The advantage Wave 2 companies have

Wave 2 companies preparing for CSRD reporting in 2027 have something their Wave 1 counterparts didn’t: a preparation year.

That extra time isn’t just a deadline extension — it’s an opportunity to test assumptions, strengthen processes, and resolve problems before mandatory reporting begins.

Wave 1 showed that the complexity of CSRD doesn’t come only from the number of disclosures required. The bigger challenge is building the organisational capability behind those disclosures. Many companies started by focusing heavily on data collection — identifying data points, finding owners, setting up reporting processes. But as they moved towards actually writing their sustainability statements and preparing for assurance, deeper questions surfaced: Were policies sufficiently developed? Could every material disclosure be backed by evidence? Were responsibilities clearly assigned? Did the narrative reflect how the company was really managing its impacts, risks, and opportunities?

This is what Position Green calls cold start risk: entering the first reporting cycle without having tested the systems, processes, and governance a robust ESRS report depends on. The fix isn’t more effort closer to the deadline. It’s an earlier preparation.

CSRD readiness is a business issue, not only a sustainability issue

One of the biggest mindset shifts for Wave 2 companies is recognising that CSRD isn’t primarily a reporting challenge. At its core, it requires companies to demonstrate how they understand and manage sustainability-related impacts, risks, and opportunities across the business and value chain — which makes it relevant well beyond the sustainability function.

For CFOs and executives, the questions are familiar ones: Are our processes reliable? Do we have clear ownership? Can we demonstrate how decisions are made? Are risks identified and managed effectively? Can we provide evidence for what we disclose?

In that sense, CSRD readiness has a lot in common with financial reporting readiness — it requires governance, controls, documentation, and accountability across the organisation. Companies that treat CSRD as a standalone reporting project risk building a compliance process disconnected from how the business actually runs. Companies that integrate it into existing governance and risk processes are better positioned to get real value out of the exercise.

1. Use the Double Materiality Assessment as your strategic foundation

The Double Materiality Assessment (DMA) is often treated as just the first box to tick. Its importance goes far beyond that.

A well-structured DMA defines the sustainability issues that matter most to the organisation — identifying material impacts, risks, and opportunities that become the foundation for policies, actions, targets, metrics, and ultimately the report itself. As Lisen Follin, Senior Manager, Strategy & Implementation Practice Lead at Position Green, put it during the webinar, the DMA provides the “red thread” running through the entire sustainability statement: impacts and risks flow into governance, into actions, into targets, into metrics. Try to write the narrative before that foundation is in place, and you end up working backwards from the report to figure out what you should actually be managing.

For Wave 2 companies, three things matter most:

Refresh your DMA. Many companies completed their initial assessment two or three years ago. Since then, the business may have changed materially — through acquisitions, strategy shifts, or value chain changes — and the DMA needs to reflect the organisation as it exists today, not as it existed when the work was first done.

Use the new flexibility intelligently. The simplified ESRS allows more flexibility in how materiality is assessed. Not every topic needs the same depth of work. Where there’s strong sector consensus and good available evidence — climate and energy topics, for example — a top-down approach at topic level can be justified. Where materiality is more context-dependent — biodiversity, human rights, value-chain issues — a deeper bottom-up assessment is still needed. The goal isn’t to do less work; it’s to direct effort where it creates the most understanding and value. Importantly, this flexibility doesn’t lower the bar: conclusions still need to meet the standard of fair and faithful representation.

Establish clear, defensible thresholds. Ida Ljungkvist, Group Sustainability Director at Scandi Standard, described one of their biggest DMA challenges was simply knowing when to stop — it’s genuinely difficult for a sustainability professional to declare something immaterial. Their solution was a visual prioritization tool with explicit thresholds, which made decisions far easier to communicate internally and to defend during assurance. Document the rationale behind every threshold and every borderline call; auditors will ask why a topic fell in or out of scope, and “we felt it was right” isn’t an answer that holds up.

2. Turn your gap assessment into a real implementation roadmap

A gap assessment is an important milestone, but identifying gaps is only the beginning. The harder, and more valuable, work is deciding which gaps matter most, which need immediate action, and how to allocate resources across them.

A strong roadmap weighs:

– Strategic importance: which gaps most affect how the business is positioned

– Regulatory and stakeholder relevance: what matters most to those reading the report

– Internal capability versus complexity: where you’ll need outside help or longer lead times

– Assurance sensitivity: which areas auditors are likely to scrutinise most closely

– Phasing provisions and reliefs: these exist for a reason, use them where genuinely needed

Not every gap needs solving at the same pace, and the most effective companies prioritise the areas where closing a gap improves both compliance readiness and actual business performance.

One area deserving particular attention is policy development. Wave 1 experience showed that policies routinely take longer than expected, Ljungkvist explained that creating or updating a policy can require six to nine months once stakeholder input, governance review, board approval, publication, and communication are all factored in. Policies can’t be treated as a final reporting task tacked on at the end. They need to be developed early enough to actually become embedded in how the organisation operates – and Ljungkvist’s advice was to engage auditors on DMA methodology before committing significant effort to closing gaps, to avoid expensive rework later.

3. Build sustainability data governance like a business-critical process

Data was one of the biggest challenges Wave 1 companies faced — but the real challenge was rarely just finding the numbers. It was establishing reliable ownership, controls, documentation, and evidence behind those numbers.

Unlike financial data, sustainability data is collected from across the organization — operations, procurement, HR, facilities, supply chain — often monthly, and often from non-standardised sources. Scandi Standard, for example, has over 30 people contributing data points every month, which demands real training, clear instructions, and robust controls.

Four things make the biggest difference:

Clear ownership. Every material data point needs a named responsible owner who understands what’s required and how the information will be supported.

Evidence collected as you go. Evidence should be gathered as part of the regular reporting cycle, not reconstructed under pressure at assurance time. Start collecting supporting evidence – invoices, screenshots, portal records – from the very first data point, not the hundredth.

Controls comparable to financial reporting. Scandi Standard built an internal control framework aligned with their existing financial controls, which significantly smoothed conversations with auditors.

The right technology. Manual spreadsheets can work initially, but they tend to become unmanageable as reporting requirements expand. A structured data management platform isn’t mandatory, but it consistently improves ownership, traceability, workflow, and audit readiness. The goal isn’t technology for its own sake — it’s confidence in what’s being reported.

4. Run a mock report before your first mandatory submission

One of the strongest, most concrete recommendations from the webinar: run a mock report in 2026.

A mock report lets you test the entire reporting process before the stakes are real. It surfaces missing data, unclear ownership, weak evidence trails, narrative gaps, methodology questions, and assurance challenges – all while there’s still time to fix them.

Scandi Standard’s experience is a useful model. Their 2024 sustainability report was assured under GRI but structured around ESRS, which let them resolve key questions with their auditors early – where to place the carbon inventory, how to handle references to the corporate governance report, what could sit in an appendix. By the time they entered their 2025 reporting cycle, many of those structural debates were already settled.

A few practical notes if you take this approach: be explicit in the document that it isn’t an ESRS-compliant report – auditors will require clear caveats on anything that resembles a compliant statement but isn’t assured as one. And don’t underestimate the narrative dimension: Wave 1 companies have had four years to evolve their sustainability narratives from compliance-driven to strategy-led. Wave 2 won’t have that runway, so a mock report is the best opportunity to avoid publishing something that reads like a legal document on day one.

For executives, a mock report also produces something genuinely valuable: a concrete investment case. Instead of presenting a vague list of potential gaps, sustainability teams can show precisely what needs to improve, why, and what it will take — a far more persuasive conversation with a CFO than abstractions.

5. Engage auditors early to reduce assurance risk

One of the clearest lessons from Wave 1, repeated by both speakers throughout the session: auditor engagement needs to start early, not once the reporting cycle is already underway.

Early engagement helps companies:

– Align on DMA methodology and scope before it’s finalised

– Discuss borderline materiality decisions and threshold logic

– Agree in advance how to handle incomplete data — for example, if December figures won’t be ready by sign-off, decide together whether to estimate or use a rolling 12-month approach

– Identify which disclosures will receive the deepest scrutiny — for Scandi Standard, that was food safety, which let them bring in specialists and strengthen evidence specifically for that topic

– Avoid costly rework by surfacing disagreements before, not during sign-off

The goal isn’t to outsource responsibility to auditors — it’s to create alignment before significant resources are committed. The companies that struggled most during Wave 1 assurance were often not the ones with incorrect information; they were the ones that couldn’t demonstrate how their conclusions had been reached. Traceability matters as much as accuracy.

6. Keep compliance connected to performance

The final lesson from Wave 1 may be the most important: CSRD reporting shouldn’t become an exercise in compliance alone.

The purpose of sustainability reporting is to provide transparency on how a company manages its material impacts, risks, and opportunities. For the topics where sustainability is closely tied to business performance, use CSRD as a genuine opportunity to strengthen strategy and decision-making. For topics where the requirement is primarily about meeting a disclosure threshold, meet it efficiently and move on — don’t let compliance work crowd out the work that actually drives outcomes.

As Ida Ljungkvist summarised during the webinar: reporting is not the point. Performance is.

Final takeaway

Wave 2 companies don’t need to repeat the challenges Wave 1 faced. The opportunity in 2026 is to move from reactive compliance preparation to proactive business readiness.

Companies that invest early in governance, data quality, materiality assessment, and assurance preparation won’t just reduce reporting risk — they’ll build a stronger foundation for managing sustainability performance in the years ahead.

Find the full webinar here.

Where to start your 2027 reporting preparation

If you are reading this in the weeks following your last reporting submission, the most useful thing you can do today is block time for a structured retrospective before the memory of the season fades. Bring in your data owners, your internal stakeholders, and anyone who has visibility of the process end to end.

From that conversation, three things should emerge: a prioritized list of structural improvements, a clear picture of what your key stakeholders actually need from your 2027 data, and an honest assessment of where your current setup does and does not serve those needs.

That is your plan of action. The window to execute it well is open now, so do not miss the chance to capitalize on it.

Position Green helps organizations build and maintain sustainability reporting processes that are audit-ready, stakeholder-aligned, and designed to generate insight beyond compliance. To explore how we support your 2027 reporting readiness, get in touch with our team.