provider has the "right" score, but whether you can understand the reasoning behind the one you use. 

As Bruce Kahn, Ph.D., Lead Portfolio Manager of the Sheldon Sustainable Equity Fund at Sheldon Capital Management, notes:

Rather than relying on a single headline rating, you should understand the criteria, evidence, and methodology that produced it.

That is why audit-ready ESG analysis requires more than a single number.

Decision-makers need transparent, criterion-level evidence showing how a score was calculated, what data supports it, and which sustainability risks contributed most to the final assessment.

What "Explainability" Actually Means for a Score

If ESG ratings can produce different answers for the same company, the next question becomes: can you explain how a particular score was calculated?

For organizations making procurement, investment, or compliance decisions, the answer matters just as much as the score itself.

In ESG reporting, explainability goes beyond publishing a methodology document or describing the categories included in an assessment.

It means every score can be traced back to the underlying data that produced it, the source of that data, the methodology used to evaluate it, and the company's performance relative to comparable organizations.

Rather than functioning as a black box, an explainable ESG score exposes the evidence behind the final rating so stakeholders can understand, and if necessary, challenge the reasoning.

The difference becomes clear in practice.

A black-box ESG score may assign a supplier a governance rating of 42 out of 100 without explaining whether the result reflects weak board oversight, inadequate anti-corruption controls, limited public disclosure, or the provider's own weighting methodology.

Without that context, compliance teams and auditors have little basis for validating the assessment, defending it during an audit, or understanding why the score changes over time.

This level of transparency is becoming increasingly important as sustainability disclosures face greater regulatory scrutiny.

According to Deloitte’s 2024 Sustainability Action Report, 57% of executives identify data quality as their organization’s biggest ESG reporting challenge, while 81% cite documentation and sign-off among their top ESG reporting challenges.

These findings highlight a problem that sits upstream of the ESG score itself: organizations need reliable, documented data before they can produce reporting that stands up to scrutiny.

But reliable data alone doesn’t make a score explainable.

You also need to understand how that data was evaluated, weighted, and translated into the final assessment.

Many ESG providers publish high-level descriptions of their methodologies but provide limited visibility into how individual company scores are derived.

Veridion addresses this challenge by building explainability directly into its ESG data layer, which is powered by a continuously updated view of the global business landscape.

Rather than producing a standalone numerical rating, each ESG score is accompanied by a justification string that identifies the underlying business attribute influencing the assessment, together with a quartile benchmark showing how the company compares with others in the same North American Industry Classification System (NAICS) industry.

This creates a traceable link between the underlying business data and the resulting ESG assessment, allowing data teams, compliance professionals, and auditors to reproduce the reasoning behind a score instead of treating it as an opaque model output. 

Because the underlying business data is continuously refreshed, organizations can evaluate ESG risk using evidence that reflects the latest available company information rather than relying solely on periodic disclosures.

Guardrails That Keep a Score Defensible Over Time

Explainability is only one part of audit readiness. 

An ESG score also needs to change for the right reasons and remain defensible over time. 

Here, a defensible score means one you can trace back to its underlying evidence and explain why it changed when that evidence changed.

If a company's rating changes dramatically between reporting periods without a corresponding change in its underlying sustainability performance, stakeholders are left wondering whether the business actually changed or whether the scoring model did. 

A score that cannot remain consistent across reporting cycles is almost as difficult to defend as one whose methodology cannot be explained. 

Meaningful Changes Should Drive Score Changes

An ESG score isn’t supposed to stay static.

If a company’s underlying risk changes, its assessment should change with it.

What matters to the end user is whether the reason for that change is visible and traceable.

Imagine a supplier’s governance score drops significantly between two reporting periods.

That change could reflect a new regulatory violation, a change in board composition, newly available company data, or a revision to the provider’s scoring methodology.

Each scenario has a different implication for your risk assessment.

Without a record of what changed, you may know that the score moved but not whether the supplier’s underlying risk actually changed.

This is where longitudinal explainability becomes important.

A useful ESG data set should allow you to compare assessments across reporting periods and identify what changed in the underlying evidence, how that affected the relevant criteria, and whether any methodological changes contributed to the new result.

For example, new emissions data or an environmental enforcement action might legitimately increase a company’s environmental risk.

A change in the provider’s methodology, however, could alter the score without any corresponding change in the company’s underlying performance.

Those are fundamentally different events, and your data should allow you to distinguish between them.

For data teams, this traceability makes ESG scores more useful in downstream systems.

You can determine whether a change should trigger a supplier-risk alert, prompt a new due-diligence review, or simply be recorded as a methodological update rather than a change in the company’s risk profile.

Audit Ready Scores Need More Than Transparency

Consistency alone is not enough.

A score also needs to withstand scrutiny from people outside your organization. 

Internal compliance teams, external auditors, regulators, business partners, and investors should all be able to understand how an assessment was produced and why it changed over time. 

A practical example comes from Hiscox, a specialty insurer that needed ESG assessments capable of supporting sustainability-linked insurance products across a portfolio dominated by private companies.

By replacing disclosure-based ratings with explainable ESG scores supported by criterion-level justifications, the insurer expanded eligibility for sustainability-linked products while adopting a methodology that Swiss Re was willing to evaluate and accep

This is one of several real-world examples illustrating that audit-ready ESG data isn’t simply about assigning a score, but about providing enough supporting evidence for another organization to understand and rely on the reasoning behind that score.

Questions to Ask Any ESG Data Provider

Before relying on ESG data for procurement, investment analysis, or regulatory reporting, ask some practical questions:

• Can every score be traced back to the underlying data that produced it?
• Does the provider identify the original data sources and explain how they were validated?
• Can you see which criteria contributed to the final score?
• Is the weighting methodology documented and applied consistently across reporting periods?
• Can scores be benchmarked against companies within the same industry or peer group?
• If a score changes between reporting periods, can the provider explain exactly what changed and why?
• Is there an auditable history showing how the score evolved over time?

If the answer to several of these questions is “no,” the ESG score may be difficult to defend during an audit, regulatory review, or due diligence exercise, regardless of how sophisticated the underlying model appears

Conclusion

The reality is that ESG scores were never going to converge into a single, universally agreed-upon number. 

The differences between providers are structural, not accidental.

What can change is your relationship to the score.

You can keep treating it as something you receive and hope it withstands scrutiny, or you can start treating it as something you’re entitled to interrogate. 

Audit readiness isn’t a property of a single well-designed score.

It’s a property of a system that lets you trace, justify, and defend every number it produces, whether today or next quarter, and in front of anyone who asks.

The organizations best prepared for evolving sustainability requirements won't be those with the highest ESG scores.

They'll be the ones that can explain, justify, and defend every score they rely on.