Category: Global

  • The Cost of an Unprovable Corporate Claim

    The Cost of an Unprovable Corporate Claim

    The contract was not renewed. The notification arrived in three lines. The company was confident its pricing was competitive. Quality unquestioned. Delivery record clean. But it did not pass. A senior manager called the buyer’s contact. “Nothing wrong on your end. We just went in a different direction.” Six months later, the same buyer issued a new tender. The company was not invited.

    The Claim That Could Not Be Substantiated

    Every organisation makes claims. About the quality of its processes. About the reliability of its data. About the sustainability of its supply chain. About the governance structures behind its decisions. Most of those claims are made in good faith. Few are made with the evidence architecture required to substantiate them under independent scrutiny.

    And in a business environment where sustainability disclosures, supply chain representations, AI-assisted decisions and board statements are increasingly subject to verification, the gap between a claim and a provable claim is no longer merely a compliance question. It is an economic one.

    What an Unprovable Claim Actually Costs

    The cost of an unprovable corporate claim is rarely visible at the moment it is made. It becomes visible later. Sometimes much later. And by then, the cost has compounded. Consider what happens when a material claim cannot be substantiated under scrutiny.

    A tender is lost - not necessarily because the offering was inferior, but because the due diligence process revealed that the underlying data could not be verified. The buyer chose a supplier whose documentation required less remediation.

    An assurance engagement identifies a material evidence or control deficiency - not necessarily because the reported figures were wrong, but because the system that produced them could not provide sufficient appropriate evidence to support them. The cost of remediation may exceed the cost of building the system in the first place.

    A regulatory inquiry opens - not because the organisation intended to mislead, but because a public sustainability claim could not be substantiated at the time it was made. Legal costs, management time and reputational exposure follow.

    An investor due diligence process stalls - not because the business fundamentals are weak, but because governance documentation is incomplete and accountability structures cannot be demonstrated. The transaction timeline extends. Terms may be renegotiated. Value can be lost.

    In each case, the cost is not the claim itself. The cost is the absence of evidence to support it.

    The Compounding Effect

    What makes unprovable claims particularly expensive is not their immediate cost. It is the compounding effect of the problem remaining unaddressed. An organisation that loses a tender for reasons it does not understand may enter the next tender with the same gap. An organisation that receives an assurance finding without addressing the underlying system weakness may face similar evidence problems again.

    And one unprovable material claim should raise a broader question:

    What else in the organisation depends on evidence that has never been structured to withstand scrutiny? The problem does not resolve itself. It can compound - quietly and invisibly - until the cost of correcting it becomes significant.

    Why the Cost Remains Hidden

    EU buyers rarely say: “You did not pass because your evidence architecture was insufficient.”

    They may simply say: “We went in a different direction.”

    Regulatory scrutiny may begin with a request for documentation rather than an explicit statement that a claim was unprovable.

    Investors may not decline a transaction by saying: “Your governance cannot be demonstrated.” They may instead extend timelines, request additional evidence or seek changes to the transaction terms. In each case, the underlying issue may remain unspoken. And the organisation that does not understand the real reason continues operating with the same gap - and may pay the same cost repeatedly without knowing why.

    The Economic Logic of Defensibility

    There is an economic logic to defensibility that organisations are beginning to recognise. A system capable of substantiating material corporate claims does not only reduce legal exposure. It can reduce transaction friction. It can accelerate due diligence processes. It can reduce the cost of responding to assurance requests. It can protect management time. It can reduce friction in access to markets, counterparties and capital.

    And it can protect the individuals who made and approved material claims - because those claims were made within a system capable of demonstrating how they were produced, what evidence supported them and why reliance on them was reasonable. The cost of building that system is finite. The cost of not having it is open-ended.

    The Question Every Organisation Should Ask

    What are the material claims your organisation is currently making - about its sustainability performance, its supply chain, its governance or its AI-assisted decisions - that it could not substantiate under independent scrutiny tomorrow?

    If the answer is uncertain, the organisation does not have a documentation problem. It has an evidence gap. And that gap has a cost. The only question is whether the organisation discovers that cost on its own terms - or on someone else’s.

    Other blogs

    Trošak korporativne tvrdnje koju nije moguće dokazati

    The Cost of an Unprovable Corporate Claim

    The contract was not renewed. The notification came in three lines. The company was convinced that...

    Možete izgubiti tender prije nego što iko kaže da je razlog ESG

    You can lose a tender before anyone even cites ESG as the reason

    The formal notification came in three lines. The company was sure that the price was…

  • The Company That Can Prove Its Decisions Has a Different Risk Profile

    The Company That Can Prove Its Decisions Has a Different Risk Profile

    One loses a contract renewal. The other wins new business from the same buyer. The difference was not price. It was not quality. It was not relationship.

    It was the ability to demonstrate, under scrutiny, why a material decision was reasonable — and to produce the evidence to prove it.

    Risk Is Not Only About What Can Go Wrong

    Most organisations manage risk by identifying what could fail and building controls to prevent it. That is necessary. It is not sufficient. There is a second dimension of risk that fewer organisations have addressed.

    When a decision is challenged — by an investor, a regulator, a counterparty, an assurance practitioner — can the organisation demonstrate why it acted reasonably?

    Not assert it. Demonstrate it. The difference between those two words is the difference between a statement and a proof.

    And in a business environment where sustainability disclosures, AI-assisted decisions, supply chain representations and board statements are increasingly subject to independent scrutiny, that difference carries economic consequences.

    What Scrutiny Actually Tests

    When a material corporate decision comes under scrutiny, the question is rarely whether the decision was correct.

    It is whether the process that produced it was controlled, documented and defensible. An assurance practitioner does not ask whether your Scope 3 number looks reasonable. They ask how it was produced, who verified it, what controls were applied and whether the evidence has been preserved. A regulator investigating a greenwashing claim does not ask whether you intended to mislead.

    Among other questions, they ask whether the claim was substantiated at the time it was made — though the precise standard will depend on the applicable jurisdiction and regulatory framework.

    An investor conducting due diligence does not ask whether your governance appears sound. They ask whether you can demonstrate that it functioned — through documentation, process records and accountability structures that existed before the question was asked.

    In each case, the underlying question is increasingly the same. Not what you claim. What you can prove.

    The Gap Most Organisations Have Not Closed

    Most organisations have invested significantly in compliance systems, reporting frameworks and risk controls. Very few have asked a different question.

    If any material decision, statement or data point in our corporate reporting were challenged tomorrow — could we demonstrate how it was produced, who verified it, what controls governed it and why it should be trusted?

    That question is not about compliance. It is about defensibility. And the gap between compliance and defensibility is where risk lives — quietly, invisibly, until scrutiny arrives.

    Why This Creates a Different Risk Profile

    An organisation that can demonstrate the defensibility of its decisions operates differently from one that cannot. It enters due diligence processes with less friction. It responds to regulatory inquiries with documented evidence rather than reconstructed narratives. It provides assurance practitioners with what they need before they ask for it.

    It gives investors and counterparties a basis for trust that goes beyond representation. It protects the individuals who approved material decisions — because those decisions were made within a system capable of demonstrating why they were reasonable. That is not a compliance advantage. It is a governance advantage. And increasingly, it is a commercial one.

    The Infrastructure Question

    Modern organisations invest in financial controls, cybersecurity systems, compliance programmes and reporting platforms. Each addresses a specific category of risk. But there is a category of infrastructure that fewer organisations have built. A system capable of demonstrating — at any point, to any legitimate challenger — why a material corporate decision, statement or data point should be trusted. Not because the organisation says so. Because the evidence shows it.

    That infrastructure does not replace compliance. It completes it. Because compliance tells an organisation what must be done. Defensibility infrastructure demonstrates that what was done can be proven.

    The Question Every Board Should Ask

    If your most material corporate decision from the last twelve months were challenged tomorrow — not in court, but by an investor, a regulator or a counterparty conducting due diligence — could your organisation demonstrate:

    • How that decision was reached?
    • Who was accountable for it?
    • What evidence existed at the time to support it?
    • And whether that evidence has been preserved in a form that survives independent scrutiny?

    If the answer is uncertain, the organisation does not have a compliance problem. It has a defensibility gap. And in a business environment where the scrutiny of corporate decisions is becoming more systematic, more rigorous and more consequential — that gap has a cost. The organisations that will navigate this period successfully will not necessarily be those that comply the most. They will be the organisations that can demonstrate not only what they did — but why they did it, who was accountable, and what evidence existed when the decision was made. That is defensibility.

    Other blogs

    Trošak korporativne tvrdnje koju nije moguće dokazati

    The Cost of an Unprovable Corporate Claim

    The contract was not renewed. The notification came in three lines. The company was convinced that...

    Možete izgubiti tender prije nego što iko kaže da je razlog ESG

    You can lose a tender before anyone even cites ESG as the reason

    The formal notification came in three lines. The company was sure that the price was…

  • If You Use AI for ESG Reporting, Who Is Legally Responsible?

    If You Use AI for ESG Reporting, Who Is Legally Responsible?

    Artificial intelligence may accelerate sustainability reporting. It does not transfer accountability.

    Management signed the assertions.

    The sustainability report was prepared with AI assistance. Data was aggregated, analysed and formatted by an automated system. The board approved the report. Management signed the assertions. Six months later, during an assurance engagement, one question was asked. “Who validated this output before it was disclosed?” No one had a clear answer. Not because the AI had failed. Because no one had defined who remained responsible for what the AI produced. That distinction is becoming one of the most important governance questions organisations will face.

    The Question Nobody Is Asking

    Organisations are adopting AI tools for ESG reporting at remarkable speed. Data aggregation. Materiality assessments. Narrative generation. Gap analysis. The efficiency gains are undeniable.

    The governance gap is growing just as quickly. Poor governance around AI is no longer only a legal exposure. It is becoming a commercial one. Investors increasingly examine governance quality. Customers increasingly ask how sustainability information is produced. Assurance practitioners increasingly expect organisations to demonstrate that AI-supported outputs remained under meaningful human control. Most organisations still treat AI as a productivity tool. Increasingly, regulators expect organisations to demonstrate that AI-supported decisions remain subject to effective governance and documented human oversight. The legal question is no longer whether AI was used. It is whether its use was governed. That distinction matters. A tool may fail. A governance failure belongs to people.

    Where the EU AI Act Changes the Conversation

    The EU AI Act signals a broader regulatory direction. Where AI systems fall within its scope, organisations are expected to establish meaningful human oversight that is documented, operational and assigned to competent individuals. Even where a particular ESG AI application does not fall within the Act’s high-risk classification, the governance question remains remarkably similar. If AI contributes to corporate disclosures, organisations should be able to demonstrate: Who reviewed the output. Who understood its limitations. Who exercised independent professional judgement. Who accepted responsibility before relying on it. That expectation does not depend solely on whether a specific legal obligation applies. It reflects a broader governance principle that organisations increasingly cannot ignore. Sometimes, one question from an assurance practitioner, regulator or investor is enough to reveal whether that governance actually exists.

    Where ESG and AI Accountability Intersect

    Sustainability disclosures are not neutral documents. They are governance statements made to investors, regulators, customers and the market.
    When AI contributes to those statements — whether by aggregating data, generating narratives or supporting materiality assessments — the question of accountability does not disappear. It simply changes direction. It moves toward the people who selected the technology. Toward those who reviewed the output. Toward those who approved the disclosure. Under the Corporate Sustainability Reporting Directive, sustainability reporting has become part of corporate governance rather than a purely operational reporting exercise. The EU AI Act reinforces another principle: technology does not remove human responsibility. Together, these developments expose a governance gap that many organisations have not yet recognised.

    The Governance Gap Few Organisations Have Closed

    Most organisations using AI in ESG reporting have not answered three fundamental questions. Who is responsible for validating AI-assisted ESG outputs before disclosure? What competence does that person require to exercise meaningful oversight? How is that review documented in a way capable of withstanding assurance, regulatory scrutiny or legal challenge? Without clear answers, AI risk has not been managed. It has merely been transferred into a process without identifiable accountability. From a legal perspective, responsibility follows the decision-maker — not the instrument used to reach the decision. AI changes the process. It does not change that principle. And when scrutiny begins, accountability always returns to the people who approved the outcome. It never remains with the technology.

    The Board Dimension

    Boards approving sustainability reports increasingly face a governance question rather than a technology question.
    Approving a sustainability report is not simply authorising a document. It is confirming that the information within that document was generated, reviewed and preserved through a process the organisation understands — and can defend. If AI contributed to that process, but governance over its use was never clearly defined, documented or supervised, the board may struggle to demonstrate why reliance on those outputs was reasonable. The EU AI Act does not create accountability for governance. It makes existing governance expectations more visible.

    Why This Is Also an Economic Issue

    Weak governance around AI does not only increase legal exposure. It affects business value.

    An organisation that cannot demonstrate control over AI-assisted sustainability information may face:

    • greater assurance costs
    • slower procurement processes
    • reduced investor confidence
    • increased regulatory scrutiny
    • diminished credibility with customers and business partners

    Trust has become an economic asset. Governance is increasingly the mechanism through which that trust is earned.

    What Accountability Actually Requires

    AI can accelerate ESG reporting. It cannot replace governance. Nor can it replace evidence.

    Responsible AI-assisted sustainability reporting requires:

    • documented human oversight identifying who reviews AI outputs, with what competence and under what authority
    • evidence demonstrating that AI operated within a controlled governance process rather than replacing informed human judgement
    • governance structures capable of demonstrating that every material sustainability statement was reviewed, challenged and approved before disclosure

    Technology may generate information. Only governance transforms information into something organisations can responsibly disclose.

    The Question Every Board Should Ask

    If tomorrow an assurance practitioner, regulator or investor challenged one AI-assisted statement in your sustainability report, could your organisation demonstrate:
    Who reviewed it? How it was reviewed? Why it was considered sufficiently reliable? Who accepted responsibility before it was disclosed? If the answer is uncertain, the problem is not the AI. The problem is the governance architecture surrounding it. Because in law, accountability does not follow the tool. It follows the decision to use it.

    PROOFA™ Evidence Architecture™

    Artificial and PROOFA™ Evidence Architecture™

    Artificial intelligence does not reduce the need for evidence. It increases it.

    PROOFA™ Evidence Architecture™ was developed as the first legal operational instrument integrating forensic methodology, ESG governance, Legal Design Thinking and evidence architecture into a single defensibility framework.

    It is not an AI governance framework. It does not regulate artificial intelligence. It structures the human accountability, evidentiary integrity and governance architecture that must exist before AI-assisted information becomes part of a corporate sustainability disclosure.

    Because organisations will not ultimately be judged by whether they used AI. They will be judged by whether they can demonstrate who remained accountable after they did.

    This article discusses governance considerations arising at the intersection of AI-assisted sustainability reporting and emerging European regulatory frameworks. References to the EU AI Act reflect its broader governance direction and should not be understood as suggesting that every AI application used in ESG reporting is automatically classified as a high-risk AI system under the Act.

    Other blogs

    Trošak korporativne tvrdnje koju nije moguće dokazati

    The Cost of an Unprovable Corporate Claim

    The contract was not renewed. The notification came in three lines. The company was convinced that...

    Možete izgubiti tender prije nego što iko kaže da je razlog ESG

    You can lose a tender before anyone even cites ESG as the reason

    The formal notification came in three lines. The company was sure that the price was…

  • Board Liability in the Age of ESG Assurance

    Board Liability in the Age of ESG Assurance

    The board approved the sustainability report.

    Management signed the assertions.

    Six months later, the assurance practitioner asked one question.

    No one in the room could answer it.

    The report was accurate.

    The system that produced it was not defensible.

    That distinction is now a board-level problem.

    The Shift That Most Boards Have Not Yet Made

    For years, sustainability reporting was treated as a disclosure exercise.

    Collect the data. Prepare the report. Meet the deadline.

    Boards reviewed outputs.

    They rarely examined the systems that produced them.

    That approach was manageable when assurance expectations were limited and sustainability information existed outside the formal accountability structure of the organisation.

    That is no longer the case.

    As the Corporate Sustainability Reporting Directive embeds sustainability information into formal corporate reporting, and as the International Standard on Sustainability Assurance establishes the reference point for assurance engagements, the position of the board changes fundamentally.

    Sustainability information is no longer an operational matter reviewed by a specialist team.

    It is a governance matter for which the board is accountable.

    What Board Approval Actually Means

    Many directors still experience ESG report approval as a procedural step.

    Sign here. Move to the next agenda item.

    The legal and operational reality is different.

    When a board approves a sustainability report, it is not simply endorsing a document.

    It is asserting that the information contained in that document was generated, verified and preserved through a system capable of withstanding independent scrutiny.

    That assertion has consequences.

    If the system behind the report cannot demonstrate effective controls over data origin, verification procedures, governance responsibilities and evidence preservation — the board has approved something it cannot defend.

    And under mature assurance frameworks, that gap does not remain invisible for long.

    The Question Boards Are Not Asking

    Boards regularly discuss regulatory risk.

    They discuss reputational risk.

    They discuss financial exposure.

    They rarely ask the question that matters most in an assurance environment:

    If an assurance practitioner examined the system that produced this report — not the report itself — could we demonstrate that every material statement was generated through a controlled, verifiable and defensible process?

    That is not a reporting question.

    It is a governance question.

    And it belongs on the board agenda before the report is approved — not after scrutiny begins.

    Personal Exposure — Where Governance Becomes Individual

    Board liability in the context of ESG assurance is not abstract.

    When a sustainability statement becomes the subject of regulatory scrutiny, investor challenge or litigation, the inquiry does not stop at the level of the legal entity.

    It moves toward the individuals who approved the disclosure.

    The question shifts from:

    “Did the organisation get this wrong?”

    to:

    “Who approved a statement they could not substantiate?”

    Directors who have relied on the assumption that corporate liability shields personal accountability are encountering a different reality.

    As assurance standards mature and sustainability disclosures become increasingly material to investment decisions, regulatory compliance and legal exposure — the personal dimension of board approval becomes impossible to ignore.

    That responsibility cannot be delegated to the sustainability team.

    It cannot be delegated to software.

    It cannot be delegated to external consultants.

    It sits with the governance structure that approved the report.

    What Assurance-Ready Governance Actually Requires

    Assurance readiness is not achieved by possessing audit trails and documented workflows.

    Those are necessary. They are not sufficient.

    A board that is genuinely prepared for the assurance environment must be able to demonstrate that the organisation operates a control environment — not merely a reporting workflow.

    That means:

    Information is generated through defined processes with clear ownership.

    Data is subject to verification procedures designed to identify errors and unsupported assumptions.

    Evidence is preserved in a demonstrable state, protected from unauthorised alteration.

    Governance responsibilities, approvals and accountability mechanisms are formally established and documented.

    Without these elements, the board is approving a report it cannot defend.

    With them, approval becomes an informed governance act — not a procedural formality.

    The Governance Question for 2027

    The organisations that navigate this period successfully will not necessarily be those that produce the most comprehensive sustainability reports.

    They will be the organisations whose boards understood one thing early:

    Approving a report and being able to defend it are not the same act.

    The first requires a signature.

    The second requires a system.

    As assurance environments continue to mature, the question facing every board is no longer whether the report appears credible.

    It is whether the governance structure behind it can demonstrate why it should be.

    Other blogs

    Trošak korporativne tvrdnje koju nije moguće dokazati

    The Cost of an Unprovable Corporate Claim

    The contract was not renewed. The notification came in three lines. The company was convinced that...

    Možete izgubiti tender prije nego što iko kaže da je razlog ESG

    You can lose a tender before anyone even cites ESG as the reason

    The formal notification came in three lines. The company was sure that the price was…

  • ISSA 5000 Will Not Test Your ESG Report - It Will Test Your System

    ISSA 5000 Will Not Test Your ESG Report - It Will Test Your System

    For years, sustainability reporting has been evaluated primarily through the lens of disclosure.

    Organisations focused on whether required metrics were reported, whether narratives were coherent, and whether sustainability statements aligned with applicable reporting frameworks.

    That era is ending.

    As assurance expectations mature and the International Standard on Sustainability Assurance (ISSA 5000) becomes the reference point for assurance engagements, the focus is shifting away from what organisations disclose and toward how that information is generated, controlled, validated and preserved.

    The distinction may appear subtle.

    In practice, it changes everything.

    The Traditional ESG Mindset

    Most ESG programmes evolved around reporting obligations.

    Data was collected from multiple departments, consolidated in spreadsheets or reporting platforms, reviewed by sustainability teams and ultimately transformed into disclosures.

    The primary objective was completeness.

    Can we gather the information?

    Can we prepare the report?

    Can we meet the deadline?

    In this environment, systems were designed to facilitate reporting workflows.

    They were not necessarily designed to create defensible evidence.

    As long as disclosures appeared reasonable and assurance expectations remained limited, that distinction often went unnoticed.

    ISSA 5000 changes the equation.

    The Question Is No Longer About the Report

    Historically, organisations have been accustomed to questions such as: 


    Does the disclosure comply with the framework?


    Is the reported information consistent?


    Can management explain the methodology?


    These questions focus on outputs.

    ISSA 5000 introduces a different perspective.

    The assurance practitioner must obtain sufficient appropriate evidence regarding sustainability information.

    That requirement inevitably shifts attention toward the underlying system.

    The real question becomes:

    Can the organisation demonstrate effective control over the generation, verification and preservation of sustainability information?

    This is not a reporting question.

    It is a systems question.

    Assurance Begins Long Before the Report

    Many organisations still view assurance as a review conducted near the end of the reporting cycle.

    That assumption is increasingly problematic.

    Evidence quality is determined at the moment information is generated, not when it is reported.

    If source data lacks ownership, validation logic, preservation controls or documented procedures, no amount of late-stage review can fully compensate for those weaknesses.

    Assurance therefore begins upstream.

    It begins with:

    • Data origin
    • Control design
    • Validation procedures
    • Governance responsibilities
    • Evidence preservation

    The report merely reflects the effectiveness of those elements.

    Why Architecture Matters

    Most ESG systems were built to consolidate disclosures.

    Very few were built to preserve evidence.

    This distinction becomes critical under assurance.

    A reporting platform may successfully aggregate information from dozens of sources.

    However, assurance requires more than aggregation.

    It requires organisations to demonstrate:

    • How information entered the system
    • Who verified it
    • Which controls were applied
    • Whether changes were tracked
    • Whether evidence was preserved

    Whether management can demonstrate the state of information at the time of attestation

    Without structured evidence architecture, organisations may possess data but lack defensible proof.

    That gap often remains invisible until scrutiny occurs.

    From Workflow to Control Environment

    The operational implication of ISSA 5000 is straightforward.

    ESG systems can no longer be viewed as reporting tools alone.

    They must function as control environments.

    A mature sustainability information system should be capable of demonstrating:

    • Generation Controls: Information is produced through defined processes with clear ownership and documented methodologies.
    • Verification Controls: Data is subject to review procedures designed to identify errors, inconsistencies and unsupported assumptions.
    • Preservation Controls: Evidence is protected from unauthorised alteration and maintained in a demonstrable state.
    • Governance Controls: Responsibilities, approvals and accountability mechanisms are formally established and documented.

    These controls collectively form the foundation of assurance readiness.

    Audit Readiness Is Not Defensibility

    Many organisations believe they are prepared because they possess audit trails and documented workflows.

    Those capabilities are important.

    They are not sufficient.

    An audit trail records activity.

    Defensibility requires evidence preservation.

    Audit readiness assumes cooperation.

    Defensibility anticipates scrutiny.

    As sustainability disclosures become increasingly relevant to investors, regulators and litigation risk, organisations must consider not only whether information can be reviewed, but whether it can be defended.

    The difference is significant.

    One supports reporting.

    The other supports accountability.

    The Governance Dimension

    Perhaps the most overlooked implication of ISSA 5000 is governance.

    Boards approve sustainability reports.

    Management signs assertions.

    These actions transform sustainability information from an operational matter into a governance matter.

    The question facing leadership is therefore not:

    “Can we produce the report?”

    But:

    “Can we demonstrate that the information was generated, verified and preserved under effective controls?”

    That responsibility cannot be delegated to software.

    It cannot be delegated to consultants.

    Ultimately, it belongs to the organisation’s governance structure.

    The Future of Assurance

    The organisations that will navigate the next phase successfully are not necessarily those that disclose the most information.

    They will be the organisations that understand how evidence is created, controlled and preserved.

    ISSA 5000 is not simply raising expectations for sustainability reports.

    It is raising expectations for sustainability systems.

    And as assurance environments continue to mature, the decisive question will not be whether a report appears credible.

    It will be whether the system behind it can demonstrate why it is.

    Other blogs

    Trošak korporativne tvrdnje koju nije moguće dokazati

    The Cost of an Unprovable Corporate Claim

    The contract was not renewed. The notification came in three lines. The company was convinced that...

    Možete izgubiti tender prije nego što iko kaže da je razlog ESG

    You can lose a tender before anyone even cites ESG as the reason

    The formal notification came in three lines. The company was sure that the price was…

  • Audit Trail Is Not a Chain of Custody

    Audit Trail Is Not a Chain of Custody

    Why Most ESG Systems Are Structurally Unprepared for What Comes Next

    Most companies believe they are ESG-ready because their system has an audit trail.

    That belief is dangerously incomplete.

    An audit trail records activity.
    A chain of custody protects evidence.

    Those are not the same thing.

    And as ESG reporting moves toward higher levels of assurance under ISSA 5000, this distinction stops being technical - and becomes legal.

    The Illusion of Control

    An audit trail typically shows:

    • who entered data
    • who edited it
    • when changes were made

    This creates a perception of transparency.

    But transparency is not integrity.

    A forensic chain of custody answers different questions:

    • Was the original data preserved?
    • Could it be altered without detection?
    • Was access restricted and documented?
    • Can the organisation demonstrate the state of the data at the moment management signed the report?

    Most ESG platforms were built for workflow efficiency and disclosure consolidation.

    They were not built for evidentiary defensibility.

    That difference rarely matters - until scrutiny begins.

    What Changes Under ISSA 5000

    ISSA 5000 shifts the focus from narrative coherence to control demonstration.

    The question shifts from:

    “Does this disclosure look consistent?”

    to:

    “Can the organisation demonstrate effective control over the generation, verification and preservation of this information?”

    As sustainability reporting frameworks - including those introduced under the Corporate Sustainability Reporting Directive - move toward progressively stronger assurance expectations, systems will not be evaluated only on outputs.

    They will be evaluated on architecture.

    When ESG data flows across departments, suppliers, spreadsheets, external consultants and digital tools, integrity becomes fragmented.

    Audit logs remain.

    Control logic often does not.

    When Governance Meets Evidence

    Board members sign sustainability reports.

    Management asserts that controls are in place.

    But here is the structural question rarely asked at board level:

    Can we demonstrate that our ESG data is legally defensible - not merely traceable?

    Traceability shows movement.
    Defensibility shows preservation.

    If a sustainability claim is challenged - by regulators, investors or in litigation - the issue will not be whether the data was entered in good faith.

    The issue will be whether the organisation can prove that the information was:

    • generated under defined controls
    • verified through documented procedures
    • protected from silent alteration
    • preserved in a demonstrable state at the time of attestation

    That requires architecture.

    Not reporting dashboards.

    The Hidden Exposure

    As sustainability disclosures integrate into governance and director oversight duties under instruments such as Directive 2013/34/EU, ESG systems become part of corporate accountability infrastructure.

    This is no longer an IT question.
    It is not a communications question.

    It is a governance question.

    Because once management signs, assertions move from operational to personal.

    And personal exposure is rarely mitigated by an audit trail alone.

    The Structural Vulnerability

    We are entering a phase where:

    • ESG disclosures are assured, not merely published.
    • Sustainability claims are litigated, not merely criticised.
    • AI tools assist in generating data and narratives - while responsibility remains human.

    In this environment, weak evidence architecture is not a technical inconvenience.

    It is a structural vulnerability.

    Most organisations do not recognise the gap - because their systems have never been tested under adversarial conditions.

    Yet.

    The Audit Assumption

    External assurance assumes good faith and cooperation.

    The auditor reviews. The organisation responds. A qualified opinion is issued. The process ends.

    But the scenarios that create real organisational exposure do not operate on those terms.

    A regulatory investigation does not assume good faith.
    An investor claim does not assume cooperation.
    A greenwashing proceeding does not ask whether the report looked consistent when it was filed.

    It asks whether the organisation can prove - retroactively, under pressure, with an opposing party actively looking for failures - that every data point was generated under defined controls, protected from alteration, and preserved in a demonstrable state.

    Audit readiness and adversarial defensibility are not the same thing.

    Most organisations have designed for the first.

    Almost none have designed for the second.

    From Traceability to Defensibility

    Most ESG systems were designed to produce reports.

    Very few were designed to withstand scrutiny.

    PROOFA™ was developed as a legal-operational instrument integrating forensic standards, ESG disclosure logic under the Corporate Sustainability Reporting Directive, and Evidence Architecture™ methodology into one structured framework.

    It is not reporting software.

    It is a defensibility instrument.

    Its purpose is not to generate sustainability claims - but to structure how ESG data is preserved, verified and attested in a manner capable of withstanding assurance, investigation or dispute.

    Because in the assurance environment shaped by ISSA 5000, the decisive question will not be whether your report reads well.

    It will be whether your system holds.

    Does your organisation have an audit trail - or a true forensic chain of custody for ESG data?

    Other blogs

    Trošak korporativne tvrdnje koju nije moguće dokazati

    The Cost of an Unprovable Corporate Claim

    The contract was not renewed. The notification came in three lines. The company was convinced that...

    Možete izgubiti tender prije nego što iko kaže da je razlog ESG

    You can lose a tender before anyone even cites ESG as the reason

    The formal notification came in three lines. The company was sure that the price was…

  • CSRD 2026: The Omnibus I Shift and the Standard of Due Diligence

    CSRD 2026: The Omnibus I Shift and the Standard of Due Diligence

    Beyond compliance: why Evidence Architecture is now a legal necessity - and a personal risk for every director who signs.

    Most boards think Omnibus I bought them time. It didn’t. It transferred the risk - from the regulator to the director personally. Here is what a rigorous legal analysis of the March 2026 threshold changes actually reveals.

    1. The Extraterritorial Reality of the Supply Chain

    On March 19, 2026, the EU’s Omnibus I package raised CSRD reporting thresholds to companies with over 1,000 employees and turnover exceeding €450 million. The legislator narrowed the mandatory scope. The market did not follow.

    The legal obligation to report may be bounded by thresholds. The contractual obligation to provide data is not.

    If your German, Austrian, or Italian partner is CSRD-obligated -and they are - every gram of their sustainability burden travels downstream via contract. Whether you operate from Warsaw, Podgorica, Beograd, Zagreb, USA, Seoul, or São Paulo, the question has shifted permanently:

    The core legal question is no longer about the mandate to report. It is about the standard of proof.

    Boards that interpreted the threshold increase as a reprieve misread the signal entirely. The compliance perimeter contracted. The evidentiary expectation did not.

    2. Evidence Architecture: The Forensic Standard

    Sustainability data is completing a transition that began years ago: from corporate communication to legal evidence.

    Across jurisdictions, a consistent pattern emerges in legal and audit practice: auditors do not challenge the data. They challenge the system that produced it.

    This is what I define as Evidence Architecture - the systematic design of audit trails that can withstand not just regulatory review, but legal scrutiny. An Excel spreadsheet or a PDF without a verifiable chain of custody does not meet this standard. It is not a compliance gap. It is a liability.

    What the Forensic Standard Requires:

    • Digital Chain of Custody - A traceable, time-stamped record from the point of data origin to final disclosure. Not a summary. A trail.
    • Methodological Consistency - Q1 data collection must be defensibly identical to Q4. Inconsistency is the first crack every auditor exploits.
    • Independent Verifiability - Data that can withstand third-party assurance and, where necessary, legal scrutiny. If it cannot be verified externally, it cannot be defended internally.

    3. Governance and the Personalization of Liability
    This is the conversation most boards are not having - and should be.

    Under the CSRD framework, sustainability reporting is elevated to board-level accountability. This is not rhetorical. It is structural. Directors who sign off on ESG disclosures that lack a robust evidentiary basis may be exposing themselves to regulatory sanctions, civil liability, and reputational consequences that follow individuals - not just organizations.

    When a sustainability claim fails audit, the question shifts from what went wrong to who authorized it. In the CSRD context, that person has a name on a board resolution.

    The legal framework is clear: if ESG cannot be substantiated through a designed system of proof, it represents a point of significant professional and legal exposure for those who signed it.

    4. The Value-Chain Cap: A Protection Most Suppliers Don’t Know Exists
    One of the most significant - and most overlooked - provisions of the Omnibus I package is the Value-Chain Cap.

    This provision establishes that large EU entities cannot demand sustainability data from smaller suppliers that exceeds the voluntary SME standards arriving in July 2026. It is a genuine statutory protection. And the majority of non-EU suppliers operating in EU supply chains are entirely unaware of it.

    They are overdelivering on data they are not legally obligated to provide, while underdelivering on the specific, verified data their partners actually require - creating simultaneous risks of unnecessary operational disclosure and continued liability exposure from unverified claims.

    Legal Design allows us to map these boundaries clearly: to identify precisely what you must not provide, and to deliver what you do provide with forensic precision. This is not a documentation exercise. It is a rights exercise.

    5. Legal Design as Operational Infrastructure
    The role of the modern lawyer is not to produce more complexity. It is to make compliance possible, visible, and defensible.

    Legal Design Thinking translates regulatory obligation into operational systems - visual, process-driven architectures where every data point in a sustainability disclosure has a clear, validated, auditable origin. Not hundred-page manuals that no one reads. Systems that employees can actually use and that auditors cannot dismantle.

    In the CSRD era, the primary objective is not merely to report. It is to ensure that every disclosure is rooted in a designed system of truth.

    Integrity Over Narrative. Regulations are subject to political and economic cycles. The structural shift toward verifiable accountability is not. The window created by Omnibus I threshold adjustments should be read precisely as that - a window, not an exit.

    The organizations that will lead in this era are not those with the most elaborate sustainability narratives. They are the ones who can answer one question, instantly, from any point in their supply chain:

    “Where did this number come from - and who validated it?”

    The window is open. The question is whether you are building a system - or just a story.

    Integrity in reporting is not found in the narrative. It is found in the evidence that supports it.

    LDT ESG CHECKLIST 2026 CSRD 2026 BLUEPRINT: ESG Proof Architecture

    Other blogs

    Trošak korporativne tvrdnje koju nije moguće dokazati

    The Cost of an Unprovable Corporate Claim

    The contract was not renewed. The notification came in three lines. The company was convinced that...

    Možete izgubiti tender prije nego što iko kaže da je razlog ESG

    You can lose a tender before anyone even cites ESG as the reason

    The formal notification came in three lines. The company was sure that the price was…

  • CSRD: When ESG Becomes a Personal Risk. How Proof Architecture Shifts ESG from Sustainability to Accountability

    CSRD: When ESG Becomes a Personal Risk. How Proof Architecture Shifts ESG from Sustainability to Accountability

    March has traditionally been about closing financial books. But starting in 2026, March carries a different weight for European and multinational companies. The key question will no longer be: “Are we profitable?” It will be: “Who is personally accountable for the accuracy of this ESG report?”

    The Corporate Sustainability Reporting Directive (CSRD) does not simply expand sustainability reporting; it fundamentally shifts ESG from narrative disclosure to auditable accountability. For the C-suite, this is no longer a reporting task, it is a significant governance exposure.

    From Communication to Governance Exposure

    For years, ESG reporting has operated in a semi-structured space of fragmented systems and manual spreadsheets. CSRD changes the standard by making ESG data subject to mandatory assurance.

    The challenge for most global organizations is the structural gap between their financial ERP systems and their ESG data needs. While a CFO can trust a ledger, they often cannot verify the "digital pedigree" of carbon emissions, water usage, or supply chain labor metrics. Under CSRD, the question is no longer: “Do we have the data?” It is: “Can we prove its origin-and who signed off on it?”

    The End of Collective Ambiguity

    In many organizations, ESG responsibility has been described as "cross-functional" or "shared." While collaboration is essential, collective ambiguity does not satisfy regulatory scrutiny.

    As a legal professional, I see this as a massive liability trap. CSRD requires:

    • Clearly identified signatories who take legal responsibility for the report.
    • Documented internal controls equivalent to financial reporting standards (SOX-level discipline).
    • Defined validation protocols (the "four-eyes" principle).
    • A verifiable audit trail for every material metric.

    If these elements are missing, auditors and regulators will not ask why the system was imperfect. They will ask who was responsible for ensuring it existed. This is where ESG becomes personal.

    Double Materiality: The Liability Filter

    CSRD introduces Double Materiality, requiring companies to report not only how sustainability issues affect them but also how they impact the world.

    From a governance perspective, this acts as a liability filter. If a Board signs off on a report that ignores a significant impact in its value chain, it is no longer just a reporting error-it is a failure of oversight that creates direct governance risk. Double Materiality transforms ESG from a disclosure exercise into a governance exposure map.

    Proof Architecture: The Executive Shield

    Delegation does not equal protection. Without a defined methodology to track data from its origin to the final signature, the Board remains exposed.

    My methodology, Proof Architecture, is designed as a structural shield. It is not about more narrative; it is about documented integrity through five layers:

    • Layer 1 – Data Origin: Responsibility at the point of creation (ERP, meters, HR records).
    • Layer 2 – Verification: Independent validation and documented review processes.
    • Layer 3 – Traceability: Digital logs demonstrating when and by whom data was modified.
    • Layer 4 – Governance Sign-off: Defined authorization levels for reporting inclusion.
    • Layer 5 – Disclosure Responsibility: Executive signatories fully aware of the supporting control environment.

    The Supply Chain Multiplier

    CSRD compliance does not stop at the company boundary. Scope 3 emissions and human rights metrics introduce external dependency risk. A single key supplier with undocumented methodologies can compromise the integrity of your consolidated disclosures. Proof Architecture must extend into supplier contracts, communication standards, and verification protocols to protect the lead organization.

    When the System Fails, Liability Becomes Visible

    CSRD exposes three escalating risk layers:

    • Operational Risk: Inconsistent or undocumented data flows.
    • Reputational Risk: Adverse assurance opinions signaling governance weakness to markets.
    • Governance Risk: Board-level accountability for insufficient internal controls.

    CSRD does not penalize imperfection; it penalizes the absence of structured control.

    The Question Every Board Should Ask in 2026

    When the assurance provider asks: “Where did this number originate-and who validated it?”, will your organization have a documented answer? Or an explanation?

    In 2026, the auditor's signature is not a stamp of approval for your sustainability story; it is a verification of your governance integrity.

    If ESG cannot be proven, it cannot be defended. And if it cannot be defended, it becomes personal.

    LDT ESG CHECKLIST 2026 CSRD 2026 BLUEPRINT: ESG Proof Architecture

    Other blogs

    Trošak korporativne tvrdnje koju nije moguće dokazati

    The Cost of an Unprovable Corporate Claim

    The contract was not renewed. The notification came in three lines. The company was convinced that...

    Možete izgubiti tender prije nego što iko kaže da je razlog ESG

    You can lose a tender before anyone even cites ESG as the reason

    The formal notification came in three lines. The company was sure that the price was…

  • CSRD Is Not an ESG Regulation. It’s a Board-Level Risk Framework.

    CSRD Is Not an ESG Regulation. It’s a Board-Level Risk Framework.

    From sustainability reporting to executive accountability.

    As organizations move toward CSRD compliance in 2026, one misconception remains widespread:
    that CSRD is primarily about ESG reporting.

    It is not.

    CSRD represents a fundamental shift in corporate accountability, moving sustainability data from marketing narratives into the realm of governance, risk, and audit exposure.

    The real question is no longer:

    “Do we report ESG data?”

    But:

    “Can we defend it — and who is personally accountable?”

    Why CSRD changes the risk profile of organizations

    CSRD introduces something many organizations were not structurally prepared for:

    • traceable data
    • named responsibility
    • auditability across the value chain

    This shifts ESG from a reputational topic to a legal and fiduciary one.

    For Boards and executives, this means:

    • ESG data becomes part of enterprise risk management
    • sustainability failures can translate into governance failures
    • accountability is no longer abstract — it is documented

    The Sarbanes–Oxley moment for ESG

    Many governance professionals compare CSRD to the Sarbanes–Oxley Act.

    Not because the regulations are identical,
    but because the impact on executive responsibility is similar.

    Just as SOX forced organizations to design financial control systems,
    CSRD forces them to design proof systems for non-financial data.

    Narratives are no longer sufficient.
    Controls, traceability, and accountability are.

    Why ESG reports fail audits

    When ESG reports fail assurance reviews, the issue is rarely inaccurate data.

    The failure happens behind the scenes:

    • unclear data origins
    • missing audit trails
    • fragmented systems
    • undefined ownership of information

    In short: the system cannot prove itself.
    Auditors do not challenge intentions.
    They challenge structures.

    ESG as a proof system, not a document

    To withstand regulatory and audit scrutiny, ESG must be designed as a proof architecture, consisting of:

    1. Data Origin Layer – where data is created and who owns it
    2. Verification Layer – how data is validated
    3. Traceability Layer – how changes are recorded
    4. Governance Layer – who approves and signs off
    5. Disclosure Layer – how information is presented to regulators and investors

    Without these layers, ESG disclosures remain vulnerable.

    The hidden exposure in the value chain

    CSRD extends accountability beyond organizational boundaries.

    A single critical supplier without:

    • standardized ESG inputs;
    • verification protocols;
    • traceability can undermine the entire reporting system.

    This makes supply chain governance one of the largest unaddressed CSRD risks globally.

    Why Boards must understand architecture, not reporting.

    CSRD is not an operational ESG task.
    It is a governance design challenge.

    Boards that focus solely on reports risk overlooking critical weaknesses.

    • structural weaknesses
    • accountability gaps
    • legal exposure

    Understanding the architecture behind ESG data is now a matter of executive protection, not sustainability strategy.

    CSRD compliance is a design question.

    Organizations that succeed under CSRD do not ask:
    “What else should we report?”

    They ask:

    “What system must we design so this data can be defended?”

    CSRD compliance is not achieved at year-end.
    It is the result of systems designed to work every day.

    If ESG cannot be proven,
    it cannot be defended.

    Download the ESG Proof Architecture 2026

    LDT ESG CHECKLIST 2026 CSRD 2026 BLUEPRINT: ESG Proof Architecture

    Other blogs

    Trošak korporativne tvrdnje koju nije moguće dokazati

    The Cost of an Unprovable Corporate Claim

    The contract was not renewed. The notification came in three lines. The company was convinced that...

    Možete izgubiti tender prije nego što iko kaže da je razlog ESG

    You can lose a tender before anyone even cites ESG as the reason

    The formal notification came in three lines. The company was sure that the price was…

  • CSRD 2026: Why Your ESG Checklist is an Audit Trap

    CSRD 2026: Why Your ESG Checklist is an Audit Trap

    The Illusion of “Compliance”

    Most global organizations are currently transitioning to CSRD (Corporate Sustainability Reporting Directive) using control lists (checklists). While they are excellent for identifying weaknesses, they are dangerous as the foundation for building solutions.

    As we approach the 2026 reporting cycle, the focus must shift from “Reporting” to “Proof Architecture”. If your ESG data lacks a defensible system in the background, your report is not a strategy — it is a liability and a legal exposure.

    A checklist tells you where you are vulnerable. It does not tell you what you need to build.

    I. Shifting from Narrative to Architecture

    Historically, ESG has existed within marketing and communications. CSRD has moved it to the desk of the Chief Financial Officer (CFO) and General Counsel. Regulators are no longer interested in your “sustainability story”; they are interested in your data lineage.

    Global standards (ESRS) now require:

    • Auditability: Every figure must be verifiable by a third party.
    • Traceability: A clear digital path from source to table.
    • Accountability: Board-level signatures on non-financial data.

    These are not narrative requirements — they are structural requirements.

    II. Why Global Reports Fail Audit Review

    Even companies with long ESG reporting history are increasingly facing situations where auditors reject or conditionally approve their reports. Failure rarely lies in the targets themselves — the problem is in the infrastructure.

    Common failure points include:

    • “Orphaned” data: Numbers delivered via email with no timestamp or source origin.
    • Black-box methodologies: Calculations (such as Scope 3 emissions) with no documented logical trail.
    • Governance gaps: ESG data that exists in isolated silos, disconnected from the company’s legal and financial control framework.

    The problem is not the content — the problem is the architecture that produces it.

    III. The Blueprint: ESG as a System, Not a Document

    To pass assurance with limited or reasonable confidence, ESG must be structured as a five-layer defense system:

    • Data Origin: Direct data sources (ERP, IoT) replacing manual estimates.
    • Verification: Automated logical controls that detect anomalies before they reach the report.
    • Traceability: A digital “pedigree” for every data point.
    • Governance: Formal ownership of data and clearly assigned legal risk.
    • Disclosure: Transformation of raw inputs into machine-readable XBRL formats for global regulators.

    Without these five layers, your ESG report is simply a collection of claims that cannot be defended in court or at a board meeting.

    IV. The Fracture Point: Supply Chain

    For global entities, CSRD breaks in the supply chain. A single key supplier without a verifiable data system can compromise the report of an entire Group.

    Your architecture must extend beyond your internal systems. The Blueprint applies equally to standardized supplier inputs as it does to your internal ERP.

    V. Blueprinting vs Implementation

    A Blueprint is not your IT software, nor your legal advisor. It is the Master Plan that directs them.

    Without a Blueprint:

    • Costs escalate: You purchase software that “does not speak” to your auditors.
    • Complexity paralyzes: Departments operate in silos, creating redundant data.
    • Risk remains hidden: Gaps surface only when the auditor asks the first question.

    CSRD compliance is not a reporting exercise. It is a systems-design challenge. In the regulatory environment of 2026, the rule is simple: If you cannot prove it — you cannot defend it.

    As a practical extension of this article, I have prepared the ESG Proof Architecture.

    Download ESG PROOF ARCHITECTURE GLOBAL

    LDT ESG CHECKLIST 2026 CSRD 2026 BLUEPRINT: ESG Proof Architecture

    Other blogs

    Trošak korporativne tvrdnje koju nije moguće dokazati

    The Cost of an Unprovable Corporate Claim

    The contract was not renewed. The notification came in three lines. The company was convinced that...

    Možete izgubiti tender prije nego što iko kaže da je razlog ESG

    You can lose a tender before anyone even cites ESG as the reason

    The formal notification came in three lines. The company was sure that the price was…

ENG