How Should Companies Build ESG Internal Controls? A Three-Line Defense Starting with Finance & Accounting
As sustainability disclosure regulations become increasingly stringent, ESG reporting is no longer “just about writing a good report.” It has evolved into a critical foundation for corporate integrity and risk management. In Taiwan, both the Financial Supervisory Commission (FSC) and the Taiwan Stock Exchange Corporation（TWSE) have recently made it clear that companies are expected to establish internal control mechanisms for sustainability information—to ensure accuracy and consistency in ESG disclosures.
However, in practice, many companies still struggle with one key question: Where do we begin when building an effective ESG internal control system?
In this article, we offer insights from a certified public accountant’s perspective, walking you through the three lines of ESG internal defense that every company should consider. Our goal is to help businesses establish a structured and auditable ESG information management framework—starting from the foundation.
However, in practice, many companies still struggle with one key question: Where do we begin when building an effective ESG internal control system?
In this article, we offer insights from a certified public accountant’s perspective, walking you through the three lines of ESG internal defense that every company should consider. Our goal is to help businesses establish a structured and auditable ESG information management framework—starting from the foundation.
1. Why Is ESG Internal Control So Important?
In today’s era of mandatory sustainability reporting, the credibility of ESG information has become a central concern for regulators, investors, and the market at large.According to Taiwan’s FSC “Sustainable Development Roadmap for Listed Companies 2.0,” the accuracy and consistency of ESG disclosures will become a key focus of future audits. Companies without a robust internal control system may face significant risks—including being flagged for inaccurate reporting, reputational damage, or even regulatory penalties.
Moreover, if ESG information isn’t effectively linked to financial data, it can hinder internal management and weaken the company’s competitiveness in ESG ratings, financing terms, and market trust.
Moreover, if ESG information isn’t effectively linked to financial data, it can hinder internal management and weaken the company’s competitiveness in ESG ratings, financing terms, and market trust.
Image source: FREEPIK
2. The Three Lines of ESG Internal Control for Companies
To help companies build a structured and reliable system for managing sustainability information, we recommend adopting a “Three Lines of Defense” framework—adapted from traditional internal control models.This approach ensures that data sources are traceable, processes are clearly defined, and information is accurate and verifiable, forming the foundation for a robust ESG internal control system.
2.1 First Line of Defense: Data-Producing Departments
The first line of ESG internal control lies in the departments that generate the raw data. For example:
- Production teams are responsible for recording greenhouse gas emissions
- HR tracks employee health and occupational safety statistics
- Legal manages governance structures and compliance documentation
In practice, however, the most common issues include inconsistent data formats, unclear calculation logic, and a lack of standardized procedures (SOPs)—all of which lead to heavy rework when it comes time to compile ESG reports.
Solution: Develop cross-departmental data recording guidelines and assign a dedicated point of contact responsible for compiling and validating ESG data.
Solution: Develop cross-departmental data recording guidelines and assign a dedicated point of contact responsible for compiling and validating ESG data.
2.2 Second Line of Defense: Finance and Risk Control Systems
The second line of defense lies in a company’s finance department and risk management mechanisms.
ESG information shouldn’t exist solely in a standalone report—it needs to be embedded into the company’s daily financial management and internal systems. Examples include:
ESG information shouldn’t exist solely in a standalone report—it needs to be embedded into the company’s daily financial management and internal systems. Examples include:
- Integrating carbon emission data into budgeting models and cost analysis
- Adding ESG-specific fields in the company’s ERP system
- Establishing sustainability KPIs tied to performance evaluation and incentives
By aligning ESG with financial systems, companies can ensure auditability and internal consistency, while also preparing for future material information disclosure requirements.
2.3 Third Line of Defense: Audit and External Assurance
The final line of defense consists of internal audit and third-party verification.
Companies can strengthen this layer by implementing the following measures:
Companies can strengthen this layer by implementing the following measures:
- Establishing an internal ESG audit process
- Engaging third-party accountants or assurance providers to conduct reasonableness testing
- Regularly reviewing internal systems to ensure ESG data collection and consolidation processes meet standards
By incorporating multi-layered audit mechanisms, companies can significantly reduce the risk of data errors or accusations of greenwashing—enhancing the credibility of ESG reports and building trust with the market.
Image source: FREEPIK
3. How to Launch Your ESG Internal Control System: A 3-Step Guide
Building an effective ESG internal control system doesn’t need to happen overnight. Companies are encouraged to start small and move forward step by step with the following approach:
- Map out current ESG data sources and process gaps:
Identify which departments are responsible for which data, and assess whether consistent standards for data recording are in place. - Design systems and assign clear responsibilities:
Establish cross-departmental collaboration mechanisms, and integrate ESG data fields into your ERP or accounting systems. - Introduce audit and assurance procedures:
Review ESG data flows on a regular basis, and align them with financial reporting to ensure transparency and market-verifiability.
4. Conclusion: Let ESG Data Become the Backbone of Your Business
In the age of sustainability, ESG disclosure is no longer just about regulatory compliance—it’s a signal of a company’s resilience and risk management maturity.While many companies spend significant time and resources preparing sustainability reports, they often overlook what matters most to the market, investors, and regulators: the credibility of the information.By building a robust internal control system—from data-producing departments, to finance and accounting structures, to audit and assurance procedures—companies can reduce the risks associated with inaccurate disclosures. More importantly, they can turn ESG data into a strategic asset for business decision-making and stakeholder communication.
An ESG report is not the finish line. It’s the starting point for sustainable governance and long-term value creation.
An ESG report is not the finish line. It’s the starting point for sustainable governance and long-term value creation.
Is your company ready to meet the new ESG challenges?
Hall Chadwick Taiwan has extensive experience in ESG financial consulting and can assist your company in building a sustainability reporting framework that aligns with the latest regulatory requirements.
If you have any questions regarding the 2025 ESG financial disclosure requirements, feel free to contact us.
If you have any questions regarding the 2025 ESG financial disclosure requirements, feel free to contact us.