CSRD Wave 2: The Ultimate Guide to Preparing for CSRD

Introduction

For a CSRD wave 2 company, the first sustainability statement will now cover the 2027 financial year and be published in 2028. That is two years later than originally planned, and the standards are considerably lighter than those Wave 1 companies applied. The underlying work, however, is largely unchanged. Companies still need a double materiality assessment that withstands scrutiny, reliable data, documented controls, and a sustainability statement capable of obtaining limited assurance.

This guide explains what the Omnibus package changed, which companies are now in scope, and how to use the time remaining before the first reporting year begins. It draws primarily on EU legislation and EFRAG material, supplemented by published guidance from the Big 4 audit firms. It also reflects Nossa Data's experience supporting Wave 1, 2 and 3 companies with their CSRD preparation.

Who is in scope: Wave 2 now covers EU companies and groups with more than 1,000 employees and net turnover above EUR 450 million. They will report on FY2027 under the revised ESRS, which contain 61% fewer mandatory datapoints than the 2023 standards, and their statements remain subject to limited assurance. The most valuable steps to take now are to begin the double materiality assessment, run a gap analysis alongside it, and involve the assurance provider early.

Nossa Data helps companies manage CSRD preparation and disclosure in a single platform, from the first ESRS gap analysis to an audit-ready sustainability statement. Speak to our team to discuss your Wave 2 programme.

1. What is the CSRD, and what changed under the Omnibus?

The Corporate Sustainability Reporting Directive (Directive (EU) 2022/2464) requires companies within its scope to include a sustainability statement in their management report. The statement is prepared under the European Sustainability Reporting Standards (ESRS), tagged in a machine-readable format once the detailed rules apply (see section 13) and subject to external assurance. The directive entered into force on 5 January 2023, replacing the Non-Financial Reporting Directive (NFRD), and the first set of ESRS followed as Commission Delegated Regulation (EU) 2023/2772.

As originally drafted, the CSRD applied in four waves. Large public-interest entities already reporting under the NFRD (Wave 1) began with FY2024. Other large companies (Wave 2) were due to follow with FY2025, listed SMEs (Wave 3) with FY2026, and non-EU groups with substantial EU turnover (Wave 4) with FY2028.

The Omnibus package

That timetable was overtaken by the Omnibus I simplification package, which the European Commission proposed on 26 February 2025 and which was adopted in two stages.

The first stage, the so-called stop-the-clock directive (Directive (EU) 2025/794), was adopted on 14 April 2025. It postponed reporting for Waves 2 and 3 by two years so that companies would not incur costs under rules that were about to change.

The second stage, the content directive (Directive (EU) 2026/470), was published in the Official Journal on 26 February 2026 and entered into force on 18 March 2026 (EY, March 2026). It narrowed the scope of the CSRD to companies with more than 1,000 employees and net turnover above EUR 450 million, removing listed SMEs altogether. It introduced a value chain cap, under which reporting companies may not request more information from business partners with up to 1,000 employees than a voluntary standard permits. It removed the planned move to reasonable assurance, retaining limited assurance with an EU assurance standard due by 1 July 2027. It also allowed member states to exempt Wave 1 companies that fall below the new thresholds from reporting on FY2025 and FY2026, and required the Commission to adopt simplified ESRS.

The revised ESRS

EFRAG submitted its technical advice on simplified ESRS on 3 December 2025. The proposal reduced mandatory datapoints by 61%, removed all voluntary datapoints and roughly halved the length of the standards (EY, January 2026).

The Commission adopted the revised standards on 3 July 2026 as Delegated Regulation (EU) 2026/1463. Following the scrutiny period by the European Parliament and the Council, it was published in the Official Journal on 21 September 2026 and enters into force on 10 November 2026, without any need for transposition into national law (PwC, Sustainability reporting guide, September 2026, SRG 1.2.2.1). It applies to financial years beginning on or after 1 January 2027, and companies may apply it voluntarily to FY2026 (Deloitte IAS Plus; PwC Viewpoint). Wave 2 companies will therefore prepare their first statement under ESRS (2026) rather than the 2023 set.

2. Which companies are in scope under CSRD wave 2?

Following the Omnibus, a CSRD wave 2 company is an EU undertaking, or the parent of an EU group, with more than 1,000 employees on average and net turnover above EUR 450 million that was not already reporting as part of Wave 1. Both criteria must be met, and for groups they are measured on a consolidated basis.

Sources: Directive (EU) 2026/470; EY, March 2026.

Several points deserve attention when applying these criteria to a particular group. Wave 2 is not limited to listed companies: large private groups, credit institutions and insurers are within scope if they meet the thresholds. An EU subsidiary may be exempt where its parent publishes a compliant consolidated sustainability statement that covers it, and pure financial holding companies that do not manage their subsidiaries are exempt from direct reporting.

Many companies that prepared for the original Wave 2, with its threshold of 250 employees, now fall outside the mandatory regime. They are likely to continue receiving information requests from customers and lenders, although the value chain cap limits what in-scope companies may ask of them.

Finally, the detail depends on national law. Member states must transpose the Omnibus changes by 19 March 2027 and may add requirements of their own, so the position should be confirmed in each country where the group has an in-scope entity.

Applying the thresholds in practice

PwC's Sustainability reporting guide (September 2026) addresses several practical questions that arise when groups test themselves against the new thresholds (SRG 2.3).

The thresholds are assessed for the financial year being reported, as at the balance sheet date. The Accounting Directive rule requiring size criteria to be exceeded in two consecutive years generally does not apply to the sustainability reporting obligation, so a calendar-year group tests its FY2027 obligation against its turnover and average headcount for the year ending 31 December 2027. National law should nonetheless be checked. Net turnover is measured under the GAAP applied in the financial statements, while the definition of an employee and the method of averaging follow national rules. Where national guidance is silent, the Commission's November 2024 FAQs point to the annual work unit approach in Recommendation 2003/361/EC, under which part-time and seasonal staff count as fractions of a full-time employee.

For a group, the test is performed on a consolidated basis, includes subsidiaries outside the EU and measures turnover after intercompany eliminations. Acquired businesses count from the date they join the group, and disposed businesses until the date they leave. An exemption from preparing consolidated financial statements does not, by itself, exempt a parent from consolidated sustainability reporting, so an intermediate holding company may need to produce financial information solely to support its sustainability statement. Public-interest entity status alone does not create a reporting obligation, and issuers with securities admitted to trading on an EU-regulated market, including non-EU issuers, apply the same thresholds.

PwC illustrates the consolidated test with a Dutch holding company that has no operations of its own, a German subsidiary with EUR 600 million turnover and 2,800 employees, and a Japanese subsidiary with EUR 150 million turnover and 480 employees. The holding company does not meet the thresholds on a standalone basis, but the group's EUR 750 million turnover and 3,300 employees exceed both. The Dutch parent must therefore prepare consolidated sustainability reporting for FY2027, and the Japanese subsidiary is included in the assessment even though it is established outside the EU.

3. First steps: how to begin preparing for the CSRD

The double materiality assessment, the gap analysis and the first discussions with the assurance provider are best run in parallel rather than in sequence, because each informs the others.

Step 1: Carry out a double materiality assessment

The double materiality assessment (DMA) determines the content of the sustainability statement. Under ESRS, a sustainability matter is material if it is material from an impact perspective (the company's effects on people and the environment), from a financial perspective (its effects on the company's cash flows, performance, position and cost of capital), or from both. The scope of data collection, internal controls and assurance all follows from its conclusions, which is why it should come first.

The revised ESRS make the exercise more manageable than it was for Wave 1. Companies may take a top-down approach, reaching conclusions at topic level where materiality is evident from the strategy, business model, sector and geographic footprint, and assessing individual impacts, risks and opportunities (IROs) only where the answer is less clear. A full reassessment is not required every year unless circumstances change significantly (EY, January 2026).

Step 2: Run a gap analysis alongside it

As material topics emerge, they should be mapped to the ESRS (2026) disclosure requirements and compared with the information the company already holds. For each relevant datapoint, the gap analysis should establish:

1. whether the information is already reported, for example in the annual report, CDP response, EU Taxonomy disclosures or a voluntary sustainability report;
2. who owns the data and in which system it is held;
3. whether the data is currently measured, estimated or unavailable;
4. whether policies, actions or targets expected by the standards are missing; and
5. the effort and time required to close each gap.

Conducting the two exercises together avoids investing in data for topics that are later judged immaterial. It also reveals early the areas where the company has no policy or target at all, which typically take longest to address.

A key lesson from Nossa Data's work with reporting companies is that most organisations already have a clear view of their material issues, which the DMA then formally validates. For the large majority, E1 Climate Change, S1 Own Workforce and G1 Business Conduct prove material, as EFRAG's review of FY2025 statements confirms (99%, 99% and 95% of companies respectively). Gap analysis on these three standards can therefore usually begin before the DMA is finalised.

Step 3: Hold pre-assurance discussions with the auditor

Early agreement with the assurance provider on how the DMA will be assessed, what documentation will be expected and how estimates will be treated reduces the risk of late surprises. PwC identifies the failure to involve the assurance practitioner early as one of eight common DMA mistakes (PwC Ireland). The Dutch Authority for the Financial Markets (AFM) observed that, in Wave 1, assurance teams that reviewed first drafts in the third or fourth quarter enabled companies to close gaps before the year end (AFM, February 2026).

Nossa Data's experience with Wave 1 companies supports this. One of the most common causes of difficulty in a CSRD engagement is a gap between the assurance provider's expectations of limited assurance and the issuer's understanding of them. The sooner you know what type of data you will need to provide the auditor, the better.

Initial discussions usually cover the DMA methodology, scoring scales and thresholds; the reporting boundary and consolidation scope; the reliefs and phase-ins the company intends to use; the approach to estimates and value chain data; and whether a readiness review on FY2026 information would be worthwhile. Where the statutory auditor will also provide sustainability assurance, independence rules may restrict the advisory support the same firm can offer. If an early conversation with the auditor is not feasible, the finance team is a useful starting point, as it already understands the evidence auditors expect in a financial statement audit.

For example, consider a company reporting its total number of employees under ESRS S1. During a limited assurance engagement, an auditor would not simply check that the figure has been disclosed. They would typically request supporting evidence, such as an export from the company's HR system, documentation explaining how the figure was calculated, and a reconciliation between the underlying data and the reported number. They may also review internal controls, management approvals and a sample of employee records to assess the accuracy and completeness of the disclosure.

4. When was the CSRD adopted, which countries have transposed it, and what are the timelines?

The CSRD was signed on 14 December 2022, published in the Official Journal on 16 December 2022 and entered into force on 5 January 2023. As a directive, it must be transposed into national law by each member state, and the original deadline was 6 July 2024. Many member states missed it, and in September 2024 the Commission opened infringement proceedings against 17 of them.

Key regulatory milestones

Transposition status

According to EY (March 2026), most member states had transposed the original CSRD by March 2026. The exceptions were Germany, Luxembourg, the Netherlands, Portugal and Spain.

Companies should expect a second round of national legislation, since member states must also transpose the Omnibus amendments by 19 March 2027. Some may go further than the directive requires, for example on who is permitted to provide assurance. None of this is a reason to delay preparation. The revised ESRS take the form of a delegated regulation and apply directly, so the content of the first report is settled even where national law is not.

5. What are the EFRAG datapoints, and how can they help with preparation?

EFRAG's list of ESRS datapoints breaks each disclosure requirement down into the individual items to be reported, which makes it a practical basis for a data collection plan. The first version, EFRAG IG 3, was finalised on 31 May 2024 as an Excel workbook with an explanatory note and was technically updated in December 2024 and January 2025.

For each datapoint, the list identifies the ESRS standard, disclosure requirement and paragraph reference; the type of data required, such as narrative, monetary, percentage or GHG emissions; whether the datapoint is voluntary, phased in or conditional on another disclosure; and whether it links to other EU legislation such as SFDR or Pillar 3.

The 2026 datapoint list

IG 3 was prepared for the 2023 ESRS. Following the adoption of the revised standards, the EFRAG Secretariat released a 2026 Draft List of ESRS Datapoints on 28 August 2026. It reflects ESRS (2026), categorises datapoints by data type, links each reference to EFRAG's Knowledge Hub and includes a version that maps paragraphs back to the 2023 standards. The comment period closed on 23 October 2026, a final version is expected by the end of 2026, and a draft XBRL taxonomy will be consulted on separately. Wave 2 companies should build their gap analysis on the 2026 list rather than on IG 3.

Using the list in practice

Filtered to the company's material topics and extended with columns for data owner, source system, availability and quality, the list effectively becomes the gap analysis. It is worth separating the general disclosures in ESRS 2, which apply regardless of the DMA outcome, from topical datapoints that apply only where a topic is material, and flagging those that may be omitted under the phase-in provisions described in section 14.

The list also provides a framework for internal controls, since every datapoint should have a single accountable owner, and for digital tagging, since the datapoints map to the ESRS XBRL taxonomy. Before collecting anything new, companies should map their existing CDP, GRI, TCFD and EU Taxonomy outputs against it.

6. What guidance is available for a double materiality assessment?

The binding requirements are set out in ESRS 1 and ESRS 2, now in their 2026 form. Several further sources help translate them into a workable process.

A practical DMA process

Deloitte describes a four-step approach consistent with EFRAG IG 1. The company first establishes its context by mapping its business activities, business relationships, geographies and value chain. It then identifies potential IROs, starting from the ESRS topic list and adding sector- and entity-specific matters, informed by engagement with affected stakeholders and users of the report. Third, it assesses materiality, scoring impacts on severity and likelihood, and risks and opportunities on likelihood and magnitude, against thresholds defined in advance. Finally, it concludes and documents the outcome, recording decisions, thresholds and judgements and mapping each material IRO to the relevant disclosure requirements.

What the revised ESRS change

ESRS (2026) introduce several simplifications (EY, January 2026). The top-down approach permits conclusions at topic level where materiality is evident. IROs with shared characteristics may be aggregated, provided significant differences between geographies, sectors or sites are not obscured. Impacts are generally assessed on a gross basis, before mitigation, although effective prevention measures may be taken into account for potential impacts. The principle of undue cost or effort means that an exhaustive search for every possible IRO is not required, and a full reassessment is needed only when circumstances change significantly.

PwC's guidance adds some useful clarifications (SRG 4.4). In its view, the choice between a top-down and a bottom-up approach should not change the conclusions reached, since the underlying requirement to identify material IROs is the same, and the two approaches may be combined across different topics. ESRS 1 (2026) AR 15 confirms that a company need not analyse each characteristic of severity, or every time horizon, where a conclusion can be reached without doing so. Assessing materiality at topic level does not, however, remove the obligation to identify and describe the material IROs themselves in the sustainability statement. ESRS (2026) do not require stakeholder engagement as such, but where a company carries out due diligence, the results of engagement with affected stakeholders are a key input to the impact assessment, and SBM-2 requires disclosure of whether and how engagement took place. Judgements about undue cost or effort must also be revisited at each reporting date, as the standards expect the availability of information to improve over time.

Common pitfalls

PwC's review of DMA practice highlights eight recurring weaknesses: completing the assessment quickly without adequate documentation; assessing only at topic level; relying solely on the ESRS topic list; depending on a single tool or method; giving impact and financial materiality unequal weight; working in silos; involving the assurance provider too late; and omitting a final "stand-back" review against the company's own public statements. Practice is nevertheless maturing. EFRAG found that 67% of companies reporting on FY2025 used a hybrid of top-down and bottom-up methods, and that 82% updated their DMA in the second year of reporting.

7. What guidance is available for value chain mapping?

The principal reference is EFRAG IG 2: Value Chain, finalised on 31 May 2024. ESRS define the value chain as "the full range of activities, resources and relationships related to the undertaking's business model", both upstream and downstream. The DMA must therefore consider IROs across the whole chain, not only within the company's own operations.

Mapping the value chain

A practical map starts from the business model: the products and services offered, key inputs, principal supplier categories, logistics, distribution channels, customers and end-of-life treatment. Each stage should then be classified as upstream, own operations or downstream, with the relevant geographies and sectors recorded, since these largely determine exposure to human rights and environmental risks. The affected stakeholders at each stage, including workers in the value chain, local communities, consumers and end-users, should be identified at the same time.

Rather than surveying every supplier, companies can use sector and country risk data to locate the hotspots where severe impacts are most likely. These hotspots feed directly into the long list of IROs. For each metric that depends on value chain information, the company should then decide whether to rely on primary data, supplier-specific data, or sector averages and other estimates.

Changes following the Omnibus

The Omnibus has altered the economics of value chain reporting. In-scope companies may not request more information from value chain partners with up to 1,000 employees than the voluntary standard allows, and those partners may decline requests that go further (EY, March 2026). The cap does not apply to requests made for due diligence purposes.

The revised ESRS also remove the hierarchy that previously favoured primary data, placing estimates and secondary data on an equal footing. Where reliable direct or estimated data cannot be obtained without undue cost or effort, a company may report a metric for only an objectively defined part of its own operations or value chain, provided it discloses that it has done so. The relief does not extend to gross Scope 1, 2 and 3 GHG emissions under ESRS E1-8. PwC suggests that a legal entity, a site, value chain partners below a certain size or those located in particular countries could each constitute an objectively defined part (SRG 3.7.2). Activities that are not significant drivers of the IRO a metric represents may also be excluded, provided this does not impair the relevance or faithful representation of the information.

As a result, value chain work for Wave 2 will depend less on extensive supplier surveys and more on well-chosen, well-documented estimation methods. EY expects the cap to increase reliance on secondary data, which suggests assurance providers will concentrate on how estimates were selected and applied.

8. What are IROs, and how should they be considered?

Impacts, risks and opportunities (IROs) are the units assessed in the DMA. For each IRO judged material, a reader of the sustainability statement should be able to understand what it is, where it arises in the value chain, and which policies, actions, metrics and targets address it.

Sources: ESRS 1; Deloitte.

Practical considerations

Impacts and risks are frequently connected. EFRAG IG 1 notes that most material impacts eventually give rise to financial risks or opportunities, whether through regulation, reputation or dependence on resources, so both perspectives should be assessed for each matter. Risks may also arise from dependencies on natural, human and social resources, independently of the company's own impacts. For potential negative human rights impacts, severity takes precedence over likelihood.

Each IRO should be specific. Climate change is a topic rather than an IRO; an IRO describes a particular matter, where it occurs in the value chain and the effect it has. The revised ESRS allow IROs with shared characteristics to be aggregated, but they should be kept separate where geographies, business units or assets differ significantly.

A single IRO register, recording for each item an identifier, description, value chain stage, time horizon, scores, rationale, owner and related disclosures, gives the process structure and serves as key evidence for the assurance provider. It is also the natural place to test the link to strategy. EFRAG's review of FY2025 statements found that companies identified on average 6.4 material topics but set measurable targets for only 3.3 (EFRAG State of Play 2026). Material IROs without corresponding policies, actions or targets are likely to attract questions from auditors and readers alike.

9. How should risks be classified to meet auditor expectations?

Assurance providers do not expect a particular scoring model. They expect a method that was set before scoring began, applied consistently, aligned with the way the business manages risk elsewhere, and documented well enough to be re-performed. Under the CEAOB guidelines, the assurance provider checks whether the process described in the statement is the process the company actually followed, and whether any material IRO appears to have been omitted.

Classification dimensions

Each sustainability risk should be classified on the same set of dimensions, so that results can be compared and challenged.

What assurance providers look for

The first expectation is alignment with enterprise risk management (ERM). Using the same likelihood scales, and where appropriate the same financial thresholds, as the group risk register makes the results easier to defend. A risk treated as material for CSRD purposes but absent from the ERM register, or the reverse, will invite questions.

Thresholds for financial materiality should be quantitative and linked to the financial statements, with the rationale documented and sensitivity tested close to the cut-off. The AFM observed assurance teams using scenario analysis to challenge outcomes near the threshold (AFM, February 2026). Assumptions such as carbon prices, asset lives and impairment drivers should also be consistent with those used in the financial statements.

Time horizons deserve particular care. ESRS 1 (2026) paragraph 79 sets the short term as the period covered by the financial statements, the medium term as up to five years and the long term as more than five years. A company may depart from the medium- and long-term definitions only where the defaults would produce information that is not relevant, and it must disclose that it has done so. PwC cautions against allowing the uncertainty of long-term risks to reduce their apparent significance (SRG 3.5.3 and 4.6). The time horizon is a characteristic of a risk, not a determinant of its materiality. Neither ESRS nor the ISSB standards require financial effects to be discounted in the materiality assessment, qualitative analysis is an accepted basis where effects cannot be quantified reliably, and low-likelihood, high-impact risks may be material, particularly in aggregate.

The process also needs a clear evidential trail, including workshop records, stakeholder input and formal approval by the board or a board committee. A stand-back review, comparing the results with the company's public statements, investor communications and peers' disclosures, provides a useful final test of completeness. Deloitte emphasises recording how thresholds were set and where judgement was applied for each IRO, noting that consistent scoring itself forms part of the control framework (Deloitte).

10. What can Wave 2 learn from Wave 1 CSRD disclosures?

Wave 1 companies have now published two rounds of ESRS statements, and EFRAG has reviewed both. Companies converged quickly on a similar overall structure. The statements were nevertheless long, practice varied considerably at datapoint level, and many companies identified material topics without setting targets for them.

Sources: EFRAG State of Play 2025; EFRAG State of Play 2026.

Lessons for Wave 2

The number of material topics is broadly predictable. In the first year, an average of six of the ten topical standards were judged material, and climate change, own workforce and business conduct were material for almost every company. Length, by contrast, proved a poor indicator of quality. EFRAG found little correlation between the length of a statement and the number of material topics, and KPMG observed that many statements contained the required disclosures but struggled to convey a coherent sustainability narrative, with frequent repetition and limited cross-referencing (KPMG, September 2025).

Several more detailed weaknesses recur. Many companies reported entity-specific information, but only around 30% labelled it as such. Companies identified 6.4 material topics on average but set measurable targets for only 3.3. KPMG's survey found that companies felt considerably better prepared for climate disclosures than for pollution and social data, and that while almost all reported Scope 1, 2 and 3 emissions, fewer than a third reported emission reductions. EFRAG also noted that stakeholder engagement in the DMA was largely business-focused, with wider societal stakeholders consulted less often.

The second year showed clear improvement. In FY2025, 82% of companies updated their DMA, 67% used a hybrid approach, and the proportion disclosing a climate transition plan rose from 55% to 69%.

How disclosure will differ after the Omnibus

Wave 2 statements are likely to be shorter, given 61% fewer mandatory datapoints and the removal of voluntary datapoints. They will, however, require more explanation of judgement. The top-down DMA, aggregation of IROs, partial-scope metrics and undue cost or effort reliefs each involve choices that must be disclosed and justified, and ESRS (2026) introduce fair presentation as an explicit objective, supported by a statement of compliance in BP-1.

The value chain cap will increase the use of estimates and sector averages. Companies also gain flexibility in presentation: they may adopt a four-part structure (general, environmental, social and governance) or explain the reasons for an alternative, and they may include an executive summary (PwC Viewpoint). Because Wave 1 reports for FY2025 were prepared under the 2023 ESRS, benchmarking against them is more useful for approach and quality than for datapoint coverage.

11. What is limited assurance under the CSRD, and how should companies prepare?

Limited assurance results in a conclusion expressed in negative form: the assurance provider states that nothing has come to its attention to indicate that the sustainability statement is materially misstated. The work involved is less extensive than the reasonable assurance applied to financial statements and consists mainly of enquiries and analytical procedures, supported by targeted testing. Following the Omnibus, it is the only level of assurance the CSRD requires, as the planned move to reasonable assurance has been removed.

Scope of the assurance conclusion

Under the CSRD, and as described in the CEAOB's non-binding guidelines published in September 2024, the assurance conclusion covers the compliance of the sustainability statement with ESRS; the process used to identify the information reported, which in effect is the DMA; compliance with the EU Taxonomy disclosure requirements under Article 8; and, once they apply, compliance with the digital tagging requirements.

The Commission must adopt an EU limited assurance standard by 1 July 2027. Until then, national standards apply, generally based on ISAE 3000 (Revised) or the IAASB's ISSA 5000.

Experience from Wave 1

The AFM's review of first-year engagements provides the clearest public evidence of how limited assurance has worked in practice (AFM, February 2026). Controls over sustainability data were generally less mature than those over financial data, and none of the assurance teams reviewed placed reliance on client controls, relying instead on substantive procedures, often with larger samples. Data was more frequently estimated or sourced from third parties, and teams tested GHG emission factors against alternative sources. Challenge from the assurance teams led to more complete DMAs and to corrections in the completeness of GHG emissions. Analytical procedures were more difficult in the first year because no assured comparative data existed.

Preparing for assurance

Preparation should begin with agreement on the scope and timetable of the engagement, including interim reviews of the DMA and the draft statement. The company should assemble a complete file supporting the DMA, covering the methodology, IRO register, thresholds, stakeholder evidence and approvals, and should document every significant estimate, including the method, data sources, emission factors and key assumptions.

A reporting manual setting out definitions, boundaries and calculation methods for each metric, together with a clear audit trail from each reported figure to its source data, will reduce both the time the assurance provider needs and the number of findings. A dry run on FY2026 information, or on a subset of key metrics, followed by a readiness review, is the most effective way of identifying weaknesses while there is still time to address them. KPMG's 2025 ESG Assurance Maturity Index found that CSRD preparation took most companies more than a year (KPMG). Companies should also bear in mind that FY2027 figures will form the comparatives in the second year, so errors made in the first year will carry forward.

12. How do internal controls work, and how should internal and external auditors work together?

Internal control over sustainability reporting (ICSR) applies to sustainability data the same discipline that governs financial reporting: clear ownership, defined methodologies, review and approval, and evidence that each step has taken place. The most widely used framework is the COSO Internal Control – Integrated Framework, for which COSO published sustainability-specific guidance in March 2023 (Deloitte).

Applying the COSO components

PwC recommends embedding sustainability data within existing financial processes and systems, reusing established templates and automated controls, and operating controls on a fixed cadence so that evidence of review is retained (PwC Netherlands). ESRS 2 also requires companies to describe the main features of their risk management and internal control systems in relation to sustainability reporting.

The roles of internal and external audit

The Three Lines Model offers a clear way to allocate responsibilities. Data owners in operations, HR, procurement and finance form the first line, operating controls and collecting data. The sustainability reporting, risk and compliance functions form the second line, setting methodologies and reviewing and consolidating results. Internal audit, as the third line, provides independent assurance to the audit committee on the design and operation of controls. The external assurance provider then forms its own independent limited assurance conclusion.

Internal and external audit can work effectively together in several ways. Internal audit can review the DMA process and test higher-risk datapoints during FY2026, so that issues are resolved before the external engagement begins. The two functions should share a common view of which disclosures carry the greatest risk of misstatement, so that internal audit effort is directed there, and should agree documentation standards, such as risk and control matrices, that the external provider can use. Both should report to the audit committee, which should hold clear responsibility for overseeing sustainability reporting. Independence must be respected throughout: internal audit should not test controls it helped to design, and the external assurance provider cannot design the company's controls.

Market practice is moving in this direction. KPMG found that the proportion of companies in which management or internal audit tests the processes and controls behind ESG data rose from 15% in 2023 to 39% in 2025 (KPMG). Companies that reach a comparable level of control maturity before FY2027 begins can expect a considerably smoother first assurance cycle.

13. What requirements are in place for XBRL tagging?

The CSRD requires digital tagging in principle, but the obligation does not yet apply in practice. Article 29d of the Accounting Directive, inserted by the CSRD, requires in-scope companies to prepare their management report in the European Single Electronic Format (ESEF) and to mark up their sustainability statement, including the EU Taxonomy Article 8 disclosures. The Omnibus left this requirement unchanged. The detailed rules that make it operational, an amendment to the ESEF Regulation (Delegated Regulation (EU) 2019/815) containing the sustainability taxonomy, have not yet been adopted. EFRAG states plainly that "digital tagging of ESRS disclosures is not yet mandatory" (EFRAG, September 2026).

What XBRL tagging involves

XBRL (eXtensible Business Reporting Language) is the standard used to make corporate reports machine-readable. Under ESEF, the management report is published as an XHTML document that can be read in any web browser, and individual disclosures are labelled with tags from a digital taxonomy using Inline XBRL (iXBRL). Each tag identifies what a figure or passage represents, such as gross Scope 1 GHG emissions or a policy on the company's own workforce, so that software can extract and compare the information automatically. Listed companies already apply this approach to their IFRS consolidated financial statements.

For sustainability statements, the tags come from the ESRS XBRL taxonomy developed by EFRAG, which mirrors the ESRS datapoint list described in section 5. The tagged information is also intended to feed the European Single Access Point (ESAP).

Current status

Three bodies are involved. EFRAG develops the taxonomy, ESMA drafts regulatory technical standards (RTS) setting out the marking-up rules, and the Commission adopts those standards as a delegated act amending the ESEF Regulation (EFRAG).

Sources: EFRAG, September 2026; ESMA consultation paper, December 2024; ESMA report on 2025 corporate reporting activities, May 2026.

When will tagging apply?

No date has been set. ESMA's December 2024 consultation, prepared before the Omnibus, gives the clearest indication of how the timing is likely to work. It proposed that the rules would apply to financial years beginning in the year the amended RTS are published in the Official Journal if publication takes place before 30 June, and from the following year if it takes place later. It also proposed a phased introduction over three two-year phases, starting with ESRS 2, IRO-1, ESRS E1 and numerical datapoints, with narrative disclosures tagged as high-level text blocks, and moving progressively to more detailed tagging. Large companies that are not public-interest entities would start one year after large public-interest entities. ESMA will need to revisit these proposals in light of the Omnibus and the revised ESRS, so they should be treated as indicative only.

For Wave 2 companies, this means tagging is unlikely, though not impossible, to be required for the first report on FY2027. That would require the amended RTS to be finalised, adopted and published in the Official Journal by mid-2027, and ESMA's proposed phasing could defer the start further. Companies should nonetheless plan for it. Tagging will be required in due course, and once the rules apply, the assurance conclusion will extend to compliance with the marking-up requirements.

Practical steps now

Map reporting data to the ESRS datapoint list from the outset, since the XBRL taxonomy is built on the same structure. Ask the provider of your annual report or disclosure management software whether it supports ESRS iXBRL tagging, and consider tagging a subset of disclosures voluntarily to build familiarity. Monitor EFRAG's final taxonomy, expected at the end of 2026, and the resumption of ESMA's work on the RTS.

14. Additional advice for issuers preparing for the CSRD

Use the phase-in reliefs, but plan for future cycles without them

ESRS 1 (2026) gives companies that first report from FY2027, which the standard refers to as 'other undertakings', more transitional relief than Wave 1 receives. The main reliefs available to a Wave 2 company are summarised below.

Sources: ESRS 1 (2026) paragraphs 121 to 127; PwC, Sustainability reporting guide (September 2026), SRG 3.8; PwC Viewpoint.

These reliefs are narrower than they first appear. The value chain provision is not an exemption: information that is available must still be reported, and the value chain must still be considered in the DMA. A company that omits an entire topical standard must still assess whether the topic is material and, if it is, give brief disclosures on the related policies, actions, targets and metrics under ESRS 2 paragraph 9. Any use of the phase-ins must be disclosed under BP-2. The intervening period is best used to build the scenario analysis, value chain data and links with financial planning that will be needed once the reliefs expire.

Treat FY2026 as a rehearsal

Once the revised ESRS enter into force on 10 November 2026, they may be applied voluntarily to FY2026. A dry-run statement based on FY2026 data, reviewed by internal audit or an external provider, will expose gaps while there is still time to close them. Voluntary application in FY2026 does not start the clock on the transitional provisions, which run from the first year of mandatory reporting regardless of when the relevant member state transposes the amended CSRD (ESRS 1 (2026) paragraphs 121 and 122).

Prepare the board

Oversight of sustainability reporting should be assigned explicitly to the audit committee or a dedicated committee, with its terms of reference updated accordingly. Directors will benefit from training on double materiality, the ESRS and their responsibilities for the management report. Boards should also consider whether sustainability targets ought to feature in executive remuneration, a link that EFRAG analysed for the first time in its 2026 review.

Account for connected requirements

Several requirements sit alongside the ESRS. EU Taxonomy disclosures under Article 8 form part of the sustainability statement and fall within the scope of assurance, although ESRS (2026) allow them to be presented in a separate appendix. Digital tagging in XBRL is required by the CSRD but not yet mandatory in practice (see section 13), and should be discussed early with the provider of the annual report software. Climate is material for almost every company, and 69% of FY2025 reporters disclosed a transition plan. Work already completed for CDP, the ISSB standards (IFRS S1 and S2) and ESG ratings can be reused, since ESRS climate disclosures were designed to be largely interoperable with IFRS S2.

Invest in data and technology

KPMG found that companies in the most mature group were 4.2 times more likely than the least mature to use an integrated system for ESG data (KPMG). High-risk metrics in particular should move from spreadsheets to systems that retain a complete audit trail.

Want to see how Nossa Data can help you collect assurance-ready CSRD data? Contact solutions@nossadata.com to arrange a demo.

Manage the value chain cap from both directions

In-scope companies should design their supplier information requests around the voluntary standard. Where parts of the group themselves fall below 1,000 employees, it is equally important to understand which requests from customers they are entitled to decline.

A suggested roadmap for CSRD wave 2 companies

1. Q4 2026 to Q1 2027: double materiality assessment and gap analysis; first meeting with the assurance provider; governance arrangements and data ownership agreed.
2. Q1 to Q2 2027: data gaps closed; reporting manual and risk and control matrices prepared; dry run on FY2026 data.
3. Q2 to Q3 2027: internal audit pre-assurance review; interim review of the DMA and processes by the assurance provider.
4. Q4 2027: year-end data collection; draft statement; XBRL tagging if the rules apply by then.
5. Q1 to Q2 2028: limited assurance engagement; board approval; publication with the FY2027 management report.

How Nossa Data supports CSRD wave 2 preparation

Nossa Data is a sustainability reporting software provider that helps companies manage CSRD preparation and disclosure, from the first gap analysis through to the published statement. For Wave 2 companies, the platform supports the steps described in this guide:

• ESRS gap analysis. Map the ESRS datapoints to your material topics and see, with references to your existing reports, what is already disclosed and what is missing.
• Evidence and audit trail. Link each disclosure to its source document and page, so that your assurance provider can trace reported information back to its origin.
• Reuse of existing reporting. Build on work already completed for CDP, the S&P Global CSA, EcoVadis and ESG ratings, rather than collecting the same information twice.
• Ownership and review. Assign datapoints to owners, track progress and manage review and approval ahead of the assurance engagement.

Contact Nossa Data or email solutions@nossadata.com to discuss your CSRD wave 2 timeline or to arrange a demonstration.

Frequently asked questions

When do CSRD wave 2 companies have to report?

Wave 2 companies report on the 2027 financial year and publish their first sustainability statement in 2028, as part of the management report.

Which companies are in CSRD wave 2 after the Omnibus?

EU companies and groups with more than 1,000 employees and net turnover above EUR 450 million that were not already reporting as part of Wave 1.

Which standards will Wave 2 apply?

The revised ESRS adopted as Delegated Regulation (EU) 2026/1463, which enter into force on 10 November 2026 and apply to financial years beginning on or after 1 January 2027.

Will reasonable assurance still be required?

No. The Omnibus removed the planned move to reasonable assurance. Limited assurance remains mandatory.

Does the double materiality assessment have to be repeated every year?

Not under ESRS (2026), unless there has been a significant change in the business, its value chain or its circumstances. ESRS 1 (2026) paragraph 34 nonetheless requires companies to consider at each reporting date whether such a change has occurred, and to update the assessment to the extent the change requires.

What if our country has not yet transposed the CSRD?

The revised ESRS apply directly as a delegated regulation, so preparation can proceed. National law will determine matters such as who may provide assurance and the applicable penalties.

Is XBRL tagging required for CSRD reports yet?

Not yet. The CSRD requires sustainability statements to be marked up in Inline XBRL, but the obligation applies only once the Commission adopts ESMA's technical standards amending the ESEF Regulation. EFRAG expects to submit the final ESRS XBRL taxonomy at the end of 2026, and no application date has been set.

Sources

Regulators and standard setters

• Directive (EU) 2022/2464 (CSRD)
• Directive (EU) 2025/794 (stop-the-clock)
• Directive (EU) 2026/470 (Omnibus I)
• European Commission: delegated act on revised ESRS, C(2026) 5010
• EFRAG: ESRS implementation guidance (IG 1 to IG 3)
• EFRAG: 2026 Draft List of ESRS Datapoints (August 2026)
• EFRAG: Draft XBRL Taxonomy for the Revised ESRS (September 2026)
• EFRAG: Digital reporting with XBRL
• EFRAG: State of Play 2025 report
• EFRAG: State of Play 2026 report
• ESMA: Consultation paper on ESEF marking-up rules for sustainability reporting (December 2024)
• ESMA: Report on 2025 corporate reporting enforcement and regulatory activities (May 2026)
• AFM: CSRD assurance – four pillars for a robust approach (February 2026)
• CEAOB: Guidelines on limited assurance on sustainability reporting (September 2024)

Big 4 audit firms

• Deloitte IAS Plus: Commission publishes delegated act on simplified ESRS (2026)
• Deloitte: Unpacking the double materiality assessment (June 2024)
• Deloitte: Using the COSO framework to establish ICSR (April 2023)
• EY: EFRAG proposes major ESRS simplifications (January 2026)
• EY: EU Sustainability Developments, Issue 13 (March 2026)
• KPMG: The first wave of CSRD reporting (September 2025)
• KPMG: ESG Assurance Maturity Index 2025
• PwC: Sustainability reporting guide, chapters 1 to 5 (September 2026), including SRG 1.2.2.1, 2.3, 3.5, 3.7, 3.8, 4.4, 4.6 and 5.4
• PwC Viewpoint: Simplified ESRS – final delegated act adopted (2026)
• PwC Ireland: Eight CSRD double materiality pitfalls
• PwC Netherlands: Internal control over sustainability reporting