ESG Controller
Accounting & Finance
SmartSuite for the ESG Controller
The ESG Controller applies financial-control discipline to sustainability data: controls over data collection and calculation, reconciliation to source systems, assurance readiness and the internal control over sustainability reporting that CSRD and ISSB-aligned regimes expect.
Reports to:
What you own
The ESG Controller applies financial-control discipline to sustainability data: controls over data collection and calculation, reconciliation to source systems, assurance readiness and the internal control over sustainability reporting.
- Design and operate controls over ESG data collection and calculation
- Reconcile ESG metrics to source systems and financial data
- Own the internal control over sustainability reporting
- Prepare ESG data for limited and reasonable assurance
- Document methodologies, estimates and judgments
- Coordinate with finance on integrated and connected reporting
At a glance
The GRC processes this role owns, touches and depends on.
Owns
accountable for the process
Touches
contributes or approves
Depends on
consumes its output
How the GRC processes connect
Three lines of defence set the frame; the chain shows where each process hands off to the next. Colours follow the ESG Controller: navy is owned, blue is touched, grey is depended on.
- First lineThe business and its control ownersRun the processes, own the controls, fix the issues
- Second lineRisk, compliance and the domain programmesSet the frameworks, assess, monitor and advise
- Third lineInternal auditIndependent assurance to the board and audit committee
Reporting lines
Who this role reports to, who reports to them, and the peers they work with most.
Reports to
Controller
See the roleDirect reports
Works closely with
ESG Reporting Manager
See the roleESG Program Director
See the roleInternal Controls Manager
See the roleExternal Auditor
See the roleHow SmartSuite supports the ESG Controller
The ESG Controller puts financial-control discipline behind sustainability data and answers to the Controller and the Chief Financial Officer for numbers that reconcile and controls that operate. SmartSuite holds ESG metrics with their sources and controls, tested in the same cycle as financial controls, so assurance readiness is a state you can show.
Operate the controls over ESG data
Each ESG metric in ESG & Sustainability Management carries its source and validation record, and you add the figure it reconciles to in finance or an operational system and the reconciliation status, so an unreconciled number is visible before it reaches a disclosure.
ESG Management suiteCalculation methods, estimates and the judgments behind them are recorded against the metric with version history, so when a method changes the prior basis is still visible and the change is explained.
ESG Management suiteESG reporting controls sit in SOX Compliance with a named owner, a frequency and evidence requirements, so the control environment over sustainability data looks the way COSO expects the financial one to.
SOX Management suiteWork with finance, internal controls and the auditors
ESG controls are scheduled into the same recurring test cycles as business controls, so the Internal Controls Manager's testers cover them with the same procedures, templates and scoring.
SOX Management suiteA failed ESG control becomes a deficiency with its remediation, owner and retest decision recorded, so the Controller sees sustainability deficiencies on the same list as financial ones.
SOX Management suiteThe External Auditor reviews ESG control testing and evidence through controlled access, so ISAE 3000 or ISSA 5000 fieldwork draws on the system of record rather than on packs you assemble.
SOX Management suiteReport readiness to the Controller and the CFO
Dashboards show, for each disclosure cycle, which metrics are reconciled, which controls are tested and which deficiencies are open, so readiness reported to the Chief Financial Officer is measured.
ESG Management suiteSustainability figures and their controls are visible to the finance team alongside the close, so the connected information ISSB IFRS S1 expects is produced from one set of records rather than two reconciled afterwards.
ESG Management suiteThe AI Assistant in a SmartDoc field drafts deficiency narratives and auditor responses from the testing record, so the write-up for the audit committee or the assurance provider starts from the evidence.
SOX Management suiteESG. Holds ESG metrics with source links, calculation records and reconciliation status so every number has a control behind it.
Compliance management. Manages ESG reporting controls in the same control library as financial controls, with testing and evidence.
Internal audit. Prepares assurance-ready evidence packs for internal and external auditors.
Reporting. Reports control status and data readiness for each disclosure cycle.
Products this role uses most
Industry reference
COSO's Achieving Effective Internal Control over Sustainability Reporting (2023) applies the 2013 framework to ESG data, which is the controller's core reference. CSRD requires limited assurance of ESRS disclosures, ISSB IFRS S1 requires connected financial and sustainability information, and California's SB 253 requires assurance of emissions data, so ISAE 3000 and ISSA 5000 define what evidence auditors will need.
Financial institutions carry additional Pillar 3 ESG and SFDR data obligations; listed companies in all sectors face the prospect of ESG controls being evaluated alongside SOX-style internal control; public bodies and healthcare systems apply the same discipline where they report against GRI.
Related roles
Controller
See the roleExplore Further
Guides and definitions from the GRC Knowledge Center and the What-is glossary, chosen for this role.
Frequently asked questions
The ESG Controller applies financial-control discipline to sustainability data: designing and operating controls over ESG data collection and calculation, reconciling ESG metrics to source systems and financial data, owning the internal control over sustainability reporting, preparing data for limited and reasonable assurance, documenting methodologies, estimates and judgments and coordinating with finance on connected reporting. COSO's 2023 guidance on internal control over sustainability reporting is the core reference, and CSRD, ISSB IFRS S1 and California SB 253 make assurance a requirement.
ESG & Sustainability Management holds each ESG metric with its sources and validation record, and the reconciliation you record against it to source systems or financial data, so every disclosed number shows where it came from and whether it has been reconciled. The ESG Controller can see which metrics are reconciled to source systems or financial data and which are still estimates awaiting support. That is the structure an ISAE 3000 or ISSA 5000 assurance engagement will test, and it is maintained as the data is collected rather than reconstructed afterwards.
SOX Compliance manages ESG reporting controls in the same control library as the financial controls, with testing and evidence, so the ESG Controller does not run a parallel control program with its own standards. Control Framework & Regulatory Libraries holds the framework mappings, Compliance Assessments & Testing runs the tests and the Internal Controls Manager sees ESG controls in the same program as the SOX controls. For a listed company facing SOX-style evaluation of ESG controls, this is the structure examiners will expect.
SmartSuite assembles the evidence for internal and external auditors from the metric records, their sources, reconciliations and control tests, with audit-ready reports generated from the same records, so the ESG Controller responds to the External Auditor's requests from the system rather than assembling binders. Each requested figure can be traced to its evidence, and the auditor's follow-up questions are answered from the same records. The ESG Reporting Manager uses the same records when a disclosure line item is challenged, so reporting and assurance draw on one source.
SmartSuite reports control status and data readiness for each disclosure cycle, so the ESG Controller can tell the Controller and the Chief Financial Officer which metrics are reconciled and controlled, which are outstanding and whether the cycle is ready for assurance. Because ISSB IFRS S1 expects sustainability information to connect with the financial statements, the readiness view is shared with finance rather than kept in the sustainability team. The ESG Program Director sees the same status for program planning.
Start from the existing SOX control library and add the ESG reporting controls to it, then load the metrics in the current disclosure with their sources and calculation methods. The first cycle run in SmartSuite establishes reconciliation status for each metric and gives the ESG Controller the list of estimates and judgments to document. Testing follows the SOX calendar where frequencies align, and the Internal Controls Manager and External Auditor work in the records they already know, which shortens the first assurance engagement.