Transcript | ESG and Data Management – with Alyse Mauro Mason and Mark Carson and Zachary Unger

Welcome to the latest episode of Board Perspectives, Protiviti’s podcast series focusing on all things ESG. In this episode, Protiviti Associate Director Alyse Mauro Mason interviews Protiviti Managing Directors Mark Carson and Zach Unger on a topic that is growing rapidly in importance in the ESG space — namely, effective data governance and management.

Welcome to the Board Perspectives podcast, brought to you by Protiviti, a global consulting firm, where we explore numerous challenges in areas of interest for boards of directors around the world. I am Alyse Mauro Mason, an associate director of ESG at Protiviti. I am joined today by my colleagues, Mark Carson and Zach Unger. Mark is a managing director in our Enterprise Data and Analytics practice and is the Americas lead for ESG data and tooling. Zach Unger is a managing director who leads our global team focused on ESG reporting.

Today, we’re going to discuss ESG — environmental, social and governance — focusing on the crucial role data management plays in driving impact-driven outcomes and effective ESG reporting and disclosures. Mark and Zach are joining us today in their personal capacity to share their experienced expertise and insights with us. Thank you both for being here with us today.

Thank you.

Thanks, Alyse.

I’m going to start with Zach. What are you seeing in the ESG world today with regard to ESG data and reporting programmes?

There’s an evolving view of ESG programmes, and even today there are a lot of different ways to look at programmes and reporting on an organisation’s ESG activities. On one hand, we have regulatory requirements for certain organisations to disclose various factors regarding their ESG results. And certainly, in that lens, there’s going to be a big range of requirements and expectations with e-organisations leading the way, but here in the U.S,. we’re starting to see those in regulatory drivers. The more perhaps nuanced view of reporting and programmes, in general, is that this is something that’s becoming ingrained in organisational management and the structure of protecting investors’ funds and the assets of an organisation.

If you want to look at that a different way, ESG programmes are effectively moving away from the group of nice-to-have activities or green or progressive activities and think of them more nowadays as part of good governance, good management inherent to the kinds of behaviors that we’d expect companies to take to protect the investments from the ill effects of global climate change. This is one aspect of ESG programmes that aligns pretty well with the upcoming U.S. guidelines from the SEC, in that there’s good alignment between that same driver of considering what might go wrong and thinking through risk factors that would be disclosed in a public following.

Two things you said: We’re shifting away from this nice-to-have model into what some would call a must-have. Whether you’re a public or a private company, there are different stakeholder demands. The SEC, obviously, will be focused on those public companies, but from a private-company perspective, you’re seeing other stakeholder demands when it comes to ESG reporting data and disclosures. Can you talk about other stakeholder demands: the employee-driven, business-driven — that business-transformation piece? It’s not just for public companies.

We all know that we have lived for a long time now in a difficult hiring environment where it’s a real challenge to hire and retain excellent qualified staff, and a lot of organisations are seeing what you might consider a somewhat softer impact from these ESG programmes of making organisations — again, whether they are for-profit company or a publicly listed or private company — a place where employees want to be, and want to be loyal, to help drive the kind of retention crucial to organisations, particularly as we continue to operate as a lean organisation in a lot of cases.

Mark, what are you seeing in the ESG world today, from an ESG data and reporting perspective?

To put it simply, it’s the Wild West in a lot of ways right now in the ways interest in ESG is manifesting itself across different stakeholders. To play off of what Zach said, whether it be an interest in making the world a better place — but beyond that, an interest in making sure that you are effectively managing risk as an organisation. The example I always use is, if you’re a paper company and investors are looking at investing in you, and a large percentage of the land leases where you grow trees for your paper in 25 years are going to be, in high likelihood, wildfire zones because of climate change, investors want to know that now, and they’re savvy enough to be asking those types of questions — insurance companies as well. It’s very real, and it’s not going away. Even if there is a slower roll of regulations in the U.S. versus other areas of the world, it’s not going away.

Above and beyond that, a quick, interesting statistic on it is that a third of the worldwide professionally managed assets — $35 trillion in investor assets — use ESG to make investment decisions openly, and we expect that number to increase. Why I say it’s the Wild West is because this is very early. It’s evolving, literally, monthly in the ability to react to the more nuanced questions that regulators, investors, insurance companies, activists, etc. are going to be asking. The ability to answer questions of various stakeholders, be they insurance companies, activists, investors, employees, etc., the flexibility to evolve your thinking and provide insights that are credible to answer those questions are going to be key. The name of the game you’re going to hear a lot about today is flexibility as we move forward in this.

To use your paper-company analogy, if there aren’t the trees in the forest to be able to produce the paper — the raw material that goes into that business — what does that mean for that business over time, and what are the risks associated with climate change for that business? That’s an excellent point.

I want to dive deeper with you: At a high level, how should board members be thinking about the role of data and tooling in an ESG programme?

I would think of it as very similar to other programmes where it’s mission-critical — that you can back up the comments and decisions you’re making with credible information to support it, credible facts. It’s not that much different when you think about it with that perspective. The biggest change here is that we’re now talking about types of information that have never really had to be investor-grade or regulator-grade in the past: How many pounds of waste have you produced? What are the carbon emissions at the lithium mine that creates the batteries that go into your cell phone?

There are some interesting data points now that you’re going to need to bring together to tell these stories effectively, and leaning on enabling technology is going to help not only in bringing all that information together, and in an efficient way, but also in being able to manage for quality and for credibility the answers you’re going to take off of that. There’s a great quote from a friend of mine that good decisions based on bad data can very likely be bad decisions that you don’t know about yet, and that’s going to apply here, just like it would in any other major regulatory regime.

The last thing I’ll add to that is around the ability to affect change within your organisation, thinking through this beyond disclosures to regulators, to say it simply, and moving more toward if I’m seeing excessive greenhouse gas emissions in my supply chain versus my peers, it’s probably a pretty good symptom of opportunity in my supply chain to wring out inefficiencies and to improve the overall resiliency of my supply chain. Thinking beyond these metrics to be used for environmental disclosure, but thinking about operational effectiveness and the ways that you can improve your business going forward, we’re seeing people actively engaging in both of those topics.

What you said, it relates to those upstream and downstream partners within your value chain. So, different elements of ESG data are going to be important to different stakeholders along that value chain, and something might be material to your organisation, but something very different could be material to one of those partners upstream and downstream. If anybody gets anything from today, data is the foundation to all of this, and I appreciate you and Zach bringing that to the forefront at the beginning of our discussion today.

Something else, Mark, that’s top of mind for board members and organisations is risk. From a risk perspective, are there specific risks that you think organisations and the board should consider when it comes to their ESG programmes?

One of the big ones that you may have heard of is greenwashing. Either that is cherry-picking metrics that make you look more favorable versus others, just like in any other early reporting regime, those are easy angles to take, but this is going to quickly mature into a position where those that take those angles, it will come back to bite them.

Thinking through how you want to balance the stories that you want to tell — there’s a story you’re going to need to tell to the regulators, there’s a story that you want to tell investors, there’s a story that you want to tell your own employees about your organisation, really homing in and making sure that those stories dovetail with each other — obviously, don’t conflict with each other — and can be built on as you mature over time. There’s a real risk in not drilling in and thinking at a nuanced-enough level around the stories that you want to tell. And then, obviously, the supply of data and insights and metrics that you choose to use to support those stories, understanding that those could come back to bite you.

The other risk I would bring up now is, it’s going to take a village to get this done. It’s an ecosystem mindset to working on ESG and having it get the outcomes that you’re looking for, whether that is the fact that you have to rely on third parties and trust them for the information they’re giving you, because you’re going to represent them as part of your story — that classic third-party risk management, that’s going to be important for your ultimate credibility. 

Finally, there’s definitely going to be some risk around the investments you make in tooling and enabling technologies to support this right now, because this is so early — the ESG reporting and the whole concept of a consolidated ESG story. There is no shortage of vendors being developed in people’s garages in California daily to support various aspects of ESG. Some will fail, some will consolidate, etc. The name of the game here is change, and embracing change and understanding that as ESG matures and the stories that need to be told become more nuanced, the enabling technology and tooling and data that is the blood supply of the whole thing is going to change over time as well.

Mark, you mentioned there are companies that are emerging in this technology space for ESG. Are there things that board members and organisations should be asking of those emerging technologies? When you see something come on the market that’s maybe a year or two into their development, what’s important for organisations to consider when looking at that type of platform?

It’s understanding what that platform does, and the intent of where that platform is going to go. When we think about a comprehensive ESG capability, we think about the ability for you to track information about yourself, about a myriad of topics — waste, recycling, greenhouse gas, diversity and inclusion, all of these angles. All of those are going to have applications that will help you track and support managing that information, but then you need to bring all that information together, and bringing it together warehouse-style is a lot of people’s approach to do this. That requires additional technology and tooling. 

Then, finally, what I like to call the last mile of pulling that data out and massaging it and then providing it to tell the stories that you need to tell, and that requires tooling as well. Across the board, when you think about this, it’s an ecosystem play. It’s not unlike any other major reporting regime that’s come through in the past. A lot of the same tooling capabilities can be leveraged, but there will be specific aspects to data collection and reporting that are specific to ESG that you’ve never thought about before, and those are the pieces that are going to need to be bolted on and are going to evolve quickly over time.

There is a tendency in the space to jump straight to “I need an ESG tool to do x, y or z in my ESG programme,” and it’s important for organisations to take the time to consider what the needs for your organisation are, and then consider, whether it’s homegrown or purchased, what in-house capabilities already exist that may fulfill some of those needs? One that jumps out to me is visualisation and dashboarding, and lots of organisations have capabilities like that in-house at this point. The question of how important that is to your reporting regime can help to drive whether the decision is, “Do I need a specialised tool for this, or is this something I can filter through our existing capabilities?”

For board members, we’re now seeing that ESG dashboarding, metrics, visualisations are being reported on that quarterly basis. Without the use of tooling and the right data, that was being done manually, and so we want to make sure that from the governance aspect, making sure that data is getting to the board in a timely manner and in an efficient manner, and data is at the crux of all that, and how we were managing it — and those visualisations don’t need to be manual. There are great software and tools out there that can help you do that, and it’s helpful at that board level.

Mark, when you’re talking about the ESG story that companies and organisations tell, that’s a narrative about the data specific to ESG and the impact that it has toward their goals and the commitments that they made — is that accurate?

Yes. It starts with the criticality of being able to tell compelling stories — there are different angles. And the data that feeds the metrics that support that story, it’s critical that that blood supply of that data is trusted, accurate, complete, well-defined — all of those things are going to be challenges coming out of the gate, particularly when you’re dealing with information that’s coming in in an unstructured format versus your traditional columns-and-rows, general ledger-style reporting that has been at the forefront of most reporting regimes today. This non-financial-related information is going to be coming in in all kind of different formats. There’s going to be a real challenge of being able to bring this together in a way in which you consistently trust it and in a way that you consistently control your third parties providing it to you in a trustworthy way — let alone, ultimately routing it to the story to support the stories you want to tell.

Consistent trust — that’s a through line between a lot of different business functions, and I love that you just said that, because it’s a great segue into a question for Zach: How do you see the auditability of data and pending regulations and how those elements could possibly change and, hopefully, enhance the current ESG data management landscape?

While Mark and I come at that kind of question from different perspectives — Mark from the data-and-tooling side and me from the opposite end of the spectrum, from the reporting side of that question — we both land at exactly the same point of, trustworthiness in your data is crucial. The interesting part of that question, though, is that when we compare ESG reporting to financial reporting — and we’re going to talk more about public registrants for this one — but organisations that already file public financial reports are used to the rigors of an audit of their financials and the understanding and expectation that both their disclosure and the underlying data will have to meet the requirements of a public company audit. That’s not exactly the expectation for many companies filing ESG or CSR reports right now.

As we head more toward a regulatorily driven report, it is going to have to have at least one major change to it — the auditability of that data is going to have to be improved. We do see a wide range of auditability, or lack thereof, in reports today, and certainly as various regulations, including in the U.S. — the upcoming SEC guidance as that comes into play for organisations — we will see a significant change in the level of effort organisations need to go into to get their data to an auditable standard, as well as the level of diligence and trust that organisations really push for within themselves.

One factor that organisations will need to consider that is vastly different from financial reporting is that the range of data sources used in ESG reporting is considerably broader than we think of for financial reporting. For financial reporting, we’re very comfortable with the concept that a lot of the data that would make its way into a financial report is from a general ledger and a few other systems within that organisation.

When it comes to ESG data, that story is turned on its head: We have the information coming from third parties, from lots of different sources, and some even originating from paper. The level of rigor that goes into getting that data to an auditable standard is very different from the level of data that many organisations may have been comfortable with when it was only being used for internal reporting or for informational purposes. That’s going to be a big step up for many organisations, particularly when the SEC guidance come into play soon.

That’s a great point, Zach, and there are certain industries, such as financial services and healthcare — some of these more highly regulated industries have long since developed risk management functions and audit functions specifically focusing on these topics around the trust in data, because they’ve had to. But now, as this moves into other industries that haven’t been as regulated, the muscle memory around developing regulator-grade trusted information is going to have to be a muscle that’s developed from scratch more than it has been in other industries, and that’s going to be a real challenge. The good news is, you can be fast followers on that topic. There are disciplines out there that are well in place that can support that, but that doesn’t mean it’s simple to implement.

It’s a great point, Mark and some consistent words that we’re hearing throughout this discussion — trusted, consistent data and repeatable — those are three things that, when you come down and you look at your ESG data, whether it’s financial data or nonfinancial data, these are important things to consider in the landscape.

And because SEC was talked about — they use a phrase that is really helpful to this discussion, and it’s a good check-in when you’re thinking about your organisation’s data and reporting and disclosures, and their phrase is “Say what you mean, and mean what you say.” And at the heart of this phrase is having evidence-backed, trusted data for your reporting and disclosure requirements, regardless of the regulatory body that is seeking and requiring them. I love that phrase, and it’s a nice way of grounding where you’re at in your ESG journey when it comes to data reporting and disclosures.

One more topic for both guests, because every organisation is at a different place in their ESG journey: Zach, what do you think organisation should be doing today, or planning to do very soon, with respect to data and reporting, as well as disclosures with ESG maturity for the organisation in mind?

Regardless of state and organisation, it’s apt today — one important factor that’s going to impact every organisation is materiality. Considering — for the first time for organisations that have not yet undertaken this effort — or reconsidering the materiality of various ESG factors as they impact your organisation is crucial. Materiality is one of the core factors of disclosure. We disclose the things that are material to the organisation. It ties into your mantra — the SEC’s mantra — nicely there.

Another factor to consider for organisations is that while you’re on your path to maturity in the ESG space, continuing to build your reliance on that trusted data and repeatable metrics that we’ve been talking about is only going to continue to help you, again, regardless of wherever you stand on the maturity path.

Ultimately, “Say what you mean, mean what you say” requires you to have an understanding of the audiences, the investors, the insurance companies, activists, your own employees — understanding the stakeholders and being able to tell the story that you want to tell in a meaningful way to support that. Without that story to begin with, establishing data and metrics becomes an academic exercise. It’s starting with focusing on that story, but once you have that story in place, one, embrace that that story is going to change over time, because it’s absolutely going to. But also, two, is, how can we go about most effectively and efficiently collecting that information and managing it for trustworthiness? And there are a lot of products out there. You likely have a lot of products already in-house that can help you do that.

From the materiality standpoint, most of the well-known frameworks support and encourage materiality at the beginning of your ESG journey — SASB, TCFD, GRI. We definitely encourage you to look at some of those frameworks, because they do help with your ESG journey.

Mark, Zach talked about what organisation should be doing. He talked about materiality, and I’m wondering — and you touched on this a little bit — what about software and tools and the overall governance of data? How do those elements play a part in ESG data management?

I can’t stress it enough that if you have been involved in establishing investor-grade or regulator-grade information in the past to tell other stories you need to tell, whether it’s regulatory disclosures, board reporting, investor reporting, a lot of the disciplines that you have in place around the methods for checks and balances to make sure that you trust the data, the capabilities you have around ingesting different types of data and storing it and manipulating it and preparing it for reporting, a lot of those capabilities, you likely already have in place. Spending the time to understand what capabilities you already have and then overlaying that with what are truly the unique capabilities that you’re going to need to support ESG.

Taking into consideration the unique aspects of ESG reporting and the disparate types of data and the disparate formats of data that you’re going to need and, frankly, a large amount of herding of cats that you’re going to need to collect all these data, from the myriad of different stakeholders you’re going to need to collect it from — taking those aspects of what makes ESG unique, overlaying them on top of the existing capabilities you have, will give you a good mindset and place to start on what additional enabling technologies you might need to support you in your overall ESG journey.

Like anything, you have to start somewhere— knowing where the data lives, who is the data owner? I’m going to add two words to our running list of trusted, consistent and repeatable: automate and integrate. We want to make sure that this data is efficient and effective from a reporting perspective and from the internal-stakeholder perspective, that each of these data owners has access to the different systems from the reporting and disclosure perspective.

I want to thank Mark and Zach for being with us today and sharing your insights. It was extremely valuable, and such a great discussion. Mark, one last question to close us out: What are three key takeaways you want our audience members to remember from our discussion today?

I’m in the business of data and technology, but I will start with this: If you don’t understand the stories that you need to tell and the outcomes you’re trying to get with those stories, the data and technology piece becomes more academic than it should be and, frankly, can become more expensive than it should be. Telling deliberate stories and doing the mental work necessary to understand the metrics that you want to use to support those stories is number one.

Number two is, focus on trusted auditable data — be thinking about the fact that the information you have will need to be defensible in the future at a level of detail that is much different than that data has had to be defensible in the past. For making marketing decisions or operational decisions, you’ve needed directionally correct information versus what will hold up under scrutiny at another level of detail from a regulator or an investor.

The last thing I’ll say — and it’s probably a word to add to the list, Alyse — is, the only thing constant in this is going to be change. As we said at the beginning, the questions being asked by the various stakeholders are going to become more and more nuanced. The information required to support answering those questions is going to become more and more nuanced, and broader. And the enabling tools and technologies to support all of this are going to dramatically evolve over time. There are vendors right now being developed in Silicon Valley in people’s garages to support this right now. There is going to be consolidation. There are going to be successes and failures in those enabling tools, and so being able to have that flexibility to respond to change over time architecturally is going to be important, not unlike any other reporting regime.

If I could make a plug for a fourth, this is a well-trodden path, conceptually. The difference is that this topic is significantly different than most topics people have had to report on this level of scrutiny in the past, and the data to support it is so much more broad than general-ledger and balance-sheet data that people are used to reporting against.

That was an excellent summary, and what I heard from you is, know the metrics and what they mean for your overall impact-driven outcomes, and have auditable, defensible data, and that the only constant is change, so be flexible. If we would add up all the words, it’s trust, consistent, repeatable, automate, integrate, flexibility and change. I want to thank you again both for being here. Thank you to our listeners. We hope you enjoyed our discussion today about ESG and the crucial role that data management plays in driving impact-driven outcomes and effective ESG reporting and disclosures.

We hope you enjoyed today’s lively discussion on ESG and data. For more information, please visit the ESG section on the Protiviti website at Protiviti.com, and, as always, I encourage you to please subscribe to our Board Perspectives podcast series and review us wherever you get your podcast content.