Unlocking the Invisible 80%: How to Assess ESG Risks in Private Company Portfolios

Environmental, Social, and Governance (ESG) rating infrastructure covers a specific section of the market: listed companies, large enough to have sustainability reporting functions, operating in jurisdictions where disclosure is either mandated or investor-driven.

Most commercial insurance portfolios aren’t built on that section.

Being absent from stock markets, private companies, SMBs, and mid-market businesses don’t experience the same investor pressure, meaning ratings agencies don’t cover them.

That gap’s impact on the fluidity of underwriting processes is significant, and in this guide, we’ll walk you through what it takes to close it.

The 80% Blind Spot in ESG Underwriting

The ESG ratings ecosystem looks substantial from the outside. Dozens of agencies, thousands of data points, decades of accumulated methodology.

What it doesn’t cover is…most of your book.

The companies that make up a typical commercial insurance portfolio sit almost entirely outside the universe of rated entities. 

The data the rating agencies produce wasn’t built for them, doesn’t include them, and can’t be stretched to cover them.

Commercial underwriters operate in the dark when it comes to these types of entities. To address the blind spot problem, you need adequate fixes, which you can’t implement unless you first understand why information gets obfuscated in the first place.

We break them down below.

Rating Agencies Cover Only the Listed Minority

Major business rating agencies, like MSCI, Sustainalytics, S&P Global, and Moody’s, collectively cover somewhere between 10,000 and 20,000 companies in their primary ESG databases. Almost all of them are publicly listed.

That sounds like a lot until you consider that there are approximately 360 million registered businesses worldwide. That 10,000–20,000 figure covers less than one percent of firms.

Of course, plenty of them are microscopic businesses that don’t present meaningful insurable risk.

Still, the total number of commercially relevant private companies runs into the tens of millions.

That’s not a small blank you can fill in later or sweep under the rug – it’s a gaping chasm in coverage.

ESG rating methodology, at its core, depends on disclosure. Large listed companies produce sustainability reports, CDP filings, and regulatory submissions because their investors require it. Private companies, by and large, don’t.

According to PwC’s insurance industry ESG survey, 56% of insurers have ambitions to develop mature or leading environment-related capabilities, but only 24% report having them today. 

The tools insurers need to act on their ESG ambitions weren’t built to cover the companies they actually underwrite most of the time.

In those cases, business books end up with blind spots in their ESG coverage and inadvertently take on extra risks. This applies to businesses that are smaller by nature, such as:

• Private manufacturers
• Regional logistics operators
• Industrial SMBs
• Construction and engineering contractors
• Healthcare and social care providers
• Chemical distributors and waste management firms

Many of them can carry meaningful environmental and governance risks. Because the data to assess them often doesn’t exist anywhere, commercial underwriters can find themselves exposed and in an awkward, underinformed spot.

Matching the Insured Entity to Data Is Its Own Problem

Even when private-company ESG data does exist, there’s a second problem waiting.

Correctly linking a specific insured entity to the right data record is harder than it sounds.

Company names are ambiguous. There are thousands of businesses called “Global Solutions” or “Premier Services” or some variation thereof. 

Then there are subsidiaries that trade regionally under a different brand name that bear no resemblance to their registered legal name. 

Holding companies, operating companies, and trading entities all have separate identities, and a single insured risk can involve several of them at once.

For policies written through binders, the problem is worse.

Binder-based underwriting moves fast, often at scale. The level of entity detail that makes it into a binder submission is frequently limited, as that’s the trade-off when signing multiple policies at once under a delegated authority arrangement.

At Lloyd’s alone, delegated authority arrangements accounted for roughly 45% of total premium income in 2024. This means nearly half of one of the world’s largest specialty insurance markets is written this way, with the insurer seeing each risk only in aggregate, after the fact, through a monthly bordereau report.

Basics such as a trading name, an approximate address, and a broad industry description may be enough to bind coverage, but certainly not enough to reliably match to a data record in an external ESG database.

The practical consequence is that even an insurer with access to private-company ESG data may be unable to confidently apply it to a meaningful portion of their book.

Moody’s, in their commercial underwriting intelligence documentation, identifies entity matching as a specific, documented challenge in applying sustainability data to insurance portfolios. Not a theoretical edge case, but a routine operational constraint.

Getting the company identification right is a prerequisite for everything else. Without it, even good data doesn’t reach the underwriter in a usable form.

Black Box Scores Don’t Survive Reinsurer Review

Even if you clear the first two hurdles – finding data and matching it correctly – your problems don’t end there.

Most ESG scores arrive as “black boxes”: a single number in a vacuum, decontextualized, with no indication of what that rating is based on or what the weight distribution was. What you see is just the output, but not the reasoning behind it.

 score without an evidence trail isn’t defensible. Reinsurers reviewing a sustainability-linked product line need to understand not just what score a company received, but also how that score was derived, which signals were used, what weight was applied to each, and why a specific company landed where it did.

A number without that documentation doesn’t pass scrutiny, which is why you need to resolve this before any product ever winds up on a reinsurer’s desk.

The academic literature on ESG rating divergence is well-established on this point. Berg, Kölbel, and Rigobon’s “Aggregate Confusion,” one of the most cited studies on agency rating divergence, found that ratings from major ESG agencies disagree with each other to a degree that can’t be explained by methodology differences alone.

The paper found pairwise correlation between major agency ratings ranging from just 38% to 71%. In practice, two agencies can look at the same company and arrive at materially different conclusions, with no way to determine which is correct.

The black box nature of ESG data is also what Melanie Hayes, COO and co-founder of cyber risk management firm KYND, identifies as the root of the problem:

When two agencies rate the same company and arrive at materially different scores, and neither explains precisely why, the obvious question is: which one is right?

Reinsurers and regulators ask the same question.

A sustainability-linked product that depends on opaque, unexplained scores creates exposure for the insurer building it. 

If a claim arises, or a regulator asks how the portfolio was assessed, “we used an external ESG score” is not a sufficient answer.

Close the Gap with Evidence-Backed Data

The coverage gap, the matching problem, and the black box credibility problem all point to the same underlying need: insurance data that was built for unlisted private companies from the start.

That means observable signals that reflect reality when voluntary disclosure is limited or non-existent, verifiable commitments, and a scoring framework that applies consistently regardless of whether a company files sustainability reports.

Let’s dive into what each of these pieces contributes to the overall puzzle.

Surface Real-World Events, Not Just Self-Reported Claims

A private company that never issues a sustainability report can still have a real, observable ESG footprint.

How? You just have to broaden your search.

The news coverage a company gets is one particularly useful source. Environmental violations and labor disputes get reported in local or regional news. Larger controversies, like regulatory penalties, end up in public records and sometimes may become subjects of national debate. 

What you shouldn’t discount is that a company’s behavior leaves traces, whether they like it (or want it) or not.

Therefore, monitoring news coverage, controversies, and observable incidents rather than waiting for a company to summarize its own performance can grant you valuable insight that wouldn’t ever get picked up by rating agencies, simply because it doesn’t constitute reportable data.

The advantage for private companies specifically is significant. Voluntary disclosure rates for private businesses are low by design. As discussed, there’s no investor pressure, no listing requirement, no regulatory mandate driving them toward sustainability reports. 

But news coverage doesn’t care about that. It reflects what actually happens to real people in real places, which makes it one of the most grounded sources available. 

Additionally, there’s the benefit of timing. Real-world events typically surface through media coverage long before any formal disclosure would capture them, assuming that ever comes at all. 

A useful illustration of journalism’s power is a recent case with online clothes retailer Boohoo. It was The Sunday Times who revealed in 2020 that suppliers in Boohoo’s UK garment network were paying workers £3.50 an hour, not any formal ESG disclosure. Then, 40% off the company’s stock price was wiped over just a few days.

Putting your ear to the ground may seem like a crude solution, but it often works – and surprisingly well.

Extract Verifiable Commitments and Emissions Data

Some private companies do publish sustainability-related claims or emissions figures on their website, through a supplier questionnaire, or perhaps via an obtained third-party certification.

Given that these methods are typically less stringent than government-imposed regulations or reporting requirements, the veracity of these claims should be placed under some scrutiny. 

It’s unlikely a company that qualified for an ISO 14001 environmental management certification would disclose that they only managed to do so by the skin of their teeth, and after two resubmissions.

Really, any ESG-related claim a company publishes requires a more thorough review process when the scrutiny applied is far lighter than what’s required of listed companies.

In ESG, assumptions, interpretations, and estimates should have no place. Vagueness isn’t something reinsurers or regulators are too keen on. 

What they want is irrefutable facts: this is what the company stated, and here is where it said it. Verbatim extraction with documented sources. That type of submission cannot be easily challenged.

The same principle applies to Scope 1, 2, and 3 emissions data. 

• Scope 1 covers direct emissions from a company’s own operations. 
• Scope 2 covers purchased energy. 
• Scope 3 covers the entire value chain – the hardest to measure and the least consistently disclosed, especially among smaller companies.

Visibility issues follow directly from complexity. 

Scope 1 requires only internal operational data. Scope 2 adds purchased energy. Scope 3 demands visibility across the entire value chain, including upstream suppliers, downstream customers, and logistics. For a mid-market private company without a sustainability team, that’s rarely feasible.

Score Every Company Against a Consistent Framework

Real-world events and verbatim extractions are inputs.

The output that underwriters actually need is a score, and it has to apply the same logic to every company, regardless of how much or how little it discloses. 

Without this consistency, the only companies you can benchmark are the ones that chose to disclose in a standardized format, which largely excludes the private-company majority of most commercial books.

The United Nations Environment Program Finance Initiative (UNEP FI) risk criteria framework was developed specifically for financial institutions to assess ESG exposure across the entities they underwrite or finance. 

Unlike corporate reporting standards, it’s designed to map ESG risk to financial consequence, which makes it a natural fit for underwriting decisions.

Applying that framework across both listed and private companies is what makes portfolio-level comparison meaningful.

Veridion’s ESG Scores module does this across every active company in the world – private, public, SMB, and mid-market. Every criterion carries a justification string, making the score fully auditable.

The same explainability runs through the rest of the data package. Each module addresses a specific gap insurers face when assessing private-company risk. 

• ESG News surfaces tagged controversy signals with source URLs. 
• ESG Commitments extracts policy text verbatim, attributed to the source document it came from. 
• GHG Metrics adds Scope 1, 2, and 3 figures where disclosed, alongside Carbon Reduction Plan extracts.

The result: nothing enters the underwriting flow unattributed.

In one particular case, a specialty commercial insurer writing sustainability-linked products across the UK, US, Europe, and Asia tested exactly this. Their incumbent ratings provider covered the listed portion of their book, which amounted to roughly 20% of the eligible market. The other 80% was invisible.

After integrating Veridion’s four-module package, their eligible universe for sustainability-linked products grew 2–3x. 

After closing the private-company visibility gap, they cleared reinsurer review, which black-box scores from their previous provider had not.

You can read the full case study here.

Conclusion

Three problems sit between a commercial insurer and meaningful ESG visibility: a coverage universe built for listed companies, entity-matching constraints that limit where data can even be applied, and scoring that doesn’t hold up under reinsurer scrutiny without a documented evidence trail.

Each has a specific solution that helps you put a fuller picture together when the raw facts out there are few and far between.

If you want to uncover what the book ratings agencies don’t see, that’s when you should reach for these tools.

Applied correctly, they will do far more than just fill blatant gaps. They’ll help you turn the invisible 80% into a competitive edge.