[00:00:00] Speaker A: Hi everyone. Sustainability reporting requirements have spawned a complex ecosystem of data gathering, measuring and analysis. But in this episode we'll look at how all that data could be doing more to drive the overall performance of businesses themselves. I'm your host Bill Coffin and this is the Ethicast.
Sustainability has been a pivotal aspect of business strategy over the last decade or more with the emergence of multiple reporting frameworks. The EU's Corporate Sustainability Reporting Directive requires broad ESG disclosures for any company with significant operations in Europe and is perhaps the global high watermark for sustainability reporting requirements.
And while the Trump administration's hostility to environmental regulation calls into question the future of standards, the such as the SEC's Climate Related Disclosure rules, which require publicly traded companies to disclose their climate related risks and opportunities, states like California have their own climate disclosure rules around greenhouse gas emissions, climate related financial risks and more.
Meanwhile, the International Sustainability Standards Board and the distinct but complementary reporting frameworks of the Global Reporting Initiative, Sustainability Accounting Standards Board and Task Force on Climate Related Financial Disclosures have all contributed to the pile for many organizations. The specter of not having sufficient sustainability data to meet this often bewildering overlap of regulatory and shareholder expectations has made sustainability reporting an end unto itself. Instead of a means of improving the environmental sustainability of business operations. What began as an effort to improve transparency, advance stakeholder trust, and drive better performance has become strangely inverted with with that last objective all but forgotten.
With us today to talk about how companies can shift their perspective on how to best use sustainability data is Craig Moss, Executive Vice President, Measurement at Ethisphere and Director at the Digital Supply Chain Institute. A prolific speaker and author, Craig recently published the article Sustainability Needs to Focus More on Doing and Less on Reporting with the Dow Jones Risk Journal. Craig, welcome back to the Ethicast.
[00:02:16] Speaker B: Hi Bill, it's great to be here. Love to talk to you about this kind of topic.
[00:02:20] Speaker A: You mentioned that by excessively focusing on reporting, companies actually create risk because they're constantly using their data to look backward into the past instead of drawing on past data to inform future improvement. I just thought that was a fascinating observation and I'd love to learn more. Can you expand on that?
[00:02:37] Speaker B: Fundamentally, if you think about it, the reports that are being generated, whether it's for regulatory purposes or the investor community that's always using historical data, right? And, and typically what they're doing with that is collecting the data and putting together a story about what has happened in the past.
I'm all for a reporting is a work is something that's necessary. I'M not saying that there should never be any reporting. I'm just saying that the focus needs to be a little more balanced between focus on getting the data to report, but also using the data to be able to look forward and to look into what could be done to drive improvement.
Too much of the focus, if you focus more just on the reporting requirements. I've been talking to a lot of companies and working with a lot of companies that actually have had to set up within their sustainability or compliance department.
They're actually setting up people whose sole job is to collect data to fill out reports.
In my opinion, that's not really the end game. The end game should be collecting the data to be able to analyze it, be able to look for areas that could be improved and then try to use it to drive improvement in both internally or in your supply chain. That really, to me, Bill, is the biggest difference here is of course you have to learn from the past and you do have to be able to show what you have been doing.
But I think that the future is really about looking forward and using the data to look forward.
[00:04:14] Speaker A: How would you recommend that companies begin the conversation internally to expand their own data reporting to performance measurement and improvement instead of focusing mainly on regulatory compliance? And second part of that question is are there any obstacles or roadblocks that you can imagine that E and C teams might have to account for when planning to have those conversations?
[00:04:36] Speaker B: Yeah, so there are a couple issues that come up here. So one is if you look across the spectrum of compliance and sustainability topics, there are a lot of different specific topics. Data privacy, social compliance and labor rights, environmental compliance, corruption, conflict of interest, trade sanctions. You go down this list of topics in a lot of organizations, they're already compartmentalized.
You'll have different people that have responsibility for data privacy than they do for social and environment.
I was actually working with one multinational company and we were working with them on environmental compliance and looking at carbon greenhouse gas emissions going through the process. We worked with them with the team pretty closely for several days.
And I said, well, how does this correlate with what you're doing on human rights in the supply chain?
And they paused and they said, I don't know, I don't know what we do on that area. And I said, well, who's in charge of that? They didn't even know who was in charge of that aspect of it. They're both supply chain related topics. They're both dealing with things that do need to be reported, yet they're so separate internally that there's not even any correlation or coordination between the two departments. That's an extreme case. But internally, what companies will need to do is they're going to need to accelerate cross functional collaboration.
And I've been talking about this for at least 15 years. You know that the need for compliance, for it really to take root in a company, for it to become embedded in how a company operates, there has to be improved cross functional collaboration.
You got the supply chain department, you've got sustainability, you've got legal, you've got compliance, you might have finance involved in it.
All of these departments historically speak a different language and they typically have different performance indicators, key performance indicators.
So companies are going to have to work on aligning the performance indicators a little more carefully so that there's not a conflict between one department and another.
Easy example, if I'm a supply chain person and part of my bonus is tied to on time delivery and you're the sustainability person and part of your job performance measurement is making sure that there's no excessive overtime in the factories we're using. We inherently have a conflict in what you're being evaluated on and what I'm being evaluated on.
That's something that senior management is going to have to take care of to make sure there aren't any inherent internal conflicts.
So that's one thing that's going to take place. Got to take place.
And then the other thing is, why would I take the time to get you the data you need when I'm busy?
Because I might be keeping data in a format and structure that isn't what you need. And you might come to me and say, hey, we've got to do this new CSRD report and I need the data in these fields. And I might look and say we don't keep it that way. So then what happens? Like there's tension there between whose time is it that goes into it, we need to pull it in. How does it involve? What if they have other projects? So a lot of it gets involved in internal alignment around these types of things.
And for that I believe that part of that is senior management's responsibility to try to embed these issues in the overall corporate strategy. Right. And don't be disreactive to regulations. Think of this as part of the corporate strategy. You know, how do we embed this in our strategy going forward? So those are a couple things that I think are important.
Getting the alignment right in terms of metrics, facilitating discussion and making sure that the data can actually flow in a relatively Seamless way.
[00:08:46] Speaker A: So Craig, in the article that I mentioned before, which I read, and it's a terrific piece and I recommend everybody check it out.
But in that article you bring up how supply chains play an important role in environmental and sustainability reporting because that data can be so difficult to gather. Now, in previous episodes on the Ethicast you've appeared and you've mentioned how AI is a transformative technology for supply chain risk management in general. So my question to you is, what role do you see AI as having in the transformation of reporting data from a purely compliance driven effort to more of a performance driving effort?
[00:09:22] Speaker B: I think there are a couple parts I'm going to break this question down a little bit. So the first part is if you think about supply chain, for every large company, they're going to have thousands or tens of thousands of suppliers.
And with those tens of thousands of suppliers, they have all those different compliance and sustainability topics. So I've got to be thinking about cybersecurity or data protection or GDPR data privacy or anti corruption or trade sanctions, or social and environmental topics with each of the suppliers. So one of the things I want to talk about here a little bit, and I've been doing work on this, is companies need to be thinking about residual risk, not inherent risk in their supply chain.
Basically what that means is if you have a supplier, the inherent risk is just the risk to you based on what they do, where they are and how they do it. So if I have a supplier in a certain country that has a high risk of forced labor, forced migrant labor, that's an inherent risk.
What we need to get is beyond that to look then at residual risk. Which means that we need to understand, does that supplier have the management systems in place to be able to reduce or mitigate the risk? Do they have a good way to check to see that people that are coming in are not being brought in through corrupt employment agencies or things like that? Are there passports being held? Whatever the specifics are in each of the risk topics, environment, social corruption, there are certain controls and systems that companies can put in place to reduce the risk.
So if you look at your suppliers, you want to be able to start thinking about the residual risk, not the inherent risk.
All companies located in country X do not pose the exact same risk to you. Some are going to have very mature controls, some are going to have immature controls. That's one thing companies need to be thinking about is shifting the perspective from inherent risk to this residual risk. Like what are they actually doing to manage the risk the next piece to this then is once you've done that and you start to understand that you probably can't do that to all tens of thousands of suppliers.
So what we believe and what we're working on now is we have some developed some very good residual risk assessment where we can look at the maturity of a company. So we look at the inherent risk of that company. For you, one of your suppliers we're looking at and then we look at their control maturity and then we can calculate their residual risk.
In the article for Dow Jones we started to talk about that and basically what I where I think AI comes in is you go from the 10,000, you pick 100 that you're going to do the more in depth due diligence on residual risk.
But then you start to use AI to do predictive analytics, to turn that funnel, the traditional funnel into an hourglass.
That's where data get use gets really interesting to me because then we're able to start to look at patterns and trends and do predictive analytics. So let's say in the hundred that we did, the more in depth due diligence on, let's say that we see in there that there is a lot of risk and it's really based on a lack of policies and training.
Suddenly that gives us some indications that we can look at the factors of those hundred. We can use AI to start to extrapolate about, look at what other companies have some of the same conditional situations and we can start then to look at are they also most likely to have weakness in policies and training.
So suddenly we can start to go from just finding out what's wrong to doing what I would call scalable remediation, to start to use AI also to create scalable remediation so that you can start to effectively reach back out to the 10,000 based on good data from the hundred and be able to extrapolate what the behavior is and start to feed them content that is practical for them to use to try to improve.
So suddenly we've shifted. We're using the data instead of the reporting being an endpoint. The reporting is part of a process of improvement. The reporting is still important. And I would never advocate companies shouldn't report.
I'm just advocating that companies need to go beyond reporting to be thinking about applications of the data to driving scalable improvement.
[00:14:13] Speaker A: Craig, I'm so glad that you came back on the Ethicast to talk with us today. Thank you so much for returning to the show.
[00:14:18] Speaker B: Always a pleasure, Bill. And I'm always happy to come back and join you again.
[00:14:22] Speaker A: Craig's article Sustainability Needs More Focus on Doing and Less on Reporting is available now at the Dow Jones Risk Journal. You can find a link to that article in the show Notes of this episode and reach out to Craig
[email protected] to learn how you can measure and improve your compliance and sustainability program, as well as that of your suppliers.
To learn more about how you can adapt your supply chain to the demands of the digital economy, go to the Digital Supply chain
[email protected] and for plenty of free resources on supply chain risk management, data measurement, regulatory compliance and more, Please visit the Ethisphere Resource center at ethisphere.com resources and finally, if you'd like to appear as a guest on this program to share an ethics and compliance best practice or success story, drop us a
[email protected] Ethicast thanks for joining us. We hope you've enjoyed the show. For new episodes each week, be sure to subscribe here on YouTube, Apple Podcasts, and Spotify. And if you don't mind, please share us with a colleague or two. It really helps us out.
That's all for now, but until next time, remember, strong ethics is good business.
