ESG Reporting: The Definitive Guide for IT and Business Leaders

ESG reporting is the structured disclosure of how a company performs on environmental, social and governance (ESG) matters, and how those matters affect the company’s own financial position and its impact on the world around it. What began as a voluntary communications exercise has become a data-intensive, audit-ready reporting discipline that touches finance, operations, procurement, HR — and, critically, the IT function that has to supply, integrate and govern the underlying data.

This guide covers the full picture: the origin and definition of ESG reporting, the three pillars, the frameworks and regulations that shape it, the process for producing a report, the data and systems architecture that makes it possible, the misconceptions that derail programmes, and where the discipline is heading. It is written for the people who have to make it work — CTOs, IT managers, sustainability leads and digital transformation teams in the CEE region and across Europe.

Definition: ESG reporting is the process of collecting, calculating, verifying and publishing quantitative and qualitative information about a company’s environmental impact, its social and workforce performance, and the quality of its governance — in a format that investors, regulators, customers and other stakeholders can compare, trust and act on.

What Is ESG Reporting?

At its core, ESG reporting is disclosure. A company measures defined indicators, explains its policies and targets, and publishes the results in a report that sits alongside — and increasingly inside — the annual financial report. The purpose is not to celebrate sustainability initiatives but to make performance measurable and comparable.

The Three Letters and What They Cover

The acronym splits corporate performance into three non-financial dimensions:

• Environmental (E) — greenhouse gas emissions, energy consumption, water use, waste, biodiversity, pollution and climate-related risk.
• Social (S) — workforce health and safety, diversity and inclusion, pay equity, human rights, labour standards in the supply chain and community impact.
• Governance (G) — board composition and oversight, executive remuneration, business ethics, anti-corruption, whistleblowing, data protection and cybersecurity.

Each dimension is expressed through metrics. That is the key distinction between ESG reporting and a corporate values statement: a metric has a definition, a unit, a boundary, a calculation method and an owner. A statement of intent has none of those things.

How Is ESG Reporting Different From Sustainability Reporting and CSR?

The three terms are frequently used interchangeably, which creates confusion in board rooms and procurement processes. They are related but not identical.

The practical implication is straightforward: ESG reporting is the output of sustainability and CSR activity, translated into the language of capital markets and regulation. Sustainability and CSR describe the motivation and the programmes; ESG reporting describes the measurable result and makes it auditable.

Where Did ESG Reporting Come From and How Has It Evolved?

ESG reporting did not appear fully formed. It is the product of roughly six decades of gradual convergence between ethical investment, environmental accounting and financial disclosure.

From Ethical Investment to a Formal Framework

The lineage begins with socially responsible investment in the 1960s and 1970s, when investors began excluding certain industries on ethical grounds. The 1980s added environmental pressure: industrial disasters and the emergence of environmental liability made pollution a balance-sheet issue rather than only a moral one. The 1990s brought standardisation attempts — the Global Reporting Initiative was founded in 1997, and the triple bottom line concept of “people, planet, profit” entered management vocabulary.

The decisive step came in 2004, when the UN Global Compact published the report Who Cares Wins, which proposed integrating environmental, social and governance factors into asset management and research. That report is widely credited with popularising the term “ESG”. From that point, the focus shifted from screening out bad actors to systematically evaluating how ESG factors influence financial performance.

From Voluntary Disclosure to Legal Obligation

The 2010s were the decade of voluntary frameworks and investor demand. The Sustainability Accounting Standards Board (SASB) issued industry-specific standards; the Task Force on Climate-related Financial Disclosures (TCFD) published its four-pillar recommendations in 2017; the EU adopted the Non-Financial Reporting Directive (NFRD) in 2014, requiring large public-interest entities to disclose non-financial information.

The 2020s are the decade of consolidation and enforcement. The EU’s Corporate Sustainability Reporting Directive (CSRD), which entered into force in January 2023, replaced the NFRD and made sustainability reporting a legally mandated, assured disclosure regime governed by European Sustainability Reporting Standards (ESRS). In parallel, the International Sustainability Standards Board (ISSB) published IFRS S1 and S2 in 2023 to create a global baseline, and jurisdictions from the UK to Japan, Brazil and Australia began adopting or aligning with them. By April 2026, 28 jurisdictions had adopted ISSB standards on a voluntary or mandatory basis, with a further 12 planning to do so.

The trend line is unambiguous: ESG reporting has moved from the margins of corporate communications to the core of corporate reporting, and it now depends on the same discipline as financial reporting — defined data, documented controls, and independent verification.

Why Does ESG Reporting Matter to the Business?

Treating ESG reporting purely as a compliance cost is a strategic error. The disclosure itself is a requirement; the capability that produces it — reliable, integrated, traceable ESG data — is an asset.

Capital Access, Cost of Capital and Investor Pressure

Institutional investors, asset managers and banks increasingly use ESG data to price risk and allocate capital. Where ESG data is missing or unreliable, the market applies a discount rather than assuming good performance. Beyond equity, sustainability-linked loans tie interest margins to ESG metrics, which means the quality of the underlying data has a direct financial consequence. Failure to take ESG risk seriously can trigger shareholder action at annual general meetings and divestment by asset managers.

Operational Efficiency and Risk Management

Measurement exposes waste. Energy, water, materials and logistics are cost lines as well as emissions sources; the discipline of measuring them frequently identifies efficiency gains that had been invisible. On the risk side, climate and social factors increasingly translate into physical risk, transition risk (policy, technology, market shifts), litigation risk and supply chain risk. Reporting forces these into a managed framework instead of leaving them as unquantified exposure.

Commercial Access, Talent and Reputation

Large customers subject to CSRD can only report their own Scope 3 emissions and value chain impacts if their suppliers provide data. In practice, this means sustainability questionnaires flow down the supply chain whether or not the supplier is legally in scope — a small company’s ESG data can be a precondition for winning or retaining a contract. The same dynamic applies to talent: employees and candidates increasingly evaluate employers on verifiable ESG performance rather than statements.

What Are the Three Pillars of ESG Reporting?

Each pillar follows its own logic, has its own metrics and its own internal owner. Understanding the differences prevents the common mistake of treating ESG as one undifferentiated project.

Environmental: Measuring Impact on Natural Systems

The environmental pillar is the most mature and the most technically demanding, because it requires physical measurement rather than administrative reporting. Its centre of gravity is greenhouse gas accounting under the GHG Protocol, which divides emissions into three scopes:

• Scope 1 — direct emissions from sources the company owns or controls: combustion in boilers, furnaces and vehicles, and fugitive emissions.
• Scope 2 — indirect emissions from purchased electricity, steam, heat and cooling.
• Scope 3 — all other indirect emissions in the value chain, across 15 categories covering purchased goods and services, upstream and downstream transport, business travel, commuting, use of sold products and end-of-life treatment.

Scope 3 is where most of the difficulty lives. For many organisations it accounts for the large majority of total emissions, yet the data sits with suppliers, logistics providers and customers rather than inside the company’s own systems. Beyond climate, the pillar covers water withdrawal and discharge, waste generation and circularity, biodiversity, pollutant releases and the physical and transition risks associated with climate change.

Social: Measuring Impact on People

The social pillar covers the company’s own workforce, workers in the value chain, affected communities and consumers. Typical topics include occupational health and safety, gender pay gaps, diversity at board and management level, working time, freedom of association, child and forced labour in supply chains, product safety, customer privacy and data protection.

Much of the raw data already exists inside HR, payroll and procurement systems. The challenge is rarely availability; it is comparability, scope boundaries and the willingness to publish uncomfortable numbers. The social pillar also carries the highest risk of inconsistency between narrative claims and underlying data, which is precisely where regulatory attention now focuses.

Governance: Measuring How the Company Is Directed

Governance is the control environment that makes the other two pillars credible. It covers board composition, independence and ESG competence; executive remuneration and its link to sustainability targets; business ethics and anti-corruption; whistleblowing mechanisms; internal control and risk management; and increasingly data governance, cybersecurity and responsible use of artificial intelligence.

Governance is also where the IT function is most directly implicated. If ESG data flows through enterprise systems, those systems need access controls, change management, audit trails and segregation of duties that satisfy the same standards as financial reporting.

How Does the ESG Reporting Process Work in Practice?

A credible ESG report is produced by a repeatable process, not by an annual scramble. The process has five stages, and the quality of the output depends almost entirely on how well the first two are executed.

Stage 1: Scoping and Materiality Assessment

Materiality determines what the report covers. The concept of materiality guides organisations to focus on ESG issues that are relevant to them and have a measurable impact on the business. A materiality assessment starts by identifying the universe of potentially relevant topics, mapping them against the company’s sector, business model and geography, and then assessing which of them are significant.

Under the EU regime, the relevant test is double materiality, which requires two distinct assessments:

• Financial materiality (outside-in) — how sustainability matters create or affect financial risks and opportunities for the company.
• Impact materiality (inside-out) — how the company’s activities affect people and the environment, regardless of whether that impact is financially material to the company.

A topic is reportable if it is material from either perspective. This is a stricter test than pure financial materiality, and it is the reason ESG reporting requires input from functions that financial reporting never touches.

Stage 2: Data Collection Across the Value Chain

This is where most programmes struggle. ESG data originates in dispersed systems — energy meters, fleet telematics, ERP purchase ledgers, HR systems, supplier questionnaires, facility management platforms — and much of it sits outside the reporting entity’s own boundary. Practical requirements include a defined data dictionary, a clear boundary (which legal entities, which sites, which supply chain tiers), named data owners for every metric, and a documented calculation methodology with emission factors that are versioned and traceable.

Stage 3: Calculation, Consolidation and Reporting

Raw activity data is converted into reported metrics using defined methodologies — emission factors for greenhouse gases, established formulas for intensity ratios, consolidation rules for group structures. The consolidated result is then structured according to the chosen reporting framework, whether that is ESRS, GRI, ISSB or a combination.

Stage 4: Review, Assurance and Publication

Before publication, the data passes through internal controls and, increasingly, external assurance. Sustainability information under CSRD is subject to third-party assurance; the Omnibus simplification package deferred the deadline for adopting the European limited assurance standard to 1 July 2027, but the assurance requirement itself remains. Publication usually takes the form of a sustainability statement integrated into the management report, supported by machine-readable tagging so that regulators and analysts can process the data at scale.

Stage 5: Feedback Into Strategy and Operations

The value of the cycle appears here. Reported metrics feed target setting, capital allocation, procurement criteria and product decisions. An ESG reporting programme that produces a report and nothing else is a compliance exercise; one that changes operational decisions is a performance management system.

Which ESG Reporting Frameworks and Standards Should You Use?

Hundreds of ESG frameworks exist, but only around a dozen are considered major. They divide into voluntary frameworks, which allow reporters to select relevant disclosures, and regulatory frameworks, which mandate full responses and are enforced by a public authority.

Voluntary Frameworks and the Global Baseline

• GRI Standards — the most widely used global framework for impact-focused sustainability reporting. Modular and topic-based, with three universal standards that apply to every reporter plus topic-specific standards covering economic, environmental and social issues.
• ISSB (IFRS S1 and S2) — the investor-focused global baseline, absorbing the substance of the former TCFD recommendations and SASB industry standards. Designed for interoperability with jurisdictional regimes, which is why adoption has spread quickly.
• CDP — a disclosure system rather than a framework in the strict sense, with scored questionnaires on climate change, water and forests. Scores are used by investors and increasingly by procurement teams.
• GHG Protocol — the foundational accounting standard for greenhouse gas inventories, providing the Scope 1, 2 and 3 architecture that most other frameworks reference.

Regulatory Frameworks

• CSRD and ESRS — the EU regime, applying to companies above defined size thresholds and requiring reporting in accordance with 12 ESRS standards: two general, five environmental, four social and one governance.
• VSME — the voluntary standard for small and medium-sized enterprises, designed to provide a proportionate, simplified disclosure set and to serve as the accepted format when large customers request value chain data.
• Jurisdictional regimes — national frameworks such as Streamlined Energy and Carbon Reporting (SECR) in the UK, the National Greenhouse and Energy Reporting scheme in Australia, and various Asian and Latin American regimes aligned with ISSB standards.

In practice, most large organisations use more than one framework. The efficient approach is to build a single data model that maps internal metrics to the datapoints required by each framework, so that a new requirement becomes a mapping exercise rather than a new data collection project.

Who Is Required to Report on ESG, and Under Which Rules?

Mandatory ESG reporting is now a reality in the EU and in a growing number of other jurisdictions, but the scope has narrowed considerably since the original CSRD text — and understanding the current thresholds is essential for planning.

CSRD and ESRS: The European Baseline

EU law requires companies above a certain size to disclose information on the risks and opportunities arising from social and environmental issues, and on the impact of their activities on people and the environment. The CSRD entered into force on 5 January 2023 and replaced the earlier Non-Financial Reporting Directive. Companies subject to the CSRD report according to ESRS, developed in draft form by EFRAG, an independent body bringing together multiple stakeholder groups.

The rollout was originally structured in waves. Wave 1 — large EU listed companies and other public-interest entities already covered by the NFRD — published their first CSRD reports in 2025 covering financial year 2024. Wave 2 covered large non-listed companies, and Wave 3 covered listed SMEs.

The Omnibus Simplification and the New Thresholds

The Omnibus package, agreed politically in December 2025 and signed off by the Council in February 2026, materially changed the picture. It did not repeal the CSRD; it narrowed who must report, adjusted when, and reduced the reporting burden.

Member states are required to transpose the amended directive into national law, with a transposition deadline of March 2027. For Slovak and Czech companies, the CSRD has been implemented through amendments to national accounting legislation — in Slovakia, through Act No. 431/2002 Coll. on Accounting — so local filing and publication rules follow the national transposition rather than the directive directly.

What About Companies Below the Threshold?

Falling outside mandatory scope does not mean falling outside the data flow. Companies that are out of scope are still routinely asked for sustainability data by banks, insurers, large customers and value chain partners who need it to meet their own obligations. The practical consequence is that for most mid-market companies, ESG reporting becomes a commercial requirement rather than a legal one — driven by contracts and credit rather than by regulators. The VSME standard exists precisely for this situation, providing a proportionate disclosure set that large customers are expected to accept.

The Global Picture

Outside the EU, the landscape is converging around the ISSB baseline but at different speeds and with different degrees of legal force. Adoption of IFRS S1 and S2 has proceeded across Asia, Latin America, Africa and Oceania, with 28 jurisdictions having adopted the standards on a voluntary or mandatory basis as of April 2026 and a further 12 planning to do so. In the United States, the picture moved in the opposite direction: the SEC adopted climate disclosure rules in 2024, stayed them pending litigation, and in 2026 proposed to rescind them. That does not eliminate climate disclosure obligations for US companies operating in Europe or in value chains serving European customers — it simply shifts the source of the obligation from domestic securities law to EU regulation and commercial contracts.

How Do You Build the Data and IT Foundation for ESG Reporting?

ESG reporting is fundamentally a data problem dressed in regulatory language. The organisations that report smoothly are not the ones with the largest sustainability teams; they are the ones whose data architecture was designed for it.

Why ESG Data Is Inherently Difficult

Four characteristics make ESG data harder to manage than financial data:

1. It originates outside the finance function. Energy, HR, procurement, logistics and facilities all own data that finance must eventually report.
2. It crosses the entity boundary. Scope 3 emissions and supply chain social data come from third parties with their own systems, definitions and incentives.
3. It is estimated as often as it is measured. Spend-based estimates, industry averages and proxy factors are legitimate but must be documented and versioned so that restatements are explainable.
4. It changes definition frequently. Standards are revised, thresholds move, factors are updated. A static spreadsheet model cannot absorb that rate of change.

These characteristics explain why data quality dominates the list of reported obstacles: in Deloitte’s research on the topic, more than half of executives cited data quality as their top ESG data challenge.

A Reference Architecture for ESG Data

A workable ESG data architecture separates concerns into layers, so that a change in reporting standards affects only the presentation layer, and a change in source systems affects only the ingestion layer.

• Source layer — meters and sensors, ERP, HR and payroll systems, fleet and travel data, procurement records, facility management platforms, supplier portals.
• Ingestion and integration layer — automated extraction from source systems, APIs and file-based interfaces for third-party data, validation rules applied at the point of entry.
• Calculation layer — a central emissions factor engine holding recognised factor sets, calculation logic per metric, unit conversion, and boundary and consolidation rules.
• Data and governance layer — a master data model for ESG metrics, documented lineage from reported figure back to source transaction, version control, and role-based access.
• Reporting and disclosure layer — framework mappings (ESRS, GRI, ISSB), report generation, and machine-readable tagging for digital submission.
• Assurance and audit layer — evidence repository, control documentation, change logs and audit trails that allow an external assurer to test the numbers without reconstructing them by hand.

Where this architecture exists, the annual reporting cycle becomes a controlled process. Where it does not, the cycle depends on a small number of people and a set of spreadsheets whose lineage nobody can reconstruct under scrutiny — which is exactly the situation that assurance is designed to detect.

Build Versus Buy: Selecting ESG Software

Dedicated ESG platforms exist and are maturing, particularly for carbon accounting and framework mapping. The realistic selection criteria are rarely about features and almost always about fit with the existing landscape: whether the platform integrates with the ERP and HR systems already in place, whether emission factors and methodologies can be configured and versioned, whether the audit trail is strong enough for assurance, whether it supports the frameworks actually in scope, and whether data can be exported without vendor lock-in.

The most common architectural mistake is to buy a reporting tool before defining the data model. A reporting layer on top of undefined data produces attractive reports built on unverifiable numbers — which is a worse outcome than a plain report built on solid ones.

Testing, Controls and Assurance Readiness

Because sustainability information is now assured, ESG data pipelines need the same treatment as any other system of record. That means defined controls with owners, reconciliation between ESG metrics and financial data where they overlap (for example energy spend versus energy consumption), exception handling and correction procedures, evidence retention for the full assurance period, and — for the reporting platform itself — functional testing, data migration testing and regression testing whenever standards or factor sets change. Organisations that treat the ESG platform as a critical business system, and test it accordingly, avoid the most expensive failure mode in this discipline: discovering during assurance that the numbers cannot be evidenced.

If your organisation is preparing for mandatory or customer-driven ESG disclosure and needs to design the data architecture, controls and reporting processes behind it, the Greyson consulting team can help you assess your current landscape and build a practical roadmap.

What Do Companies Most Often Get Wrong About ESG Reporting?

The failure patterns in ESG reporting are consistent and largely avoidable. Five recur most frequently.

Misconception 1: It Is a Communications Project

Assigning ESG reporting to marketing or corporate communications guarantees a narrative that cannot survive assurance. ESG reporting is a data and controls discipline with a communications output, not the reverse. The correct owner is a joint structure: sustainability for content and methodology, finance for consolidation and controls, IT for data infrastructure.

Misconception 2: The Omnibus Changes Mean the Pressure Is Off

The Omnibus package reduced scope and administrative burden. It did not remove the CSRD, it did not remove double materiality, it did not remove assurance, and it did not remove commercial demand for value chain data. Companies that cancelled their programmes on the basis of the revised thresholds often find themselves responding to customer and bank questionnaires with no data infrastructure at all — a harder position than reporting on a voluntary basis would have been.

Misconception 3: Estimated Data Is Unacceptable

Estimates are normal and permitted, provided they are documented, methodologically consistent and disclosed as estimates. The problem is not estimation; it is unlabelled estimation, or estimates whose methodology changes silently between reporting periods. A disclosed, stable estimate is far more defensible than a precise-looking figure with no traceable source.

Misconception 4: Scope 3 Can Be Deferred Indefinitely

Scope 3 is the largest part of most organisations’ carbon footprint and the most exposed to value chain data requests. Deferring it does not reduce the obligation; it simply delays the discovery that suppliers cannot supply the data on demand. Starting with high-impact categories and a phased supplier engagement plan is more effective than waiting for a complete inventory.

Misconception 5: Assurance Is an Annual Event

Assurance readiness is a continuous state, not a December activity. If evidence is not captured when the activity happens — meter readings, invoices, supplier confirmations, calculation runs — it cannot be reconstructed reliably months later. Organisations that build evidence capture into the operational process spend far less on assurance than those that treat it as a year-end retrospective.

What Does the Future of ESG Reporting Look Like?

Four shifts are already visible and will define the discipline over the next several years.

Convergence Around a Common Baseline

The proliferation of frameworks is giving way to consolidation. The ISSB standards have become the reference point for investor-focused disclosure, the EU regime has been simplified to reduce burden while preserving double materiality and assurance, and interoperability work between standard setters is reducing the mapping effort for multinational reporters. The direction is toward one core data set serving multiple frameworks, rather than parallel reporting tracks.

Digitisation and Machine-Readable Reporting

Sustainability information is moving into the same digital reporting infrastructure as financial information, with structured tagging and digital submission. Once regulators and analysts can process disclosures at scale, comparability becomes enforceable rather than aspirational — and the tolerance for inconsistently defined metrics falls sharply.

ESG Data as an Operational Input, Not a Reporting Output

The most significant change is cultural. As ESG data becomes integrated into ERP and planning systems, it stops being an annual reporting artefact and becomes an operational input: procurement decisions weighted by supplier emissions, capital allocation informed by transition risk, product design constrained by circularity targets. This is where the real return on an ESG data programme is realised.

Enforcement Against Greenwashing

Regulatory attention is shifting from disclosure to the truthfulness of claims. The EU’s green claims framework bans certain environmental claims outright and imposes substantiation requirements on others, and national consumer protection rules are being strengthened in parallel. Combined with assurance requirements, this raises the cost of overstatement considerably — and increases the value of a data foundation that can support every claim made.

For IT and data leaders, the conclusion is consistent across all four shifts: ESG reporting will not become less data-intensive. It will become more integrated, more automated and more auditable, and the organisations that build that capability early will spend less on compliance and gain more from it.

Frequently Asked Questions About ESG Reporting

What is ESG reporting in simple terms?

ESG reporting is the publication of structured information about a company’s environmental impact, its treatment of people, and how it is governed. It translates sustainability activity into measurable, comparable and verifiable data that investors, regulators and customers can use to make decisions.

Is ESG reporting mandatory?

It depends on where the company operates and how large it is. Within the EU, the CSRD requires large companies and certain listed entities above defined thresholds to publish assured sustainability information in accordance with ESRS. Outside the EU, requirements vary: ISSB-aligned regimes have been adopted in a growing number of jurisdictions, while the United States has moved to rescind its federal climate disclosure rules. Many companies outside mandatory scope still report because banks, insurers and large customers require the data.

What is the difference between ESG reporting and sustainability reporting?

Sustainability reporting is broad and impact-oriented, aimed at a wide audience and often narrative in style. ESG reporting is more structured and investor- and regulator-oriented, built on defined metrics, materiality assessments and third-party assurance. In practice, the two increasingly overlap, because regulation has pushed sustainability disclosure toward the ESG reporting model.

What are the three pillars of ESG reporting?

Environmental, social and governance. The environmental pillar covers emissions, energy, water, waste and biodiversity. The social pillar covers workforce, human rights, health and safety, diversity and community impact. The governance pillar covers board oversight, ethics, anti-corruption, internal control and data governance.

What is the CSRD and how does it relate to ESG reporting?

The Corporate Sustainability Reporting Directive is the EU law that makes ESG reporting a legal obligation for companies above defined size thresholds and prescribes the format of disclosure. Companies in scope report according to the European Sustainability Reporting Standards (ESRS), which set out the specific disclosure requirements across environmental, social and governance topics.

What is double materiality and why does it matter?

Double materiality is the requirement to assess sustainability topics from two directions: how they affect the company’s financial performance (financial materiality), and how the company’s activities affect people and the environment (impact materiality). A topic is reportable if it is material from either perspective, which makes the assessment broader than a purely financial one.

What data is needed for ESG reporting?

Typically greenhouse gas emissions across Scopes 1, 2 and 3, energy and water consumption, waste volumes, workforce and safety data, diversity and pay metrics, supplier information, board and remuneration data, and details of policies, targets and governance processes. The data comes from operational systems, ERP, HR, procurement and third parties, and must be documented with clear definitions, boundaries and calculation methods.

How long does it take to prepare for ESG reporting?

For a company with no existing infrastructure, a realistic preparation cycle is 12 to 18 months for a first report, with the materiality assessment and data architecture taking the longest. Companies that begin with a defined data model and phased supplier engagement typically reach a stable, repeatable cycle by the second reporting year.

Can small and medium-sized companies use a simplified approach?

Yes. The VSME standard provides a voluntary, proportionate disclosure framework designed for SMEs, and large companies are expected to accept VSME-scoped data from suppliers with fewer than 1,000 employees. It is the practical route for mid-market companies that need to answer customer and bank requests without implementing the full ESRS dataset.

What is the biggest challenge in ESG reporting?

Data quality and traceability. ESG data originates in many systems, is often estimated rather than measured, and must be evidenced for assurance. Organisations that solve the data architecture problem — clear definitions, automated collection, documented methodology and a defensible audit trail — find the reporting itself comparatively straightforward.