Corporate Sustainability Reporting Standards Compared

87% of the 14,682 publicly listed companies worldwide with revenue above $250 million filed a sustainability report in 2025, according to GRI-commissioned research. That number sounds decisive until you ask what it's actually measuring: reports under what rules, checked by whom, comparable to what? The honest answer is that disclosure volume has exploded while the substance underneath stayed a patchwork, and this piece walks through the major frameworks, GRI, ISSB, CSRD/ESRS, TCFD and its cousins, to sort out where each one actually applies.

What divides the major frameworks before you look at any individual one

Three questions separate these standards from each other, and once you have them straight, every section below stops feeling like alphabet soup.

The first is materiality: what counts as worth reporting in the first place. GRI uses impact materiality, an outside-in view asking how a company affects the world, its emissions, its labor practices, its water use. ISSB and its predecessor SASB flip that around with financial materiality, an inside-out view asking which sustainability risks move enterprise value. ESRS, under the EU's CSRD, demands both directions at once. A company has to show what it does to the world and what the world does to its balance sheet through climate risk, regulation, and supply chains. That's double materiality, and it's the single most consequential design choice in this whole landscape, because it decides what data a company has to go dig up before it can write a single sentence of the report.

Second: who's actually reading this thing. GRI writes for a crowd, employees, NGOs, communities, investors, regulators, anyone with a stake in the outcome. ISSB writes for one reader, the analyst on the buy side deciding whether to hold the stock. ESRS writes for regulators first, with a public audience layered on and real legal teeth behind it. TCFD, before it folded into ISSB, wrote specifically for investors and financial regulators, full stop.

Third, and this is the one that actually determines whether anyone goes to jail for getting it wrong: legal force. GRI is voluntary everywhere, no exceptions. ISSB is voluntary by design but has been adopted, whether by choice or by mandate, in 30 jurisdictions as of March 2025. CSRD is mandatory EU law, though its scope just got cut down considerably (more on that below). TCFD as a standalone framework no longer formally exists; it got folded into IFRS S2, though some national regulators still reference it in transitional rules. Assurance tracks the same spectrum: GRI and ISSB recommend it, ESRS requires limited assurance for companies in scope. Keep these three axes in mind. Everything past this point is a variation on them.

GRI Standards: the global baseline most companies already use

GRI has been around since 1997, which in sustainability-reporting years makes it roughly the Rolling Stones of this space: old enough that people kept predicting its decline, and still the one everyone shows up for anyway. More than 14,000 organizations across over 100 countries report using GRI Standards, and companies using GRI account for a majority of global market capitalization in 2025.

What actually sets GRI apart is reach into markets other frameworks barely touch. Companies headquartered across 107 jurisdictions use it, and it accounts for 71% of market cap representation from the Global South, a share no competing standard comes close to. The survey data lines up from every direction that's checked it: KPMG found roughly nine in ten reporting companies choose GRI, IFAC found 77% usage among 1,400 leading companies, and the WBCSD's Reporting Matters 2024 study found 83% of 181 large companies assessed report using it. Regionally, GRI use clears 50% everywhere researchers looked, 75% in the Americas, 68% in both Asia-Pacific and Europe, 62% across the Middle East and Africa.

Substantively, GRI covers the full waterfront: emissions, water, biodiversity, waste on the environmental side, labor conditions, human rights, community impact on the social side, governance structures rounding it out. The question GRI asks isn't "does this move our stock price," it's "does this matter to the world we operate in." That's impact materiality, put into practice rather than defined in the abstract.

And GRI keeps moving instead of coasting on incumbency: the GRI 101 Biodiversity Standard was updated in January 2024 and takes effect January 1, 2026, while GRI 102 (Climate Change) and GRI 103 (Energy) landed in June 2025, effective January 1, 2027.

Here's the catch, and it's the one that matters most for anyone deciding whether GRI alone is enough: voluntary means voluntary. No regulator enforces it, no penalty attaches to a sloppy report, and disclosure quality swings wildly between a company treating this as a genuine audit and one treating it as a glossy PR exercise with footnotes.

ISSB / IFRS S1 and S2: the investor-facing standard gaining regulatory force worldwide

ISSB is the new kid, formed in 2022, with its first standards, IFRS S1 and S2, published in June 2023. Everything about its design says built for finance people, not for everyone. IFRS S1 covers general sustainability disclosures material to enterprise value; IFRS S2 handles climate specifically, organized around the same four pillars, governance, strategy, risk management, metrics and targets, that TCFD built years earlier. That's not a coincidence or a nod of respect. ISSB effectively absorbed TCFD outright: S2 does the job TCFD used to do, and SASB's industry-specific metrics got folded into S1 in the same move.

Adoption has moved fast for a standard barely three years old. As of March 2025, 30 jurisdictions had adopted IFRS S1/S2, with 21 more planning to, and the adopting jurisdictions together represent more than half of global GDP. Walk the actual list and it stops being abstract fast: the UK's Sustainability Reporting Standards track IFRS S1/S2 closely, phasing in from fiscal years beginning 2025 for the largest listed companies. Australia mandated ISSB-aligned climate reporting starting January 2025 for its biggest companies. Japan's Sustainability Standards Board issued three ISSB-aligned standards on March 5, 2025. Hong Kong applied HKFRS S1/S2 to Main Board issuers starting fiscal year 2025. Brazil requires its ISSB-translated standards from January 1, 2026, Pakistan from July 1, 2025, and China published draft ISSB-aligned climate standards in the second quarter of 2025.

None of this sits still, either. ISSB is expanding SASB's sector standards, starting with extractives, minerals processing, and infrastructure, and exploring new work on biodiversity and human capital. In April 2025 it proposed dropping certain Scope 3 emissions requirements for financial institutions from IFRS S2, a small but telling admission that even a three-year-old standard is still being tuned against the reality of how hard it is to implement.

Worth being blunt about, since the two get conflated constantly: an ISSB report and a GRI report are not two flavors of the same document, and treating them as interchangeable is where a lot of reporting teams waste a year. One tells an investor what could hit the balance sheet. The other tells a community what the company is doing to the river next door. A company can and increasingly does file both, but neither one substitutes for the other.

CSRD and ESRS: the EU's mandatory regime and the Omnibus rollback that reshaped it

CSRD is EU law, full stop, and ESRS, its 12 detailed standards, spell out exactly what in-scope companies must disclose across environmental, social, and governance topics. It's the most prescriptive framework on this list by a wide margin: specific data points, mandatory double materiality assessment, required limited assurance. No other framework tells a company this precisely what number goes in what box.

Originally, that precision applied to roughly 50,000 companies across the EU, rolling out in four waves starting with fiscal year 2024 data. Then came the Omnibus Package, and the scope changed dramatically enough that "originally" is doing a lot of work in that sentence.

The European Commission proposed simplification on February 26, 2025. Trilogue negotiations wrapped December 9, 2025, Parliament approved the result a week later, and the final text entered into force March 18, 2026, giving member states 12 months to transpose it into national law. The upshot: companies in scope of CSRD dropped by roughly 90%, and CS3D scope fell by around 70%. The new threshold catches only large undertakings with more than 1,000 employees and net annual turnover above €450 million. Listed SMEs, originally very much in scope, are now fully exempt. That's not a trim, that's close to a reversal of the rule's original ambition.

S&P Global's sector analysis puts real numbers on the fallout: financial firms subject to CSRD fall by about 71%, energy sector coverage by 66%. An earlier round of quick-fix amendments in July 2025 had already cut mandatory ESRS data points in half and simplified the double materiality process.

Non-EU companies shouldn't relax just yet, though. Large non-EU firms with substantial EU turnover remain in scope under the fourth wave, originally slated for 2029; Omnibus narrowed that net but didn't cut it loose entirely. And Omnibus introduces its own wrinkle worth sitting with: member states can still apply stricter rules than the EU floor, which means what "CSRD compliance" requires in practice may vary meaningfully by country, even after a supposed simplification.

TCFD and sector-specific frameworks: where they fit now that ISSB has absorbed much of the space

TCFD launched in 2015 and built the four-pillar structure, governance, strategy, risk management, metrics and targets, that basically every climate-disclosure framework since has borrowed or copied outright. It completed its work and formally disbanded in 2023, handing the baton to ISSB's S2. Companies already reporting under TCFD are, for the most part, already halfway to ISSB S2 compliance, because the architecture transferred over wholesale rather than getting rebuilt from scratch. Some national regulators still reference TCFD alignment in interim rules while full ISSB adoption phases in, so the name hasn't vanished from regulatory text even though the task force itself has closed shop.

SASB built industry-specific standards covering financially material topics across more than 70 industries. It now lives under the IFRS Foundation alongside ISSB, folded into IFRS S1. For a company that wants ISSB-aligned reporting with real sector-specific granularity, SASB's metrics are where that granularity actually comes from.

CDP, formerly the Carbon Disclosure Project, isn't a standard at all. It's a questionnaire platform: companies fill out CDP's climate, water, and forests questionnaires, and CDP has aligned that questionnaire with both ISSB and CSRD, cutting down the duplicate work of answering three slightly different versions of the same question for three different audiences. It's still the default channel companies use to answer investor and customer requests for climate data.

Step back and the pattern here is consolidation, not proliferation. ISSB absorbed TCFD and SASB into its own body of standards, ESRS is actively building bridges toward ISSB, and GRI stands apart as the one framework that never tried to become an investor document in the first place. That refusal to chase the investor audience is exactly why it remains the standalone option for broad accountability.

How the frameworks interrelate and where they overlap

GRI and ISSB aren't rivals fighting over the same turf. They're covering different jobs entirely: GRI handles accountability to a broad public, ISSB handles risk disclosure to capital markets, and a company can run both processes side by side without contradiction, which is exactly what a growing number of large multinationals now do.

ESRS was built with interoperability as an actual design goal, not something bolted on after the fact. EFRAG and ISSB jointly mapped ESRS provisions against ISSB standards, so a company reporting under ESRS can structure disclosures to satisfy a meaningful chunk of ISSB's requirements at the same time, instead of running two reporting processes from a blank page. GRI and ESRS carry their own formal interoperability statement too, which means a company already reporting under GRI has a real head start on the impact side of an ESRS filing.

That said, the materiality gap isn't just a labeling difference. It creates actual holes in coverage depending on which lens is doing the looking. A GRI report may cover topics an ISSB report skips entirely, because they don't move enterprise value even though they matter enormously to a community or an ecosystem downstream of a factory. An ISSB report, in turn, may demand a level of financial risk quantification GRI never asks for. Only ESRS requires both directions at once, which is precisely why it's the most labor-intensive of the three to comply with; there's no shortcut around collecting twice the data.

TCFD's absorption into ISSB means a company doing IFRS S2 correctly is, by construction, already meeting what TCFD used to require. There's no separate TCFD track left to maintain once ISSB reporting is in place. CDP's questionnaire is now built to capture data usable across GRI, ISSB, and ESRS at once, which matters in a very practical way: a company facing all three doesn't need three separate data-collection exercises, just one well-mapped one. The cheap path, for any organization staring down multiple frameworks, is mapping existing disclosures against each standard's specific requirements before building anything new. Starting from a blank page for each framework separately is the expensive way to do this, and it's the mistake that eats the most budget for the least benefit.

Which framework applies to a given organization, and how to work out the scope

Scope starts with geography and legal entity type, not preference. Nobody gets to pick their favorite framework the way they'd pick a font. A large EU-incorporated company with more than 1,000 employees and net turnover above €450 million falls under mandatory CSRD/ESRS reporting at the post-Omnibus threshold, full stop, no opting out. A UK-listed company with a fiscal year beginning in 2025 or later, classified as a large public interest entity, is looking at mandatory UK Sustainability Reporting Standards, which track IFRS S1/S2 closely enough that the compliance work overlaps substantially with ISSB reporting done anywhere else.

Beyond those two clear-cut cases, the calculus turns from rule-following into judgment. A mid-sized company outside the EU with no securities listed on a mandating exchange faces no legal requirement to report under any of these frameworks, which is exactly the gap that explains why only 22% of all companies globally disclose anything at all. Choosing GRI in that position is a bet on stakeholder trust and peer comparability. Choosing ISSB-style disclosure instead is a bet that investors or lenders will ask for it eventually, whether or not the law requires it yet.

So which bet actually pays off? Given how fast adoption is moving, 30 jurisdictions and counting as of March 2025, betting against ever needing some version of investor-grade sustainability disclosure looks like a wager with worse odds every year that passes.