Overview
Mandatory disclosure law tells companies what they must say. It rarely tells anyone, with confidence, whether what's being said is true — that verification function has historically been left to markets, auditors, and reputational pressure, all of which have documented limits. This guide makes the case, addressed to regulators and policymakers, for why independent certification is a genuine complement to disclosure regulation rather than a redundant or competing layer.
What Disclosure Regulation Does and Doesn't Do
Regimes like the EU's CSRD/ESRS, the ISSB's IFRS S1/S2, and California's SB 253/261 compel companies to disclose specific sustainability information, in specific formats, against specific materiality tests — see The Global ESG Disclosure Regulation Guide for the detailed comparison. What none of these regimes does, by itself, is independently verify that a given disclosure is accurate. CSRD requires assurance of disclosures, but assurance providers work from the company's own records and representations; most disclosure regimes worldwide still rely predominantly on self-reported data with after-the-fact enforcement as the primary check on accuracy, rather than systematic, proactive verification built into the disclosure process itself.
The Verification Gap, Documented
The scale of this gap is well evidenced, not speculative. A European Commission review found 42% of examined corporate sustainability claims misleading or unverifiable. An estimated 30–40% of all corporate ESG claims lack credible verification. A 2022 analysis found over 70% of climate-themed ESG funds failed to align with the global climate goals they claimed to pursue. None of these figures describe a regulatory-design failure exactly — disclosure law was never designed to independently verify every claim it compels, any more than tax law independently audits every return filed. But the gap is real, and it's the specific gap independent, evidence-based certification is designed to close.
Two Regulators Are Now Addressing Half of This Problem
Notably, two major financial regulators have recently moved to address a closely related but distinct piece of this verification problem: the reliability of ESG ratings specifically, as opposed to corporate disclosures generally. The EU's Regulation (EU) 2024/3005 (adopted 27 November 2024) establishes an authorisation and transparency regime for ESG rating providers operating in the Union, addressing methodology transparency and conflicts of interest. The UK FCA's Consultation Paper CP25/34 (December 2025) proposes a parallel regime covering baseline standards, transparency, governance, conflicts of interest, and complaints handling for UK-active ESG rating providers. That two regulators, working largely independently, converged on essentially the same diagnosis — that ESG ratings suffer from transparency and conflict-of-interest problems serious enough to warrant direct regulatory intervention — is itself significant evidence that the market has not solved this problem on its own.
Why Ratings Regulation Alone Doesn't Close the Gap
Regulating ratings providers addresses transparency and conflicts of interest in how opinions about companies get formed and sold — a real and worthwhile intervention. But it doesn't address the more upstream problem: ratings are still built substantially from self-reported corporate disclosures, and even a perfectly transparent, conflict-free rating methodology applied to unverified underlying data produces an unreliable output. Academic analysis of ESG rating firms as sustainable-finance gatekeepers has noted precisely this structural weakness: ESG ratings are difficult to verify for accuracy ex post, given their complex, multi-dimensional, and predictive nature, which keeps the market cost of an inaccurate rating low regardless of how transparent the methodology behind it is. Certification protocols that verify underlying claims against evidence — rather than aggregating opinions about self-reported disclosures — address a layer of the problem that ratings regulation, by itself, does not reach.
Market Surveillance Through Public Verification
A certification scheme with a public verification mechanism functions as a form of low-cost, continuous market surveillance that complements periodic regulatory enforcement. Every Standard ESG certificate carries a QR code linking to a public page showing current validity status, level, score, and dates — visible to any market participant, at any time, without requiring a regulatory information request. When a certificate is revoked for cause, that status change is immediately and publicly reflected, giving the market a real-time signal that doesn't depend on waiting for a regulator's enforcement action or a company's own voluntary disclosure of a problem. This is a genuinely different surveillance mechanism from regulatory enforcement — it's distributed across every market participant checking a certificate, rather than centralized in a single regulator's limited investigative capacity.
Complaint-Triggered Re-Assessment
Beyond passive public verification, a well-governed certification scheme provides an active channel for third parties — competitors, customers, workers, NGOs, members of the public — to flag concerns about a certified company, which can trigger re-assessment or revocation. This functions similarly to a regulatory whistleblower or complaints mechanism, but operating continuously and directly against a specific, checkable certification claim rather than requiring a formal regulatory complaint process. See the Impartiality, Appeals and Complaints Policy for how this works in Standard ESG's scheme specifically — any substantiated complaint can trigger re-assessment, and where the complaint reveals a gate violation (child or forced labour, undisclosed corruption sanctions), that finding overrides the company's existing certification entirely, regardless of when in the certification cycle it surfaces.
Impartiality and Auditor-Competence Governance
For a certification scheme's verification claims to carry real weight, the scheme's own governance needs to withstand scrutiny — a concern regulators evaluating any conformity-assessment or verification body would naturally raise. A well-governed scheme requires reviewers and auditors to declare conflicts of interest and recuse themselves where one exists, binds partner auditors under signed agreements to the same standards as internal staff, and requires documented training — covering the protocol itself plus underlying standards like ISO 20400, SA8000 auditing practice, and health-and-safety inspection fundamentals — before anyone is authorized to conduct assessments. Appeals of certification decisions are reviewed by staff not involved in the original decision, a structural separation rather than a stated policy alone. This mirrors, in miniature, exactly the kind of impartiality and competence requirements regulators impose on accredited conformity-assessment bodies more broadly.
Tamper-Evident Template Hashing
A subtler but important governance feature: assessment templates (the specific indicators, weights, and evidence requirements a company is scored against) are immutable once published and cryptographically content-hashed at lock time, with that version and hash stamped on every resulting certificate. This means the specific criteria behind any certificate — including certificates issued years earlier — remain permanently, independently verifiable and cannot be silently altered retroactively. For a regulator evaluating whether a certification scheme's claims can be trusted over time, this kind of tamper-evidence is a meaningful technical safeguard against exactly the kind of "the goalposts moved after the fact" concern that undermines confidence in less rigorously versioned assessment schemes.
Mirroring Conformity-Assessment Good Practice
None of the governance mechanisms described above are novel inventions specific to ESG — they mirror established good practice from conformity assessment more broadly: impartiality requirements, competence standards for assessors, appeals mechanisms, and version control over the criteria being assessed against are all standard features of credible accreditation and certification regimes across many industries. The case for regulators taking voluntary ESG certification seriously as a complement to disclosure law rests partly on recognizing that these are not ad hoc features specific to one scheme, but the same structural safeguards regulators already expect from credible assessment bodies in other domains.
Easing SME Entry Into ESG Accountability
Disclosure regulation, by design, typically targets larger companies first — CSRD's initial scope, the SEC's large-accelerated-filer threshold, California's $1 billion revenue threshold. Small and medium-sized enterprises largely sit outside these direct mandates, even though they face growing indirect pressure through their larger customers' supply-chain due diligence obligations. Voluntary certification with a graduated entry point — a low-cost, proportionate Level 1 self-assessment, with the option to progress to document- or on-site-verified levels as capacity grows — gives SMEs a structured on-ramp into credible ESG accountability well before, or entirely independent of, any regulatory mandate reaching them directly. This serves a genuine public-interest goal that disclosure regulation, focused on the largest companies by design, does not directly address.
The Policy Case, Summarized
For regulators and policymakers, the case for recognizing voluntary, evidence-based certification as a genuine complement to disclosure regulation rests on five points: it provides continuous, public market surveillance that supplements periodic regulatory enforcement; it gives third parties an active channel to flag and trigger re-investigation of specific concerns; it applies impartiality and competence governance that mirrors established conformity-assessment good practice; it makes its own assessment criteria tamper-evident and permanently verifiable over time; and it extends structured ESG accountability to smaller companies that disclosure mandates, by design, do not yet reach. None of this substitutes for mandatory disclosure law or for regulating ratings providers directly — it fills a distinct, complementary gap that neither of those interventions, on their own, closes.
Standard ESG (standardesg.org) was built with exactly these governance mechanisms — public verification, complaint-triggered re-assessment, impartiality rules, and tamper-evident template hashing — as core design features, not afterthoughts. See The Standard ESG Certification Protocol: A Public Overview for the full governance detail.
Was this page useful?