How Exposed Is Your Organisation to ESG Regulatory Change?

19 jurisdictions already have ISSB-related requirements in force. Is your ESG framework keeping up? 

ESG regulation is no longer moving in one direction or according to one timetable. Organisations may now face sustainability disclosure requirements arising from European legislation, UK standards, securities regulation, climate reporting rules, stock exchange requirements and sector-specific obligations, often alongside voluntary commitments made to investors, lenders and customers. 

The regulatory picture is also changing quickly. In February 2026, the IFRS Foundation reported that nearly 40 jurisdictions had taken steps towards adopting or otherwise using ISSB Standards, with requirements in 19 jurisdictions already in effect. At the same time, the UK published final UK Sustainability Reporting Standards S1 and S2 in February 2026, while the European Commission adopted substantially revised European Sustainability Reporting Standards in July. 

Against this backdrop, an ESG regulatory gap analysis should do more than compare an existing sustainability report with a new disclosure checklist. Done properly, it should tell leadership which requirements apply, where the organisation is exposed, whether the required data exists, whether governance and controls are sufficiently robust and what needs to happen next. 

That makes the exercise both regulatory and strategic. 

A good gap analysis does not simply identify what is missing. It explains what matters, why it matters and how the organisation should respond. 

Read More: ESG Materiality & Risk Assessment 

Executive Takeaway 

A credible ESG regulatory gap analysis should help an organisation answer six questions: 

• Which requirements apply to us now, and which are likely to apply next? 

• What are we already doing that meets those requirements? 

• Where are the material gaps in governance, data, controls and disclosure? 

• Which gaps create the greatest regulatory, financial or reputational risk? 

• Who is accountable for closing them, and by when? 

• How will we know when remediation is complete? 

Importantly, the analysis should cover more than published disclosures. It should examine the operating system behind them, including board oversight, materiality, reporting boundaries, data ownership, internal controls, policies, targets, stakeholder processes and assurance readiness. 

As KPMG notes in its guidance on ESG reporting controls, a gap analysis should compare regulatory requirements and priority sustainability topics with the organisation’s existing reporting and use the findings to inform a remediation roadmap. 

Why ESG gap analysis has become harder 

A few years ago, many organisations could approach ESG reporting primarily as a voluntary exercise. They selected frameworks, reported available metrics and gradually expanded disclosure as stakeholder expectations developed. 

That environment has changed. 

Today, a multinational may need to consider several regulatory and reporting regimes at once. For example, an organisation could be assessing European Sustainability Reporting Standards for part of its group while also preparing for ISSB-aligned requirements in another jurisdiction and responding to investor requests based on different sustainability frameworks. 

The IFRS Foundation describes IFRS S1 and IFRS S2 as a global baseline intended to produce material, decision-useful sustainability-related financial information for investors. IFRS S1 covers sustainability-related risks and opportunities generally, while IFRS S2 focuses specifically on climate-related risks and opportunities. 

Meanwhile, European reporting takes a broader approach that includes impacts on people and the environment as well as sustainability-related risks and opportunities. The result is not necessarily contradiction, but it does create complexity. 

Therefore, the first mistake organisations should avoid is assuming that one ESG reporting framework automatically satisfies every regulatory requirement. 

Explore More: ESG Reporting and Disclosure 

Step 1: Establish your regulatory perimeter 

Before comparing disclosures, determine which rules actually apply. 

This sounds obvious, yet many ESG readiness projects begin with the standard rather than the organisation. Teams download a disclosure framework, create a large spreadsheet and begin marking requirements as complete or incomplete without first establishing why those requirements apply. 

A better approach starts with the organisational footprint. 

Assess: 

• Countries of incorporation and operation 

• Listing venues 

• Group and subsidiary structure 

• Revenue, assets, employee and other relevant thresholds 

• Regulated activities 

• Investor and lender requirements 

• Customer and supply-chain obligations 

• Existing voluntary ESG commitments 

• Current and expected reporting timetables 

For UK organisations, the position is particularly important to understand. The Government published final UK SRS S1 and UK SRS S2 in February 2026. They are currently available for voluntary use, while the Government and Financial Conduct Authority consider how requirements may apply to relevant UK entities. 

Likewise, companies with European exposure should reassess earlier CSRD readiness work because the European Commission adopted revised ESRS in July 2026, cutting mandatory datapoints by more than 60% and total datapoints by more than 70%. 

The objective of this first stage is simple: create a defensible regulatory obligations register before assessing readiness. 

Step 2: Create a requirements matrix 

Once the regulatory perimeter is clear, translate the relevant requirements into something the organisation can assess. 

A useful requirements matrix should not merely copy paragraphs from regulation. Instead, it should connect each obligation to the business processes needed to satisfy it. 

Example ESG Regulatory Requirements Matrix 

This moves the conversation away from whether a sentence appears in the sustainability report and towards whether the organisation has the underlying capability to support that disclosure. 

Read More: ESG Reporting and Disclosure 

Step 3: Assess the current state honestly 

The next stage is to understand what the organisation already has. 

A good gap analysis should not assume that nothing exists. Most organisations have pieces of the ESG operating model already embedded across finance, risk, HR, procurement, legal, operations, internal audit or investor relations. 

The challenge is often that those pieces have never been connected. 

PwC recommends assessing existing and forthcoming reporting obligations, the operational effect of compliance requirements, the organisation’s ESG reporting ambition and the quality of data-gathering processes and controls. 

Therefore, current-state assessment should include interviews and evidence reviews across relevant functions rather than being left solely to the sustainability team. 

Useful evidence may include: 

• Existing ESG and annual reports 

• Board and committee papers 

• Risk registers 

• Policies 

• Materiality assessments 

• Climate-risk assessments 

• GHG inventories 

• Workforce data 

• Supplier information 

• Stakeholder engagement records 

• ESG targets 

• Data methodologies 

• Internal controls 

• Audit or assurance findings 

The result should be an evidence-based view of what is fully established, partially established or missing. 

Step 4: Do not assess disclosure without assessing data 

One of the most serious weaknesses in ESG regulatory readiness is the assumption that disclosure can be fixed through better writing. 

It cannot. 

If the underlying information is unreliable, the disclosure remains unreliable regardless of how polished the report becomes. 

This is why Deloitte places gap analysis alongside assurance readiness, materiality and the assessment of reporting processes and controls. Its readiness work examines systems, roles, policies, procedures and the consistency of ESG data gathering and presentation. 

For every material ESG datapoint, organisations should be able to answer: 

• Where does the information originate? 

• Who owns it? 

• What reporting boundary applies? 

• How is it calculated? 

• Which assumptions are used? 

• Is any part estimated? 

• Who reviews it? 

• What control prevents or detects an error? 

• Can the figure be reproduced? 

• Is supporting evidence retained? 

If those questions cannot be answered, the organisation has identified more than a reporting gap. 

It has identified a control gap. 

Explore More: ESG Reporting and Disclosure 

Step 5: Test governance, not just ESG processes 

ESG regulation increasingly requires evidence of governance. 

However, organisations sometimes respond by inserting generic sentences into reports stating that the board oversees sustainability. 

That does not establish meaningful oversight. 

The gap analysis should instead examine what governance actually looks like. 

Governance questions worth testing 

• Which board or committee has formal responsibility for ESG? 

• How frequently does it receive relevant information? 

• Are material sustainability risks integrated into enterprise risk management? 

• Who is the accountable executive? 

• Are responsibilities below executive level clear? 

• Which decisions require board approval? 

• What happens when ESG targets are missed? 

• How are sustainability risks considered in major investment decisions? 

• Does the board receive evidence or mainly narrative updates? 

• Are minutes sufficient to demonstrate challenge and oversight? 

Governance is particularly important under ISSB-based reporting because IFRS S1 and S2 use governance, strategy, risk management and metrics and targets as the core disclosure architecture. 

Therefore, the gap analysis should assess both governance disclosure and the governance system producing it. 

Read More: ESG Strategy Development 

Step 6: Revisit materiality 

Materiality is where many ESG frameworks meet, but they do not always use the concept in exactly the same way. 

Consequently, organisations should not assume that an existing materiality assessment remains suitable simply because one was completed recently. 

The gap analysis should examine: 

• The definition of materiality used 

• Applicable regulatory requirements 

• Stakeholders considered 

• Time horizons 

• Financial effects 

• Environmental and social impacts 

• Value-chain coverage 

• Scoring methodology 

• Management judgement 

• Board oversight 

• Documentation of conclusions 

• Frequency of reassessment 

In the European context, double materiality considers both an organisation’s impacts and sustainability-related financial risks and opportunities. Meanwhile, ISSB Standards focus on sustainability-related risks and opportunities that could reasonably be expected to affect the entity’s prospects. 

The IFRS Foundation’s 2026 readiness guidance explicitly recognises that organisations familiar with ESRS or GRI may already possess useful processes and data capabilities, although they still need to ensure that financially material sustainability information is identified appropriately for ISSB reporting. 

Therefore, good gap analysis looks for interoperability while remaining alert to genuine differences. 

Explore More: ESG Materiality & Risk Assessment 

Step 7: Include the value chain 

A regulatory gap analysis that stops at the legal entity boundary may overlook significant ESG exposure. 

Depending on the framework and materiality conclusions, organisations may require information relating to suppliers, customers, financed activities or other parts of the value chain. 

This creates practical challenges because data quality falls as organisations move further from information they directly control. 

Accordingly, the assessment should establish: 

• Which value-chain relationships are material 

• What information is required 

• Whether the organisation already collects it 

• Contractual rights to request information 

• Data quality and estimation issues 

• Supplier engagement needs 

• Responsibility for reviewing the information 

• Whether technology or third-party data is required 

The European Commission’s revised 2026 sustainability reporting framework also introduced measures intended to limit disproportionate information demands on smaller businesses outside CSRD scope, reinforcing the need for organisations to understand what information they can reasonably request from their value chains. 

A strong analysis therefore balances regulatory requirements with proportionality. 

Step 8: Score gaps by risk, not convenience 

Once gaps have been identified, organisations often make another mistake: they prioritise the easiest items to close. 

That produces visible progress but not necessarily meaningful readiness. 

Instead, remediation should be risk based. 

A practical gap-rating model 

Risk scoring should consider regulatory deadlines, materiality, financial exposure, data reliability, reputational risk, assurance requirements and implementation effort. 

For example, rewriting a policy may be relatively simple, while building a reliable Scope 3 emissions process across a global supply chain may require considerably more time. The programme should reflect that difference. 

Step 9: Convert findings into an ESG regulatory roadmap 

A gap analysis without a remediation roadmap is simply a list of problems. 

The final output should show management what happens next. 

Each action should include: 

• The regulatory requirement 

• Identified gap 

• Risk rating 

• Required remediation 

• Accountable owner 

• Supporting functions 

• Target completion date 

• Dependencies 

• Required investment 

• Evidence of completion 

• Reporting or assurance deadline 

Deloitte’s sustainability readiness approach similarly considers governance, materiality, strategy, climate, social matters, data and controls, reporting and technology before translating readiness findings into focus areas and next steps. 

The roadmap should also distinguish between quick improvements and structural work. Updating a disclosure may take weeks. Building governance, systems and internal controls may take significantly longer. 

That is why gap analysis should happen early. 

Step 10: Design for assurance before assurance begins 

The best time to discover that ESG data cannot be substantiated is not during external assurance. 

Assurance readiness should therefore be built into gap analysis from the start. 

As KPMG argues, organisations need a systematic control environment that connects ESG objectives, strategy, risk management, materiality and reporting requirements. 

Similarly, Deloitte treats gap analysis and readiness assessments as preparation for assurance over sustainability metrics and disclosures. 

The analysis should therefore identify whether material information has: 

• Defined methodologies 

• Clear ownership 

• Documented processes 

• Review controls 

• Evidence retention 

• Version control 

• Appropriate approvals 

• Reconciliation where relevant 

• Clear treatment of estimates 

• Consistent reporting periods and boundaries 

Organisations that build these disciplines early usually find later reporting cycles considerably easier. 

What a good ESG regulatory gap analysis should produce 

A board or executive team should not receive a 200-line spreadsheet without interpretation. 

The final report should make the organisation’s position understandable. 

A useful deliverable should include 

1. Regulatory map 

Which requirements apply now, which may apply later and why. 

2. Readiness assessment 

Current maturity across governance, materiality, strategy, risk, data, controls and reporting. 

3. Gap register 

Specific weaknesses linked to applicable requirements. 

4. Risk prioritisation 

Critical, high, moderate and lower-priority issues. 

5. Remediation roadmap 

Actions, owners, deadlines and dependencies. 

6. Assurance readiness view 

Weaknesses that could prevent credible verification. 

7. Board summary 

The issues that require leadership attention rather than operational remediation alone. 

This combination turns technical analysis into decision-useful governance information. 

The Lumorus View 

The purpose of an ESG regulatory gap analysis is not to prove that an organisation has a sustainability programme. It is to establish whether governance, data and controls are strong enough to support the claims and disclosures the organisation is required to make. 

This distinction matters because ESG compliance can easily become a documentation exercise. Organisations compare existing reports against regulation, fill obvious gaps and assume the work is complete. 

However, disclosure is only the visible layer. 

Beneath it sit processes, systems, people, judgement and evidence. If those foundations are weak, reporting risk remains. 

An effective analysis therefore moves beyond the question what are we missing? and asks what capability do we need in order to meet this requirement reliably every year? 

That is the difference between temporary compliance and regulatory readiness. 

Common mistakes to avoid 

Even well-resourced organisations can undermine the exercise through poor design. 

Treating ESG regulation as one global standard 

Requirements overlap, but they are not identical. Map jurisdictions separately before identifying opportunities for common reporting. 

Starting with disclosure instead of scope 

Determine which requirements apply before building a large checklist. 

Leaving the exercise entirely to sustainability 

Finance, risk, legal, governance, HR, procurement, operations and internal audit may all hold relevant information. 

Ignoring controls 

Reliable disclosure requires more than available data. It requires confidence in how that data was produced. 

Confusing voluntary reporting with regulatory compliance 

A strong GRI or sustainability report may provide useful foundations without satisfying every legal requirement. 

Prioritising easy gaps 

Close the gaps that create the greatest exposure, not simply those that are quickest to fix. 

Treating the gap analysis as a one-off exercise 

The regulatory environment continues to evolve. The obligations register and readiness assessment should therefore be reviewed regularly. 

Five questions boards should ask 

Boards do not need to review every line of an ESG regulatory matrix. However, they should understand whether the organisation’s overall response is credible. 

Useful questions include: 

1. Which ESG reporting requirements currently apply to us across every material jurisdiction? 

2. Where are our highest-risk gaps in governance, data and internal controls? 

3. Which disclosures rely significantly on estimates or weak information? 

4. What must be remediated before the next reporting or assurance deadline? 

5. Who is accountable for delivering the roadmap and how will progress reach the board? 

These questions keep board attention on risk and accountability rather than technical detail. 

The Bottom Line 

ESG regulation will continue to evolve. The European Union is simplifying aspects of sustainability reporting, the UK has finalised UK SRS S1 and S2, and jurisdictions around the world are moving at different speeds towards ISSB-based requirements. 

Organisations cannot respond effectively by treating each change as another reporting project. 

They need a repeatable way to understand regulation, assess readiness, identify weaknesses and prioritise action. 

That is what a well-designed ESG regulatory gap analysis provides. 

It creates clarity about what applies, evidence about current capability and a roadmap for closing the gap between the organisation’s sustainability ambitions and its regulatory obligations. 

Most importantly, it helps leadership identify weaknesses before regulators, investors or assurance providers identify them first. 

How Lumorus can support your ESG regulatory readiness 

Lumorus works with boards, sustainability leaders, investors and executive teams to connect ESG regulation with governance, strategy, risk and credible reporting. 

Depending on the findings of an ESG regulatory gap analysis, organisations may require support across: 

• Regulatory exposure and material ESG risk: ESG Materiality & Risk Assessment 

• Strategy and remediation priorities: ESG Strategy Development 

• Reporting architecture, data and disclosure: ESG Reporting and Disclosure 

• Investor and capital-allocation implications: ESG Integration in Investment Decisions 

• Stakeholder input and materiality: Stakeholder Engagement 

• Evidence of social outcomes: Social Impact Measurement and Management 

About Lumorus 

Lumorus is a UK headquartered global governance, ESG, company secretary and advisory firm supporting organisations across Europe, Africa, Asia, the Caribbean, Canada, the Middle East and international markets. 

For more than 10 years, we have helped boards, investors and leadership teams strengthen governance, accountability, sustainability and organisational resilience. 

If ESG reporting requirements are expanding faster than your internal systems, a regulatory gap analysis can provide a practical starting point by identifying what applies, where the organisation is exposed and which improvements should come first. 

Is your ESG framework genuinely ready for the regulations ahead, or are you relying on reporting processes designed for yesterday’s requirements? 

Contact Lumorus to discuss an ESG Regulatory Gap Analysis and build a practical roadmap towards stronger governance, reliable data and credible disclosure. 

Email: [email protected] 

Lumorus: Better Business, Built on Purpose. 

Sources 

• IFRS Foundation – Jurisdictional Readiness Assessment Guide and Tool, including global progress towards adoption or other use of ISSB Standards. 

• IFRS Foundation – IFRS S1 and IFRS S2 requirements and the ISSB global sustainability disclosure baseline. 

• UK Department for Business and Trade – Final UK Sustainability Reporting Standards S1 and S2, published February 2026. 

• European Commission – Revised European Sustainability Reporting Standards adopted in July 2026. 

• PwC – Guidance on identifying reporting obligations, regulatory gaps, operational implications and ESG data controls. 

• KPMG – Guidance on regulatory pre-readiness assessments, materiality, ESG gap analysis and internal controls. 

• Deloitte – ESG gap analysis, materiality and sustainability assurance readiness. 

• Deloitte – Sustainability readiness assessment across governance, materiality, strategy, data, controls, reporting and technology.