The Credibility Disconnect: Corporate Sustainability Is Reaching the Limits of Downstream Reporting

EFRAG's 2026 State of Play Report examines 905 third-party assured sustainability statements. Companies identify material topics more readily than they convert priorities into targets, measurement and continuous evidence. EFRAG's review of 905 first-wave sustainability statements gives the market a large-scale view of how mandatory reporting is being implemented. The central signal is not that companies are unable to identify material matters. It is that targets, methods, accountability and granular operational records have not matured at the same speed after those matters are identified. The credibility disconnect therefore sits between reporting structure and evidence of execution. This Analysis therefore does not treat the credibility disconnect exposed by EFRAG's review of 905 sustainability statements as a self-contained technical or policy update. It separates the institutional facts supported by the official anchor, SNN editorial inference and outcomes that remain unverified. The reader should be able to see where the source ends, where interpretation begins and which conclusions the present evidence cannot support. To make the lead decision-ready, it answers five questions together: what has occurred, which first-party record supports it, through what mechanism the effect may travel, which outcome evidence is still missing, and what next observation could strengthen or overturn the judgement. Any causal relationship not stated by the source remains an editorial inference and is not converted into a factual claim through confident wording.

The first ESRS reporting wave spans countries and sectors, providing an important baseline. Reporting, ERP, procurement and supplier-management systems were originally built for different purposes. First-wave ESRS reporting reflects enterprise systems, sector characteristics, data availability and assurance readiness. A project team may complete the materiality process while supplier payments, procurement conditions and remediation remain dispersed across ERP, contracts, audits and email. A report can describe the existence of a policy without enabling the organisation to show where, by whom and across which transactions the policy produced an effect. Institutional context must identify the rule setter, implementer, data owner, reviewer and affected market. Those roles may sit in different organisations or functions, and publication of a document, deployment of a system, enterprise adoption and delivery of an outcome are different evidence states. Time and authority must also be separated. An announcement date is not an effective date; a pilot is not general adoption; a technical specification is not a legal obligation; and voluntary enterprise use is not regulatory approval. Putting these events on one timeline shows when an institutional development actually enters data, contract, investment or disclosure processes and which actor is authorised to make that transition.

Disclosure tools can organise existing information but cannot create missing evidence. When operational data lacks granular identity, context and responsibility, companies rely on aggregation or declarations instead of verifiable execution. The contrast between 81 per cent and 7 per cent matters because it converts an abstract reporting-quality concern into an observable systems-capability gap. ESG conditions in supplier selection can be described quickly through policies or questionnaires. Average payment terms for smaller suppliers require stable identification of supplier size, invoices, payment periods, exceptions and calculation population. The latter depends on continuous transaction evidence and cannot be reconstructed reliably through year-end narrative. When upstream evidence lacks stable identity, formation time, applicable boundary and version, a standardised output may still be impossible to reconstruct. The material risk is not one missing field. It is the silent conversion of the wrong entity, an expired method, an inferred relationship or an unapproved version into an apparent fact as information moves downstream. Concrete failure modes include incorrect entity matching, an incomplete data population, inconsistent boundaries, unversioned methods or factors, exceptions without rationale, approval occurring after publication, and downstream reuse outside the original purpose. Each failure can turn a reasonable individual record into a conclusion that cannot be defended after aggregation, comparison or machine-assisted interpretation.

Improvement requires traceable links among material topics, targets, operations, counterparties and responsible actors. Supplier codes should connect to payment, audit and remediation records rather than remain declarations. Improvement should begin with evidence-to-disclosure mapping rather than additional report language. Every material claim is linked to its policy, accountable owner, operational activity, transaction record, method, control, exception and reporting version. For supplier matters, the organisation also preserves whether selection conditions entered purchase orders, whether audit findings led to remediation, and whether payment metrics use a consistent population and period. The implementable control unit is a governed evidence object. Each material claim links to its primary source, calculation or judgement method, organisational and temporal boundary, accountable owner, control state, exception, approval and version. When any component changes, the system preserves the difference and affected uses instead of overwriting the earlier basis. A minimum operating control set includes a claim register, evidence owner, source snapshot, method identity, valid period, control frequency, exception threshold, review, approval and permitted downstream use. High-judgement or high-financial-impact items receive a stronger review tier. Lower-risk records use automated completeness and consistency checks so that governance effort is concentrated where a wrong claim would change a decision.

The report finds that 81 percent of organisations reference ESG criteria in supplier selection, while only 7 percent disclose specific average payment terms for SMEs. The gap indicates system capability limits. The EFRAG report supports claims about sample size, first-wave practice and particular reporting proportions. It cannot be used to conclude that every company has the same weakness. This Analysis treats the 81-per-cent and 7-per-cent figures as an institutional signal that narrative policy and granular operational evidence mature at different speeds; it is not a reassessment of any individual report or assurance conclusion. Evidence assessment begins with the official anchor and uses independent primary or method-transparent sources to test context and limits. The sources support stated institutional facts and explicit figures. Claims of comprehensive adoption, causal improvement or universal cross-market effectiveness require separate implementation evidence. Every material sentence should enter a claim ledger and be classified as official fact, direct measurement, estimate, corporate commitment, delivered outcome or SNN editorial inference. The ledger records the precise scope that each source supports. Conflicting evidence is retained with the resolution rationale; absent evidence is marked pending rather than filled with a convenient analogue from another entity, period or jurisdiction.

Institutional attention will shift from more disclosure toward stronger upstream operational evidence. Assurance credibility depends on preserving identity, time, method and responsibility when information is created. The gap also changes the centre of gravity for assurance. If an assurance provider can inspect only final narrative and aggregate tables, it may not identify selective exclusion, reclassification or overwrite after data creation. When sources, methods, populations and control states can be reconstructed across versions, assurance can move from a year-end sampling exercise toward more continuous, risk-based review. The purpose of this information density is not length for its own sake. It is to shorten the verification distance between claim and decision. Boards, investors, regulators and operational teams should be able to distinguish fact, estimate, commitment, progress and outcome, then update the judgement when conditions change without reconstructing the case from scattered files and oral explanation. Accountability therefore attaches to decision rights. The data owner maintains the source, the method owner controls calculation, the business function defines the use case, internal control or assurance tests reproducibility, and the approver accepts responsibility for final use. An exception without an expiry date, remediation owner and impact scope stops being temporary treatment and becomes persistent evidence debt.

SNN editorial analysis: EFRAG evidence from 905 statements is a direct warning for Taiwan listed companies entering phased IFRS S1 and S2 adoption from 2026. Electronics, finance, steel and other exporters need targets connected to operating responsibility, baselines, methods and continuing evidence or the credibility gap will remain visible to European customers and assurance providers. Taiwan is phasing in IFRS S1 and S2 from 2026. Although those standards differ from ESRS in materiality architecture and legal obligation, European customers may still ask Taiwan electronics, steel, financial and consumer-goods supply chains for granular data. Companies should connect material matters to operational owners, baselines, target algorithms, supplier populations and transactions, while marking whether each item serves IFRS reporting, an ESRS customer request or internal governance. For Taiwan, relevance should be traced through an actual transmission path. An international rule or customer requirement first enters finance, procurement, contract, supplier-data and assurance processes, then changes local systems and controls. It does not automatically become Taiwan law. Companies need to identify the applicable scenario, preserve bilingual mappings and make the evidence chain reviewable under controlled access. Taiwan companies can perform the transmission test on concrete objects: the company and legal entity, facility, product, batch, supplier, contract, financing instrument and disclosure field. Chinese and English names, internal and external classifications and different reporting frameworks should resolve to the same claim identity. Traceability must still preserve commercial confidentiality, personal data and access boundaries; it does not require unrestricted publication.

Future comparison should examine later reporting cycles, sector variation and system improvements. Human review must confirm the sample, statistical definitions and ESRS context before publication. Future comparison should test whether second-year reports narrow the distance between policies and execution metrics, and whether sector, size and systems maturity explain different rates of improvement. A company can act now by selecting one disclosed material matter, asking internal audit to trace it back to original transactions, and recording how many manual questions, missing fields and uncertain versions are required to reconstruct the claim. Future monitoring should separate final text, technical guidance, adoption scope, operating controls, supervision and observable outcomes. A low-regret step is to select one high-risk claim for an end-to-end reconstruction test and record missing identity, source, method, accountability and version. That is governance preparation, not a compliance guarantee or forecast of results. Monitoring should be event-triggered as well as calendar-based. A final rule, amended technical guidance, expanded scope, supervisory action, adoption data or observed outcome creates a new version and a reassessment of the earlier judgement. The prior conclusion is not erased. It retains its original basis, identifies the new evidence that changed it and states which decisions or downstream uses now require review.