ESG due diligence is the pre-deal and portfolio-level assessment of environmental, social, and governance factors that affect valuation, financing, and post-close liability. It answers a question the financial model cannot: which of this company's sustainability claims are backed by evidence, and what does the gap cost the buyer?
ESG diligence has stopped being a compliance box and started changing prices. Lenders set sustainability-linked margins off it, limited partners ask about it before committing, and insurers underwrite representations that depend on it. What usually fails is not the analysis but the evidence.
Running the review means putting permits, incident logs, supplier audits, and emissions workbooks in front of reviewers who should not all see the same material, since some of it is personal data and some of it is claims nobody has verified. A data room for ESG due diligence handles that with one link per party. Section 10 covers the setup.
ESG due diligence is a structured assessment of a target's environmental, social, and governance profile, commissioned by an acquirer, an investor, or a lender, and delivered as a report that converts sustainability findings into deal terms. It sits alongside financial, legal, commercial, and operational diligence rather than replacing any of them, and it is usually scoped after the letter of intent.
It matters commercially for three reasons. Debt is increasingly priced against sustainability performance targets, so a lender needs evidence the target can report the metrics the margin ratchet depends on. Limited partners ask for portfolio-level ESG data, so the acquirer inherits a reporting duty on the day it closes. And warranty insurers scrutinise sustainability representations, because a claim made in a marketing deck can end up as a warranty in the sale agreement.
Buyers routinely conflate ESG diligence with environmental due diligence, and the confusion causes real gaps. Environmental due diligence in its established sense is a site investigation: a Phase I environmental site assessment reviews records, walks the property, and interviews people to identify recognized environmental conditions, escalating to Phase II sampling only when something needs testing. ESG diligence asks a far wider set of questions, of which contamination is one, and covers labour conditions, supply chain human rights, board composition, bribery controls, and climate exposure that no site assessment touches.
So a buyer who commissions a Phase I and files it under ESG has covered roughly one of 12 domains. That is fine on a single-asset property deal, and not fine on an operating business, where the liabilities that surface after closing sit in the social and governance pillars rather than in the soil.
There is no universal ESG checklist, and treating one as universal is the most common scoping error in the workstream. What is material to a cold-chain logistics operator, meaning refrigerant leakage, driver hours, and fuel intensity, is close to irrelevant for a software business, where the material domains are data protection, workforce practices, and governance. A generic 200-line questionnaire produces a thick report and very little decision-useful information.
Serious reviews therefore begin with a materiality assessment, anchored to a sector standard such as the SASB standards now maintained under the ISSB. European targets in CSRD scope have often run a double materiality assessment already, looking both at how sustainability matters affect the company and at how the company affects people and the environment. Request it early, because any gap between their list of material topics and yours is itself a finding.
The domains below are the full scope that assessment selects from, four in each pillar.
| # | Pillar | Domain | What the reviewer checks |
|---|---|---|---|
| 1 | Environmental | Climate and GHG | Scope 1, 2 and 3 inventory, targets, verification |
| 2 | Environmental | Energy and resources | Energy intensity, water, waste, circularity |
| 3 | Environmental | Pollution and site liability | Permits, emissions, contamination history |
| 4 | Environmental | Nature and climate risk | Biodiversity, physical and transition risk |
| 5 | Social | Labour standards | Contracts, wages, working time, unions |
| 6 | Social | Health and safety | Incident rates, fatalities, inspections |
| 7 | Social | Supply chain and human rights | Supplier mapping, audits, modern slavery |
| 8 | Social | Workforce and community | Diversity data, turnover, community impact |
| 9 | Governance | Board and ownership | Composition, independence, beneficial owners |
| 10 | Governance | Ethics and anti-corruption | Anti-bribery controls, screening, sanctions |
| 11 | Governance | Whistleblowing and data | Speak-up channels, case log, GDPR posture |
| 12 | Governance | Tax and disclosure | Tax transparency, controls, external claims |
The governance pillar deserves more weight than it usually gets. Environmental findings are slow and quantifiable, social findings are slow and qualitative, but governance findings can end a deal in a week. An undisclosed related-party arrangement, a sanctioned counterparty, or a bribery allegation with no investigation record stops a process outright rather than adjusting a price.
Each domain becomes a folder of 10 to 80 documents, and two of them are dangerous to distribute, because workforce data and whistleblowing case logs contain personal data that under GDPR remains the seller's responsibility however it is shared.
Greenhouse gas accounting under the GHG Protocol splits emissions into three scopes, and each has a different evidence profile. Scope 1 is direct emissions from sources the company owns or controls, such as a truck fleet, a boiler, or refrigerant leakage. Scope 2 is indirect emissions from purchased electricity, heat, and steam. Both are verifiable from fuel cards, utility invoices, and service records, so a reviewer can test them in days.
Scope 3 is where the workstream stalls. It covers value chain emissions across 15 categories, eight upstream and seven downstream, including purchased goods and services, capital goods, transportation, business travel, use of sold products, and end-of-life treatment. For most companies outside heavy industry it is the overwhelming majority of the footprint, and it is the part that is estimated rather than measured. A target can present a confident-looking carbon total in which most of the tonnes come from a spend-based model.
That matters because a spend-based figure moves when procurement prices move, so an inflationary year can make a reported footprint rise while physical activity falls, and a reduction target set against that baseline becomes unmanageable. Ask category by category which method was used, what the emission factor source was, and what share of spend supplier-specific data covers. A restated emissions baseline is a red flag like a restated EBITDA.
There is also a legal ceiling on how much supplier data the target can be compelled to collect. Under Directive (EU) 2026/470, a company in CSRD scope cannot require sustainability information from a value chain partner with fewer than 1,000 employees beyond what the voluntary SME standard sets out, and where it asks for more it must say so and tell the partner it may refuse. A remediation plan built on demanding primary data from 400 small suppliers is therefore not a plan. The workable version prioritises the largest categories, contracts for data with the top suppliers by spend, and checks what has been externally assured and for which scopes.
The most expensive ESG finding is rarely a bad number. It is a good claim with nothing behind it. Sustainability language migrates from a marketing deck into an information memorandum, then a disclosure schedule, then a representation in the sale agreement. At that point an unverified claim has become a contractual liability that survives closing, and the insurer underwriting the warranty policy has priced it as though it were true.
The claims that cause trouble follow a pattern. Carbon neutral labels backed only by retired offsets with no reduction pathway. Recycled content percentages describing technical recyclability rather than actual recovery. Renewable electricity claims supported by unbundled certificates bought in a different market from where the power was used. Supplier code coverage stated as suppliers signed rather than audited.
Consumer protection regulators and courts in several European markets have moved against unsubstantiated environmental marketing, so the exposure is not only contractual. The practical test is to find the document proving each public claim and check it covers the same entity, period, and boundary.
Draft claims and offset contracts are worth restricting: view-only, watermarked, released to named reviewers.
Sellers resist this discipline because the claims are doing commercial work in the process. Buyers who do not insist end up owning the claim.
The European regime changed materially in early 2026, and diligence questionnaires written before that change now produce misleading answers. The Omnibus I Directive, Directive (EU) 2026/470, was published on 26 February 2026 and entered into force on 18 March 2026. It narrowed the Corporate Sustainability Reporting Directive so a company is in scope only if it has more than 1,000 full-time equivalent employees and more than €450 million in net annual turnover, with both tests met at once.
Timing shifted alongside scope. The earlier stop-the-clock measure pushed second-wave CSRD reporters back by two years, so their first reports are due in 2028 covering financial year 2027. The Corporate Sustainability Due Diligence Directive moved further: member states must adopt transposition measures by 26 July 2028 and apply them from 26 July 2029, with the Article 16 reporting requirement applying to financial years beginning on or after 1 January 2030. Full due diligence beyond direct business partners is now required only where plausible information suggests an adverse impact.
Two consequences follow for a live deal. A target that told you last year it was preparing for CSRD may now be out of scope, which changes what documentation exists rather than what risk exists, and EU Taxonomy reporting under Article 8 tracks the same revised scope. Commitments made to lenders and customers under the earlier regime did not expire when the directive changed, so private obligations are often stricter than public ones.
The fund-side rules matter for private equity buyers. SFDR classification under Article 8 and Article 9 still governs how funds describe sustainability characteristics and objectives, and principal adverse impact reporting rests on 18 mandatory indicators in Annex I of Delegated Regulation (EU) 2022/1288, covering greenhouse gas intensity, biodiversity, water and hazardous waste, UN Global Compact violations, gender pay gap, and board gender diversity, alongside 46 optional ones. The revision known as SFDR 2.0 would replace those labels with named product categories, but the text remains in trilogue after the Council agreed its mandate on 24 June 2026.
Germany's LkSG has meanwhile been wound back: the reporting obligation was removed, BAFA stopped reviewing compliance reports from 1 October 2025, and enforcement is suspended other than for grave human rights violations, though the duties still sit in supplier contracts signed while the act was in force. Globally, the ISSB standards IFRS S1 and IFRS S2 are consolidating into the common baseline, adopted in 28 jurisdictions as of April 2026 with a further 12 planning to.
An ESG finding is only useful once it has been priced or converted into an obligation, and the choice of remedy depends on whether the exposure is quantified, quantifiable, or open-ended. A quantified cost becomes a price adjustment. A quantifiable but uncertain cost becomes an escrow or a specific indemnity. An exposure that must be fixed before the buyer will own it becomes a condition precedent. Everything else becomes a dated action in the post-close plan.
Sellers push hard against conditions precedent because they introduce closing risk, so reserve them for findings where ownership itself is the problem: an unqualified carbon neutrality claim still in market, an unlicensed discharge, a supplier under forced labour investigation. The pattern below is that environmental findings attract money and governance findings attract conditions, because money cannot cure an integrity issue.
| Finding | How it surfaces | Commercial remedy |
|---|---|---|
| Scope 3 largely spend-based | Methodology note shows estimates dominate the total | Post-close plan with supplier data contracts |
| Carbon neutral claim backed only by offsets | No reduction pathway behind the label | Condition precedent to withdraw or qualify it |
| Refrigerant or emissions permit gaps | Monitoring data against permit conditions | Price adjustment sized to the compliance quote |
| Unaudited tier two suppliers in a high-risk region | Supplier map with audit coverage by tier | Specific indemnity, the exposure being unquantified |
| Incident rate above the sector norm | Incident log and inspections over 3 years | Escrow plus a dated remediation programme |
| No functioning whistleblowing channel | Empty case log against headcount | Condition precedent, then governance action |
| Related-party arrangements undisclosed | Board minutes against the related-party register | Renegotiation or withdrawal, depending on severity |
The 100-day plan is where most ESG value gets created, and it should be drafted during diligence rather than after closing. The version that works is short: eight to ten actions, each with a named owner, a cost, and a date, sequenced so the reporting foundation comes first. That means a verified Scope 1 and Scope 2 baseline in month one, policy and governance gaps closed in month two, and supplier engagement started in month three, because supplier data has the longest lead time.
Value creation follows from the same list: energy intensity work pays back directly, safety improvement reduces insurance and lost time, and a credible baseline is what makes a sustainability-linked facility available at all. Our guide to private equity due diligence covers how this fits the fund workflow.
ESG diligence usually runs in four stages across four to eight weeks on a mid-market deal, in parallel with financial and commercial work. Materiality scoping takes a few days and determines everything downstream, desktop review covers what the seller has published, document requests and interviews follow, and site visits happen only where the material domains require them.
The work is split across specialists rather than one firm. A sustainability advisory practice or the ESG team of an accounting firm leads, environmental engineers handle site assessments and permits, employment counsel handles labour matters as a separate engagement because the material is personal data, and a screening firm covers sanctions and forced labour checks.
That fragmentation is the operational problem. One project manager at an energy infrastructure business in Poland ran a site M&A process with more than 100 internal users and three to four investors, each bringing around 20 advisers across legal, technical, and tax, so the same permit file gets requested three times by parties who cannot see each other.
One link per advisory team keeps each reviewer in a different view of the same document set.
Sell-side teams increasingly commission vendor ESG diligence before launching a process, which is worth the money when the asset has a genuine sustainability story and a poor evidence trail. Appointing advisers three to six months before an exit leaves time to fix what the report finds.
A mid-market private equity fund agrees to acquire Kesterlund Logistik, a Nordic contract logistics and cold-chain operator with €140M of revenue, 1,900 employees, and 34 depots. The fund's limited partners require portfolio-level emissions reporting, so ESG diligence is scoped in week one alongside financial work.
Scope 1 and Scope 2 come back quickly. The diesel fleet and refrigerant losses account for 41,000 tonnes of CO2 equivalent and purchased electricity for another 3,200, all traceable to fuel cards, utility invoices, and service records. Scope 3 is the problem. Of the 15 value chain categories, only 4 are built from supplier-specific data, 8 are spend-based estimates, and 3 are not calculated at all.
Worked scenario. The 8 spend-based categories are the ones that move with procurement prices, which is why the reduction target is rebaselined before it goes into the lender documents.
Three further findings shape the deal. Two tiers of subcontracted hauliers, covering roughly a fifth of delivered volume, have never been audited against the supplier code. Three of the 34 depots show ammonia refrigerant handling gaps against permit conditions, quoted at €610,000 to fix. And the website carries a carbon neutral delivery claim supported entirely by retired offsets.
The outcomes split as the earlier table predicts. The refrigerant work becomes a €610,000 price adjustment. The unaudited haulier tiers become a specific indemnity, because the exposure cannot be bounded until the audits run. The carbon neutral claim is withdrawn as a condition precedent, which the seller accepts once counsel confirms it would otherwise be warranted. Everything else lands in a nine-action 100-day plan owned by the incoming CFO.
The most common mistake is scoping from a template rather than from a materiality assessment. A universal checklist applied to a software company produces 60 pages about water and waste and misses the data protection exposure that matters, while the same checklist applied to a food processor gives equal weight to board diversity and to a wastewater permit that could close a plant.
The second is accepting a carbon number without asking how it was built, since a total with no methodology note, no boundary statement, and no split between measured and estimated data is a marketing figure rather than an inventory. The third is treating ESG ratings as evidence, when ratings are built largely from public disclosure, so a company that publishes nothing scores poorly regardless of what it does. The fourth is sharing ESG material carelessly, because workforce data, whistleblowing logs, and incident records contain personal data, and forwarding them to an adviser, a lender, and an insurer is a data protection problem for the seller. Our data room checklist and our M&A due diligence checklist cover how ESG slots into the wider request list.
On cost, ESG review is priced as a workstream rather than a standalone report, and it scopes much like operational diligence: roughly $15,000 to $30,000 for a small company, $30,000 to $75,000 for a mid-sized business, and $75,000 to $200,000 for a large or multi-site enterprise. Site work is priced separately, where a Phase I environmental site assessment runs $2,000 to $6,000 per site and a Phase II runs $10,000 to $100,000. For how this fits the total bill, see our breakdown of due diligence cost.
What moves the number is the count of sites and jurisdictions, whether the supply chain reaches high-risk regions, and above all the quality of the target's documentation. A target that already reports under a recognised framework can be reviewed in three weeks.
A data room for ESG due diligence is not the same artifact as the one finance uses. The financial folder holds numbers that are commercially sensitive but internally consistent. The ESG folders hold personal data, unverified claims, regulatory correspondence, and evidence arriving from a dozen owners over several weeks.
The other difference is duration. A financial model stops mattering the day the deal closes, while ESG evidence keeps mattering, because the buyer reports against it, a lender tests it annually, and an exit buyer asks for it in four years.
Papermark is a secure, fully customizable, and developer-friendly data room built for modern dealmakers, with page-by-page analytics, dynamic watermarking, and transparent pricing (open-source and self-hosting available).
An ESG due diligence data room with one folder per domain, so permissions differ by folder rather than by document.
Most ESG diligence still runs over email and shared drives, and it is the workstream where that habit creates the most legal exposure, because much of the material is personal data. There are four reasons a dedicated data room for ESG due diligence earns its place. If you are still choosing a platform, our comparison of the best virtual data rooms covers pricing model, bidder management, and compliance.
Part of the evidence is personal data. Workforce records, pay gap analyses, incident logs, and whistleblowing case files describe identifiable people, and the seller stays responsible for how they are processed no matter who asked. Emailing that material to an adviser, a lender, and an insurer creates a data protection exposure whether or not the deal completes. A room keeps those folders view-only, restricted to a named allowlist, and evidenced by an access log.
Five kinds of reviewer need five different views. The ESG adviser needs everything material, employment counsel needs the labour and workforce folders and nothing else, the lender's sustainability team needs the emissions inventory and targets, and the insurer needs the claims folder. A shared drive gives you one permission set. A data room for ESG due diligence gives you one per link over the same documents.
Evidence arrives in waves from many owners. ESG documentation does not sit in one system. The permits are with the plant manager, the incident log with the safety team, the supplier audits with procurement, and the emissions workbook with whoever built it. Requests come back in rounds, and across 40 or 50 questions an email thread loses track of which are still open.
The record has to outlive the deal. When a claim is challenged, a lender tests a covenant, or an exit buyer runs its own review years later, the question is what was disclosed, to whom, and when. A room with a per-visitor audit log and an immutable archive answers that precisely, and reconstructing it from mailboxes is not realistic.
The rest of this section is the practical setup: five steps to build a data room for ESG due diligence that handles all four.
Create one folder per domain from the matrix in section 2, grouped under the three pillars, and put the materiality assessment at the top level so every reviewer starts from the same view of what matters. That structure is what makes differentiated access possible later, because a flat pile of 300 files forces you to choose between giving everyone everything and hand-picking documents per reviewer. Upload in bulk by dragging the folder tree in, and automatic file indexing on the Data Rooms Plus plan maintains the index as documents arrive in waves.
This is where an ESG room differs most from a financial one, because two folders should never reach most people in the process.
| Reviewer | Folders granted | Rights |
|---|---|---|
| Buyer's ESG adviser | All material domains across the three pillars | View and download |
| Employment counsel | Labour, health and safety, workforce data | View only, watermarked |
| Lender sustainability team | Emissions inventory, targets, assurance letters | View only |
| W&I insurer | External claims, disclosure schedule support | View only, watermarked |
| Environmental engineer | Permits, monitoring data, site assessments | View and download |
Granular file-level permissions are set per link rather than per user, so each party gets its own link carrying its own folder scope, email allowlist / domain restriction, and download rule. Access is link-based, so no reviewer has to create an account, which removes the friction that makes busy advisers go back to asking for files by email.
Permissions are set per link, so employment counsel and the lender's sustainability team see different folders of the same room.
Switch the workforce, whistleblowing, and draft claims folders to view-only and turn on dynamic watermarking, which stamps every page with the viewer's email, IP address, and timestamp as it renders. Screenshot protection adds a deterrent on incident logs and offset contracts, and email verification confirms the person opening the document is the person you invited.
The honest limit is worth stating: a downloaded file is legally treated as read, and no platform can recall it. That is why download is disabled rather than discouraged here, and why watermarking makes a leak traceable to a named viewer.
Watermark configuration controls what appears on each page: viewer email, IP address, and timestamp.
ESG requests arrive in rounds. The reviewer reads the emissions methodology note, asks for the three supplier data agreements it references, then asks who signed the assurance letter. Run over email, that thread fragments across the safety manager, procurement, the CFO, and two advisers, and nobody can say which of 50 questions is still open.
The Q&A module attaches each question to the document that prompted it, with permissions controlling who sees which threads, so the lender never sees employment counsel's questions. The log exports for the closing file, which matters because it is often the clearest evidence of what the seller told the buyer about a claim.
Page-level analytics show which reviewer opened which document, when, and for how long. In ESG diligence that is a scoping signal: an adviser who has spent forty minutes in the supplier audit folder has found something, usually a week before the report says so.
Per-visitor analytics show which ESG documents each reviewer opened and for how long.
After closing, data room freeze makes the room immutable and exports it as an archived ZIP with a certificate, and the audit log turns a general assurance into a dated, per-visitor fact. When a claim is challenged or an exit buyer runs its own review four years later, that archive is the record of what was disclosed and to whom.
Papermark is our #1 VDR provider for M&A transactions right now. In two deals we used custom branding, dynamic watermarking, and granular permissions.
Tyler
The Data Rooms plan is €99/month with a 7-day free trial and includes 3 team members, unlimited data room visitors, unlimited data rooms, unlimited documents, custom domain, dynamic watermarking, NDA agreements, and granular file-level permissions. Data Rooms Plus at €249/month adds 5 team members, the Q&A module, the audit log, automatic file indexing, and SOC 2 Type II. Premium at €549/month adds 10 team members, AI redaction, the public API, SSO, and whitelabeling, which is the plan funds pick for portfolio-wide ESG reviews. Data Rooms Unlimited at €999/month removes per-seat charges entirely, so teams that add reviewers mid-deal pay one number regardless of headcount, and it carries every Premium capability including AI redaction. Unlimited data rooms under one subscription means one room per target with no per-project fee.
No credit card required.
How the M&A due diligence process works in 2026. Seven phases, a citable checklist, red flags, document categories, and the data room setup buyers expect.
IT due diligence in 2026: the 8-domain checklist, the licence trap that costs buyers most, TSA timelines, and how to run it in a data room for IT due diligence.
SaaS due diligence in 2026: the 9 metrics buyers verify, the ARR trap that cuts valuations, and how to run the review in a data room for SaaS due diligence.
