- An ESG framework is a short list you run yourself. It sets which environmental, social and governance issues you measure and report, how each is counted, and who owns it. A rating, by contrast, is an outside agency's opinion of you.
- Choose a reporting standard before buying software. The standard depends on who asks for the report. Kenyan public interest entities must use IFRS S1 and S2 for financial years beginning on or after 1 January 2027; private companies follow their lender or customer.
- Follow the seven steps in order. Decide which issues matter, measure where you stand, give each issue an owner, collect data as part of normal work, set a few firm targets, check your suppliers, then publish and have the report independently checked.
- Measurement is where most organizations fall short. ICPAK scored 385 Kenyan public interest entities 1.51 out of 4 on readiness, weakest on metrics and targets. Globally, 57% of executives in a Deloitte survey named data quality their biggest ESG data challenge.
- You do not need a sustainability department. Pick three issues, use the records you already keep, and train the finance and procurement staff you have.
Most ESG programs that fail do so at the same point, and it is not the ambition. It comes when an auditor, lender or regulator asks where a reported figure came from, such as last year's carbon emissions or the share of women in management, and the answer involves a spreadsheet, a colleague who has since left, and an estimate nobody can rebuild. The targets were usually fine. What was missing was the routine record-keeping that turns a commitment into a figure someone else can check.
A mistake we keep meeting in East African organizations is doing this in the wrong order. They announce a commitment, work backward to a framework, and only then find that nothing in the business produces the data the framework expects. Putting the order right usually costs a year.
Kenya is about to test this at scale. From 1 January 2027, public interest entities, which include listed companies, banks, insurers, pension schemes and deposit-taking SACCOs, must report under the IFRS sustainability standards. When the Institute of Certified Public Accountants of Kenya (ICPAK) assessed 385 of them in 2026, three in four were at the two lowest of its four readiness levels. This article explains what an ESG framework is and how to build one in seven steps, starting with deciding which issues matter to your business and ending with having your report independently checked.
What an ESG Framework Is
An ESG framework is not a strategy, a values statement or a rating. It is the set of decisions about which environmental, social and governance issues your organization will measure, manage and report on, and how each one is defined and counted. In practice it comes down to a short list: the issues that matter to your business, a definition and an owner for each, and a method for collecting the numbers.
A rating and a framework are easy to confuse, but they come from opposite sides:
- An ESG rating is an outside agency's opinion of your company. The agency builds it from whatever you have published and scores it by its own method, which you do not control, so different agencies often reach widely differing ratings of the same company.
- An ESG framework is something you run yourself. You decide what to measure, how to measure it, and who is responsible for each number.
The two can disagree. You can run a good framework and still get a mediocre rating, often because the agency could not find what you published. When that happens, resist writing next year's report for the rating agencies. Write it for the lenders, customers and regulators who are directly affected by how you manage these issues.
Two points about that diagram before you build on it:
- It is a menu, not a checklist. No organization manages all eighteen items, and one that claims to is reporting on them, not managing them.
- Governance holds up the other two. The diagram draws it as one column of three, but in practice it sits underneath environmental and social. Goals that nobody is accountable for are only intentions.
Choosing a Reporting Standard
A reporting standard is the rulebook for an ESG report: it sets out what to disclose and how to measure it. The best known are the IFRS sustainability standards, S1 and S2, and the GRI Standards. Choose yours before you buy any reporting software. Software is set up around a particular standard, so choosing the standard afterwards means setting it up twice, which makes this the most expensive mistake in ESG implementation.
The choice is usually narrower than software vendors suggest, because it depends on who is asking for the report:
- Kenyan public interest entities. The choice is made for you. ICPAK's adoption roadmap makes IFRS S1 (general sustainability disclosures) and IFRS S2 (climate disclosures) mandatory for accounting periods beginning on or after 1 January 2027. Large companies outside that group follow in 2028 and smaller ones in 2029.
- Private companies. The standard is set by whoever wants the report: a lender, a development finance institution, or a large customer checking its suppliers. Ask them what they will accept before you decide what to build.
- Suppliers to European companies. The EU's simplification package, in force since 18 March 2026, limits mandatory reporting to companies with more than 1,000 employees and over €450 million in turnover, so fewer of your European customers fall under the rules. It also lets companies with up to 1,000 employees refuse information requests beyond a voluntary reporting standard.
For everyone in between, a practical rule: build to the most demanding requirement you can name today, and no further. Reporting systems built for a standard nobody has asked for are where we see the most ESG money wasted.
The Seven Implementation Steps in Order
These are the seven steps to building an ESG framework, in the order they need to happen. Each one depends on the one before it, so skipping ahead, for example by setting targets before you know where you stand, means doing the work twice.
1. Run a materiality assessment that rules things out
A materiality assessment decides which ESG issues matter enough to your business to manage and report. An issue is material if it could plausibly affect your financial results or your ability to keep operating, whether through regulators, customers, lenders or the communities around your sites. List the candidates, rank them, and write down why each one made the cut or missed it.
Then test the result: could a competitor publish your list unchanged? If so, you have described your industry, not your company. Talk to lenders, major customers, regulators and operations staff. The people who already write the sustainability report are the least likely to tell you what is missing.
2. Measure a baseline before setting targets
A baseline is where you stand today on each material issue, measured the same way you will later measure progress. Record at least one full year before committing to a public number. Targets set without a baseline are guesses, and they are the ones that get quietly revised two years later.
3. Give each issue an owner with budget authority
Every material issue needs one named person who controls at least one budget or decision the number depends on. If the owner has no say over what drives the number, it will be reported accurately and never improve. Kenyan data points at this step too. ICPAK's readiness report scored entities from 0 to 4 on each of 49 disclosure requirements, with 3 and above counting as advanced. Linking managers' incentives to sustainability targets averaged 1.15, among the lowest of all 49: most entities are only beginning to tie anyone's rewards to these targets.
4. Collect the data as part of normal work
Decide how each number will be produced in the course of ordinary operations, rather than assembled at year end. Most of the raw material already exists in meter readings, fuel purchases, payroll and procurement records. What fails an independent check is data gathered once a year by asking people to remember what happened in March.
5. Set a few targets you can be held to
Three or four targets, each with a date, an owner and a stated method, will move an organization further than a page of aspirations. Each should say what it leaves out, because exclusions are the first thing a reviewer asks about.
6. Extend the work into your supply chain
Your ESG record includes how your suppliers operate, not just how you do. A lender, buyer or regulator can ask about all three columns in your supply chain:
- Environmental: the emissions, water use and waste that come from making what you buy.
- Social: whether suppliers pay fair wages, keep workers safe, and use no child or forced labor.
- Governance: whether suppliers avoid bribery and corruption, and whether you pay them on fair terms.
Emissions get the most attention because reporting rules are strictest there: IFRS S2 asks for supply chain emissions. The GHG Protocol, the method most companies use to count them, sorts emissions into three scopes:
- Scope 1: emissions from sources you own or control, mostly the fuel burned in your vehicles, generators and boilers.
- Scope 2: emissions from generating the electricity you buy.
- Scope 3: everything else in your value chain, from what your suppliers produce to how customers use and dispose of your products.
CDP's review of 2023 corporate disclosures found that companies' supply chain emissions were, on average, 26 times the emissions from their own operations. A framework that stops at the factory gate measures the smallest part of the footprint, so the supply chain is where an emissions target is won or lost.
Source: CDP, Corporates' Supply Chain Scope 3 Emissions Are 26 Times Higher Than Their Operational Emissions
In Kenya, supply chains are hard to see. The Kenya National Bureau of Statistics counted 18.1 million of the country's 21.6 million recorded jobs in 2025 as informal, not counting small-scale farming. Many of your suppliers' suppliers are therefore small businesses that keep few written records. Start with the suppliers that account for the most spending or the most risk, and check them on all three columns, not just emissions. The easiest ones to survey are rarely either.
7. Publish, then have it checked independently
Publish against the standard you chose at the start. Whether the report is public depends on who requires it. For Kenyan public interest entities it is: the IFRS standards require the disclosures to be published as part of the annual financial report, at the same time as the financial statements. A private company reporting to a lender or customer can share it with them alone.
Either way, have an independent party review at least the disclosures you are most exposed on. That review, called assurance, is what turns an ESG report from a communications document into a governance one. It also tells you which of the first six steps you did badly.
Building an ESG framework without a department to run it?
Our Strategic Planning program works with leadership teams on exactly this sequence: materiality, ownership, data discipline, and reporting that holds up when somebody independent checks it. Request a proposal.
The Data Quality Problem
The trouble usually starts with the data itself. Deloitte's 2024 Sustainability Action Report surveyed 300 executives at public companies with at least $500 million in annual revenue. Data quality was the biggest challenge with ESG data for 57% of them and a top-three challenge for 88%. Only 15% reported Scope 3 emissions, against 74% for Scope 1.
Deloitte found a second bottleneck behind data quality: 81% of executives named documentation and sign-off, meaning the review and approval of ESG figures, as a top reporting challenge. That is a controls problem, the same one finance teams solved for financial reporting long ago, and the people who solved it are usually already on the payroll.
Kenyan data shows the same pattern. In 2026, ICPAK asked Kenya's public interest entities to assess themselves against IFRS S1 and S2, and scored the 385 complete answers on the four areas the standards cover: governance, strategy, risk management, and metrics and targets. The results, published in ICPAK's Kenya IFRS S1 & S2 Readiness Report:
- Overall: an average of 1.51 out of 4.
- Spread: 289 entities (75%) sat in the two lowest bands, and only 23 (6%) had reached the highest.
- By area: governance scored highest at 1.60 and metrics and targets lowest at 1.22.
Average IFRS S1 and S2 Readiness Score by Area, Kenyan Public Interest Entities, 2026
385 entities scored on a 0 to 4 scale. Source: ICPAK, Kenya IFRS S1 & S2 Readiness Report, 2026 edition
Governance 1.60, risk management 1.49, strategy 1.41, metrics and targets 1.22. National average 1.51.
Scores are averages on ICPAK's 0 to 4 scale, not percentages. The dashed line at 2.0 is where ICPAK's "Developing" band begins.
Put simply, boards are naming people to oversee sustainability faster than companies are building the means to measure it.
In a lighter pulse survey of 95 entities in November 2024, ICPAK found 69.5% expecting to be ready for IFRS S1 and S2 by 2026. Its 2026 assessment put 25% at the two upper readiness levels. ICPAK cautions that the surveys are not a like-for-like trend, but the planning lesson holds: readiness takes longer than intent suggests.
Source: ICPAK, Kenya IFRS S1 & S2 Readiness Report, 2026 Edition
Implementing Without a Sustainability Department
Many Kenyan organizations building an ESG framework do not have a sustainability team. They have a finance manager, an operations manager, and a chief executive who has been asked for an ESG report by a lender or a customer. That is enough to start, if you do three things.
Limit the scope to three issues
A small organization that measures energy, water and supplier conditions properly is in a stronger position than a large one measuring forty things badly. Depth holds up when someone checks. Breadth does not.
Use the records you already keep
Utility bills, fuel receipts, payroll and procurement records are already reliable data. The work is deciding what counts and recording it the same way every month, which is a habit rather than a purchase.
Train the people you have
You need a finance manager who can do basic carbon accounting and a procurement lead who can run a supplier review. Both are training problems rather than hiring problems.
Three Common ESG Implementation Mistakes
Buying the platform first
Software is bought before the standard is chosen, then set up against a requirement that later changes. Produce the numbers by hand for one cycle first, and buy software to remove the manual work rather than to define it.
Treating everything as material
The materiality assessment returns fourteen issues because nobody wanted to tell a stakeholder their concern did not make the cut, and the program spreads too thin to move any of them. Research from NYU Stern's Center for Sustainable Business, published in Stanford Social Innovation Review, points the same way: the financial gains from ESG show up when companies focus on the factors that are material to their own business.
Announcing before measuring
A public commitment is made before a baseline exists, usually because a conference or an annual report needed something to say. The program then spends years managing the gap between that number and reality instead of the issue itself.
Frequently Asked Questions
What is an ESG framework?
It is the set of decisions about which environmental, social and governance issues your organization will measure, manage and report on, and how each one is defined and counted. In practice it is a short list: the issues that matter to your business, a definition and an owner for each, and a method for collecting the numbers. It is not a rating. A rating is an outside agency's opinion of your company, built from what you publish, and a good framework can still earn a mediocre one if the agency cannot find your report.
What are the seven steps to implement an ESG framework?
In this order: run a materiality assessment that rules things out; measure a baseline for at least a year before setting public targets; give each issue an owner who controls a relevant budget; collect the data as part of normal work rather than at year end; set three or four firm targets that state what they exclude; check your suppliers' environmental, social and governance record, starting with those that account for the most spending or risk; then publish against your chosen standard and have the most exposed disclosures independently checked.
Which ESG reporting standard should we use?
It depends on who wants the report, so the choice is usually narrower than software vendors suggest. Kenyan public interest entities, including listed companies, banks, insurers and pension schemes, must report under IFRS S1 and S2 for financial years beginning on or after 1 January 2027, under ICPAK's roadmap. Private companies should ask their lender, development finance institution or large customer what they will accept. A supplier to a large European company can decline requests beyond a voluntary standard if it has up to 1,000 employees. Build to the most demanding requirement you can name, and no further.
Why do so many ESG implementations stall?
Usually because of measurement, not ambition. In Deloitte's 2024 survey of 300 executives, 57% named data quality as their biggest ESG data challenge, and only 15% reported their supply chain (Scope 3) emissions. ICPAK's 2026 assessment of 385 Kenyan public interest entities found the same gap: on a 0 to 4 readiness scale, governance averaged 1.60 and metrics and targets 1.22. The other common causes are buying software before choosing a standard, treating every issue as material, and announcing targets before measuring a baseline.
Can a company implement ESG without a sustainability department?
Yes, by keeping the scope narrow and the records consistent. An organization that measures energy, water and supplier conditions properly is in a stronger position than one measuring forty things badly, because depth holds up when someone checks. Utility bills, fuel receipts, payroll and procurement records are reliable data that already exists. The skills needed are a finance manager who can do basic carbon accounting and a procurement lead who can run a supplier review.
What is a materiality assessment and how do you know yours is any good?
It is the exercise of deciding which ESG issues could plausibly affect your financial results or your ability to keep operating, ranking them, and recording why each one made the cut or missed it. The test is whether a competitor could publish your list unchanged. If it could, you have described your industry rather than your company. An assessment that rules nothing out has not really been done.
Conclusion
The useful way to budget this is to treat the first year as a record-keeping project and the second as a reporting one. Organizations that spend early money on measurement and later money on presentation end up with reports they can stand behind. Those that reverse the order spend the second year rebuilding the first, usually after a reviewer asks a question nobody prepared for.
Pick the ESG figure your organization is proudest of. Could the person who owns it show an outsider, line by line, where it came from?
If you are working out where to start, or restarting a program that stalled, our Strategic Planning program is built for it. Request a proposal and we will work through the sequence with your team.
