---
title: "ESG due diligence in 2026: why Scope 3 data breaks most deals"
lang: en
canonical_url: https://www.papermark.com/blog/esg-due-diligence
last_updated: 2026-08-20
published: 2026-08-20
category: [mergers-and-acquisitions]
author: "Marc Seitz"
summary: "ESG due diligence in 2026: the 12-domain scope, the Scope 3 evidence trap, CSRD and CSDDD timing, review costs, and the data room for ESG due diligence."
---

# ESG due diligence in 2026: why Scope 3 data breaks most deals

ESG due diligence is the pre-deal and portfolio-level assessment of environmental, social, and governance factors that affect valuation, financing, and post-close liability. It answers a question the financial model cannot: which of this company's sustainability claims are backed by evidence, and what does the gap cost the buyer?

## Quick recap

- ESG due diligence covers three pillars, environmental, social, and governance, organised into about 12 domains.
- It is broader than environmental due diligence, which in its narrow sense means a Phase I environmental site assessment for contamination under ASTM E1527-21.
- Greenhouse gas reporting follows the GHG Protocol split of Scope 1, Scope 2, and Scope 3, and Scope 3 alone has 15 value chain categories.
- Directive (EU) 2026/470 entered into force on 18 March 2026 and narrowed CSRD scope to companies with more than 1,000 employees and more than €450 million net turnover.
- Member states must transpose the CSDDD by 26 July 2028 and apply it from 26 July 2029, with Article 16 reporting applying to financial years starting on or after 1 January 2030.
- SFDR principal adverse impact reporting rests on 18 mandatory indicators in Annex I of Delegated Regulation (EU) 2022/1288, plus 46 optional ones.
- As of April 2026, 28 jurisdictions had adopted the ISSB standards IFRS S1 and IFRS S2, with a further 12 planning to.
- ESG review scopes like operational diligence: $15,000 to $30,000 for a small company, $30,000 to $75,000 mid-market, and $75,000 to $200,000 for a large enterprise.
- A data room for ESG due diligence keeps unverified claims, personal data, and incident records scoped to the right reviewers, and Papermark hosts one from €99/month.

ESG diligence has stopped being a compliance box and started changing prices. Lenders set sustainability-linked margins off it, limited partners ask about it before committing, and insurers underwrite representations that depend on it. What usually fails is not the analysis but the evidence.

Running the review means putting permits, incident logs, supplier audits, and emissions workbooks in front of reviewers who should not all see the same material, since some of it is personal data and some of it is claims nobody has verified. A **data room for ESG due diligence** handles that with one link per party. Section 10 covers the setup.

## 1. What is ESG due diligence?

ESG due diligence is a structured assessment of a target's environmental, social, and governance profile, commissioned by an acquirer, an investor, or a lender, and delivered as a report that converts sustainability findings into deal terms. It sits alongside financial, legal, commercial, and operational diligence rather than replacing any of them, and it is usually scoped after the letter of intent.

It matters commercially for three reasons. Debt is increasingly priced against sustainability performance targets, so a lender needs evidence the target can report the metrics the margin ratchet depends on. Limited partners ask for portfolio-level ESG data, so the acquirer inherits a reporting duty on the day it closes. And warranty insurers scrutinise sustainability representations, because a claim made in a marketing deck can end up as a warranty in the sale agreement.

Buyers routinely conflate ESG diligence with [environmental due diligence](/blog/environmental-due-diligence.md), and the confusion causes real gaps. Environmental due diligence in its established sense is a site investigation: a Phase I environmental site assessment reviews records, walks the property, and interviews people to identify recognized environmental conditions, escalating to Phase II sampling only when something needs testing. ESG diligence asks a far wider set of questions, of which contamination is one, and covers labour conditions, supply chain human rights, board composition, bribery controls, and climate exposure that no site assessment touches.

So a buyer who commissions a Phase I and files it under ESG has covered roughly one of 12 domains. That is fine on a single-asset property deal, and not fine on an operating business, where the liabilities that surface after closing sit in the social and governance pillars rather than in the soil.

## 2. Materiality and the 12 domains of an ESG review

There is no universal ESG checklist, and treating one as universal is the most common scoping error in the workstream. What is material to a cold-chain logistics operator, meaning refrigerant leakage, driver hours, and fuel intensity, is close to irrelevant for a software business, where the material domains are data protection, workforce practices, and governance. A generic 200-line questionnaire produces a thick report and very little decision-useful information.

Serious reviews therefore begin with a materiality assessment, anchored to a sector standard such as the SASB standards now maintained under the ISSB. European targets in CSRD scope have often run a double materiality assessment already, looking both at how sustainability matters affect the company and at how the company affects people and the environment. Request it early, because any gap between their list of material topics and yours is itself a finding.

The domains below are the full scope that assessment selects from, four in each pillar.

| # | Pillar | Domain | What the reviewer checks |
| --- | --- | --- | --- |
| 1 | Environmental | Climate and GHG | Scope 1, 2 and 3 inventory, targets, verification |
| 2 | Environmental | Energy and resources | Energy intensity, water, waste, circularity |
| 3 | Environmental | Pollution and site liability | Permits, emissions, contamination history |
| 4 | Environmental | Nature and climate risk | Biodiversity, physical and transition risk |
| 5 | Social | Labour standards | Contracts, wages, working time, unions |
| 6 | Social | Health and safety | Incident rates, fatalities, inspections |
| 7 | Social | Supply chain and human rights | Supplier mapping, audits, modern slavery |
| 8 | Social | Workforce and community | Diversity data, turnover, community impact |
| 9 | Governance | Board and ownership | Composition, independence, beneficial owners |
| 10 | Governance | Ethics and anti-corruption | Anti-bribery controls, screening, sanctions |
| 11 | Governance | Whistleblowing and data | Speak-up channels, case log, GDPR posture |
| 12 | Governance | Tax and disclosure | Tax transparency, controls, external claims |

The governance pillar deserves more weight than it usually gets. Environmental findings are slow and quantifiable, social findings are slow and qualitative, but governance findings can end a deal in a week. An undisclosed related-party arrangement, a sanctioned counterparty, or a bribery allegation with no investigation record stops a process outright rather than adjusting a price.

Each domain becomes a folder of 10 to 80 documents, and two of them are dangerous to distribute, because workforce data and whistleblowing case logs contain personal data that under GDPR remains the seller's responsibility however it is shared.

## 3. Scope 1, Scope 2, and the Scope 3 trap

Greenhouse gas accounting under the GHG Protocol splits emissions into three scopes, and each has a different evidence profile. Scope 1 is direct emissions from sources the company owns or controls, such as a truck fleet, a boiler, or refrigerant leakage. Scope 2 is indirect emissions from purchased electricity, heat, and steam. Both are verifiable from fuel cards, utility invoices, and service records, so a reviewer can test them in days.

Scope 3 is where the workstream stalls. It covers value chain emissions across 15 categories, eight upstream and seven downstream, including purchased goods and services, capital goods, transportation, business travel, use of sold products, and end-of-life treatment. For most companies outside heavy industry it is the overwhelming majority of the footprint, and it is the part that is estimated rather than measured. A target can present a confident-looking carbon total in which most of the tonnes come from a spend-based model.

That matters because a spend-based figure moves when procurement prices move, so an inflationary year can make a reported footprint rise while physical activity falls, and a reduction target set against that baseline becomes unmanageable. Ask category by category which method was used, what the emission factor source was, and what share of spend supplier-specific data covers. A restated emissions baseline is a red flag like a restated EBITDA.

There is also a legal ceiling on how much supplier data the target can be compelled to collect. Under Directive (EU) 2026/470, a company in CSRD scope cannot require sustainability information from a value chain partner with fewer than 1,000 employees beyond what the voluntary SME standard sets out, and where it asks for more it must say so and tell the partner it may refuse. A remediation plan built on demanding primary data from 400 small suppliers is therefore not a plan. The workable version prioritises the largest categories, contracts for data with the top suppliers by spend, and checks what has been externally assured and for which scopes.

## 4. Greenwashing in the vendor pack

The most expensive ESG finding is rarely a bad number. It is a good claim with nothing behind it. Sustainability language migrates from a marketing deck into an information memorandum, then a disclosure schedule, then a representation in the sale agreement. At that point an unverified claim has become a contractual liability that survives closing, and the insurer underwriting the warranty policy has priced it as though it were true.

The claims that cause trouble follow a pattern. Carbon neutral labels backed only by retired offsets with no reduction pathway. Recycled content percentages describing technical recyclability rather than actual recovery. Renewable electricity claims supported by unbundled certificates bought in a different market from where the power was used. Supplier code coverage stated as suppliers signed rather than audited.

Consumer protection regulators and courts in several European markets have moved against unsubstantiated environmental marketing, so the exposure is not only contractual. The practical test is to find the document proving each public claim and check it covers the same entity, period, and boundary.

![Dynamic watermarking applied to unverified sustainability claims in an ESG due diligence data room](https://assets.papermark.io/upload/file_Ks2dtpU7UXaoreiAAtXr54-watermarked-document.png)

_Draft claims and offset contracts are worth restricting: view-only, watermarked, released to named reviewers._

Sellers resist this discipline because the claims are doing commercial work in the process. Buyers who do not insist end up owning the claim.

## 5. The regulatory map in 2026

The European regime changed materially in early 2026, and diligence questionnaires written before that change now produce misleading answers. The Omnibus I Directive, Directive (EU) 2026/470, was published on 26 February 2026 and entered into force on 18 March 2026. It narrowed the Corporate Sustainability Reporting Directive so a company is in scope only if it has more than 1,000 full-time equivalent employees and more than €450 million in net annual turnover, with both tests met at once.

Timing shifted alongside scope. The earlier stop-the-clock measure pushed second-wave CSRD reporters back by two years, so their first reports are due in 2028 covering financial year 2027. The Corporate Sustainability Due Diligence Directive moved further: member states must adopt transposition measures by 26 July 2028 and apply them from 26 July 2029, with the Article 16 reporting requirement applying to financial years beginning on or after 1 January 2030. Full due diligence beyond direct business partners is now required only where plausible information suggests an adverse impact.

Two consequences follow for a live deal. A target that told you last year it was preparing for CSRD may now be out of scope, which changes what documentation exists rather than what risk exists, and EU Taxonomy reporting under Article 8 tracks the same revised scope. Commitments made to lenders and customers under the earlier regime did not expire when the directive changed, so private obligations are often stricter than public ones.

The fund-side rules matter for private equity buyers. SFDR classification under Article 8 and Article 9 still governs how funds describe sustainability characteristics and objectives, and principal adverse impact reporting rests on 18 mandatory indicators in Annex I of Delegated Regulation (EU) 2022/1288, covering greenhouse gas intensity, biodiversity, water and hazardous waste, UN Global Compact violations, gender pay gap, and board gender diversity, alongside 46 optional ones. The revision known as SFDR 2.0 would replace those labels with named product categories, but the text remains in trilogue after the Council agreed its mandate on 24 June 2026.

Germany's LkSG has meanwhile been wound back: the reporting obligation was removed, BAFA stopped reviewing compliance reports from 1 October 2025, and enforcement is suspended other than for grave human rights violations, though the duties still sit in supplier contracts signed while the act was in force. Globally, the ISSB standards IFRS S1 and IFRS S2 are consolidating into the common baseline, adopted in 28 jurisdictions as of April 2026 with a further 12 planning to.

## 6. From finding to remedy: price, indemnity, or a 100-day plan

An ESG finding is only useful once it has been priced or converted into an obligation, and the choice of remedy depends on whether the exposure is quantified, quantifiable, or open-ended. A quantified cost becomes a price adjustment. A quantifiable but uncertain cost becomes an escrow or a specific indemnity. An exposure that must be fixed before the buyer will own it becomes a condition precedent. Everything else becomes a dated action in the post-close plan.

Sellers push hard against conditions precedent because they introduce closing risk, so reserve them for findings where ownership itself is the problem: an unqualified carbon neutrality claim still in market, an unlicensed discharge, a supplier under forced labour investigation. The pattern below is that environmental findings attract money and governance findings attract conditions, because money cannot cure an integrity issue.

| Finding | How it surfaces | Commercial remedy |
| --- | --- | --- |
| Scope 3 largely spend-based | Methodology note shows estimates dominate the total | Post-close plan with supplier data contracts |
| Carbon neutral claim backed only by offsets | No reduction pathway behind the label | Condition precedent to withdraw or qualify it |
| Refrigerant or emissions permit gaps | Monitoring data against permit conditions | Price adjustment sized to the compliance quote |
| Unaudited tier two suppliers in a high-risk region | Supplier map with audit coverage by tier | Specific indemnity, the exposure being unquantified |
| Incident rate above the sector norm | Incident log and inspections over 3 years | Escrow plus a dated remediation programme |
| No functioning whistleblowing channel | Empty case log against headcount | Condition precedent, then governance action |
| Related-party arrangements undisclosed | Board minutes against the related-party register | Renegotiation or withdrawal, depending on severity |

The 100-day plan is where most ESG value gets created, and it should be drafted during diligence rather than after closing. The version that works is short: eight to ten actions, each with a named owner, a cost, and a date, sequenced so the reporting foundation comes first. That means a verified Scope 1 and Scope 2 baseline in month one, policy and governance gaps closed in month two, and supplier engagement started in month three, because supplier data has the longest lead time.

Value creation follows from the same list: energy intensity work pays back directly, safety improvement reduces insurance and lost time, and a credible baseline is what makes a sustainability-linked facility available at all. Our guide to [private equity due diligence](/blog/private-equity-due-diligence.md) covers how this fits the fund workflow.

## 7. Process, timeline, and who does the work

ESG diligence usually runs in four stages across four to eight weeks on a mid-market deal, in parallel with financial and commercial work. Materiality scoping takes a few days and determines everything downstream, desktop review covers what the seller has published, document requests and interviews follow, and site visits happen only where the material domains require them.

The work is split across specialists rather than one firm. A sustainability advisory practice or the ESG team of an accounting firm leads, environmental engineers handle site assessments and permits, employment counsel handles labour matters as a separate engagement because the material is personal data, and a screening firm covers sanctions and forced labour checks.

That fragmentation is the operational problem. One project manager at an energy infrastructure business in Poland ran a site M&A process with more than 100 internal users and three to four investors, each bringing around 20 advisers across legal, technical, and tax, so the same permit file gets requested three times by parties who cannot see each other.

![Separate trackable links issued per advisory team in an ESG due diligence data room](https://assets.papermark.io/upload/file_HKCLjWCkdTzc6qAFV2it65-all-links.png)

_One link per advisory team keeps each reviewer in a different view of the same document set._

Sell-side teams increasingly commission vendor ESG diligence before launching a process, which is worth the money when the asset has a genuine sustainability story and a poor evidence trail. Appointing advisers three to six months before an exit leaves time to fix what the report finds.

## 8. Worked scenario: acquiring Kesterlund Logistik

A mid-market private equity fund agrees to acquire Kesterlund Logistik, a Nordic contract logistics and cold-chain operator with €140M of revenue, 1,900 employees, and 34 depots. The fund's limited partners require portfolio-level emissions reporting, so ESG diligence is scoped in week one alongside financial work.

Scope 1 and Scope 2 come back quickly. The diesel fleet and refrigerant losses account for 41,000 tonnes of CO2 equivalent and purchased electricity for another 3,200, all traceable to fuel cards, utility invoices, and service records. Scope 3 is the problem. Of the 15 value chain categories, only 4 are built from supplier-specific data, 8 are spend-based estimates, and 3 are not calculated at all.

Three further findings shape the deal. Two tiers of subcontracted hauliers, covering roughly a fifth of delivered volume, have never been audited against the supplier code. Three of the 34 depots show ammonia refrigerant handling gaps against permit conditions, quoted at €610,000 to fix. And the website carries a carbon neutral delivery claim supported entirely by retired offsets.

The outcomes split as the earlier table predicts. The refrigerant work becomes a €610,000 price adjustment. The unaudited haulier tiers become a specific indemnity, because the exposure cannot be bounded until the audits run. The carbon neutral claim is withdrawn as a condition precedent, which the seller accepts once counsel confirms it would otherwise be warranted. Everything else lands in a nine-action 100-day plan owned by the incoming CFO.

## 9. Common mistakes and what the review costs

The most common mistake is scoping from a template rather than from a materiality assessment. A universal checklist applied to a software company produces 60 pages about water and waste and misses the data protection exposure that matters, while the same checklist applied to a food processor gives equal weight to board diversity and to a wastewater permit that could close a plant.

The second is accepting a carbon number without asking how it was built, since a total with no methodology note, no boundary statement, and no split between measured and estimated data is a marketing figure rather than an inventory. The third is treating ESG ratings as evidence, when ratings are built largely from public disclosure, so a company that publishes nothing scores poorly regardless of what it does. The fourth is sharing ESG material carelessly, because workforce data, whistleblowing logs, and incident records contain personal data, and forwarding them to an adviser, a lender, and an insurer is a data protection problem for the seller. Our [data room checklist](/blog/data-room-checklist-2026.md) and our [M&A due diligence checklist](/blog/m-and-a-due-diligence-checklist.md) cover how ESG slots into the wider request list.

On cost, ESG review is priced as a workstream rather than a standalone report, and it scopes much like operational diligence: roughly $15,000 to $30,000 for a small company, $30,000 to $75,000 for a mid-sized business, and $75,000 to $200,000 for a large or multi-site enterprise. Site work is priced separately, where a Phase I environmental site assessment runs $2,000 to $6,000 per site and a Phase II runs $10,000 to $100,000. For how this fits the total bill, see our breakdown of [due diligence cost](/blog/due-diligence-cost.md).

What moves the number is the count of sites and jurisdictions, whether the supply chain reaches high-risk regions, and above all the quality of the target's documentation. A target that already reports under a recognised framework can be reviewed in three weeks.

## 10. Data room for your ESG due diligence

A **data room for ESG due diligence** is not the same artifact as the one finance uses. The financial folder holds numbers that are commercially sensitive but internally consistent. The ESG folders hold personal data, unverified claims, regulatory correspondence, and evidence arriving from a dozen owners over several weeks.

The other difference is duration. A financial model stops mattering the day the deal closes, while ESG evidence keeps mattering, because the buyer reports against it, a lender tests it annually, and an exit buyer asks for it in four years.

[Papermark](/data-room.md) is a secure, fully customizable, and developer-friendly data room built for modern dealmakers, with page-by-page analytics, dynamic watermarking, and transparent pricing (open-source and self-hosting available).

![Papermark data room for ESG due diligence with folders organised by pillar and domain](https://img.papermarkassets.com/upload/file_35DtVER7SdS1G6unRE8unv-papermark-data-room.png)

_An ESG due diligence data room with one folder per domain, so permissions differ by folder rather than by document._

### Why you need a data room for ESG due diligence

Most ESG diligence still runs over email and shared drives, and it is the workstream where that habit creates the most legal exposure, because much of the material is personal data. There are four reasons a dedicated data room for ESG due diligence earns its place. If you are still choosing a platform, our comparison of the [best virtual data rooms](/blog/best-virtual-data-rooms.md) covers pricing model, bidder management, and compliance.

**Part of the evidence is personal data.** Workforce records, pay gap analyses, incident logs, and whistleblowing case files describe identifiable people, and the seller stays responsible for how they are processed no matter who asked. Emailing that material to an adviser, a lender, and an insurer creates a data protection exposure whether or not the deal completes. A room keeps those folders view-only, restricted to a named allowlist, and evidenced by an access log.

**Five kinds of reviewer need five different views.** The ESG adviser needs everything material, employment counsel needs the labour and workforce folders and nothing else, the lender's sustainability team needs the emissions inventory and targets, and the insurer needs the claims folder. A shared drive gives you one permission set. A data room for ESG due diligence gives you one per link over the same documents.

**Evidence arrives in waves from many owners.** ESG documentation does not sit in one system. The permits are with the plant manager, the incident log with the safety team, the supplier audits with procurement, and the emissions workbook with whoever built it. Requests come back in rounds, and across 40 or 50 questions an email thread loses track of which are still open.

**The record has to outlive the deal.** When a claim is challenged, a lender tests a covenant, or an exit buyer runs its own review years later, the question is what was disclosed, to whom, and when. A room with a per-visitor audit log and an immutable archive answers that precisely, and reconstructing it from mailboxes is not realistic.

The rest of this section is the practical setup: five steps to build a data room for ESG due diligence that handles all four.

### Step 1: build the room by pillar and domain, not by document

Create one folder per domain from the matrix in section 2, grouped under the three pillars, and put the materiality assessment at the top level so every reviewer starts from the same view of what matters. That structure is what makes differentiated access possible later, because a flat pile of 300 files forces you to choose between giving everyone everything and hand-picking documents per reviewer. Upload in bulk by dragging the folder tree in, and **automatic file indexing** on the Data Rooms Plus plan maintains the index as documents arrive in waves.

### Step 2: set permissions per reviewer group

This is where an ESG room differs most from a financial one, because two folders should never reach most people in the process.

| Reviewer | Folders granted | Rights |
| --- | --- | --- |
| Buyer's ESG adviser | All material domains across the three pillars | View and download |
| Employment counsel | Labour, health and safety, workforce data | View only, watermarked |
| Lender sustainability team | Emissions inventory, targets, assurance letters | View only |
| W&I insurer | External claims, disclosure schedule support | View only, watermarked |
| Environmental engineer | Permits, monitoring data, site assessments | View and download |

**Granular file-level permissions** are set per link rather than per user, so each party gets its own link carrying its own folder scope, **email allowlist / domain restriction**, and download rule. Access is link-based, so no reviewer has to create an account, which removes the friction that makes busy advisers go back to asking for files by email.

![Granular folder-level permissions applied per reviewer link in a Papermark ESG due diligence data room](https://assets.papermark.io/upload/file_LkU4BNY6MKUKMgDucSzzFg-papermark-granular-permissions.png)

_Permissions are set per link, so employment counsel and the lender's sustainability team see different folders of the same room._

### Step 3: protect personal data and unverified claims

Switch the workforce, whistleblowing, and draft claims folders to view-only and turn on **dynamic watermarking**, which stamps every page with the viewer's email, IP address, and timestamp as it renders. **Screenshot protection** adds a deterrent on incident logs and offset contracts, and **email verification** confirms the person opening the document is the person you invited.

The honest limit is worth stating: a downloaded file is legally treated as read, and no platform can recall it. That is why download is disabled rather than discouraged here, and why watermarking makes a leak traceable to a named viewer.

![Watermark settings applied to workforce and whistleblowing folders in an ESG due diligence data room](https://assets.papermark.io/upload/file_UBgpNQNp4U7WL2Ev9vukcR-watermark-settings.png)

_Watermark configuration controls what appears on each page: viewer email, IP address, and timestamp._

### Step 4: run the evidence waves through Q&A, not email

ESG requests arrive in rounds. The reviewer reads the emissions methodology note, asks for the three supplier data agreements it references, then asks who signed the assurance letter. Run over email, that thread fragments across the safety manager, procurement, the CFO, and two advisers, and nobody can say which of 50 questions is still open.

The **Q&A module** attaches each question to the document that prompted it, with permissions controlling who sees which threads, so the lender never sees employment counsel's questions. The log exports for the closing file, which matters because it is often the clearest evidence of what the seller told the buyer about a claim.

### Step 5: read the analytics, then close the room properly

**Page-level analytics** show which reviewer opened which document, when, and for how long. In ESG diligence that is a scoping signal: an adviser who has spent forty minutes in the supplier audit folder has found something, usually a week before the report says so.

![Per-document analytics across ESG due diligence files in a Papermark data room](https://assets.papermark.io/upload/file_5TJkCN6dpNi1whx6rpT6T4-document-analytics-Papermark-v2.png)

_Per-visitor analytics show which ESG documents each reviewer opened and for how long._

After closing, **data room freeze** makes the room immutable and exports it as an archived ZIP with a certificate, and the **audit log** turns a general assurance into a dated, per-visitor fact. When a claim is challenged or an exit buyer runs its own review four years later, that archive is the record of what was disclosed and to whom.

### What it costs

The [Data Rooms plan](https://www.papermark.com/pricing.md?view=datarooms) is **€99/month** with a 7-day free trial and includes 3 team members, unlimited data room visitors, unlimited data rooms, unlimited documents, custom domain, dynamic watermarking, NDA agreements, and granular file-level permissions. **Data Rooms Plus at €249/month** adds 5 team members, the Q&A module, the audit log, automatic file indexing, and SOC 2 Type II. **Premium at €549/month** adds 10 team members, AI redaction, the public API, SSO, and whitelabeling, which is the plan funds pick for portfolio-wide ESG reviews. **Data Rooms Unlimited at €999/month** removes per-seat charges entirely, so teams that add reviewers mid-deal pay one number regardless of headcount, and it carries every Premium capability including AI redaction. Unlimited data rooms under one subscription means one room per target with no per-project fee.

_No credit card required._

## FAQ

### What is ESG due diligence?

It is the pre-deal assessment of environmental, social, and governance factors that affect valuation, financing, and post-close liability. A full-scope review is organised into about 12 domains across the three pillars, and a mid-market deal screens all 12 before going deep on the 3 to 5 flagged as financially material.

### What is the difference between ESG due diligence and environmental due diligence?

Environmental due diligence in its narrow sense is a site investigation, starting with a Phase I environmental site assessment under ASTM E1527-21 that looks for contamination. ESG due diligence covers all 12 domains, including labour standards, supply chain human rights, and anti-bribery controls, so a buyer who commissions only a Phase I has covered roughly 1 domain of 12.

### What is included in an ESG due diligence checklist?

Four environmental domains covering climate and GHG, energy and resources, pollution and permits, and nature and climate risk; four social domains covering labour standards, health and safety, supply chain human rights, and workforce and community; and four governance domains covering board and ownership, ethics and anti-corruption, whistleblowing and data protection, and tax and disclosure.

### How long does ESG due diligence take?

Typically 4 to 8 weeks on a mid-market deal, in parallel with financial and commercial work. It moves through 4 stages: materiality scoping, desktop review, document requests and interviews, then site visits where the material domains require them. The constraint is document availability rather than reviewer capacity.

### How much does ESG due diligence cost?

It is usually scoped like operational diligence, at roughly $15,000 to $30,000 for a small company, $30,000 to $75,000 for a mid-sized business, and $75,000 to $200,000 for a large or multi-site enterprise. Site work is priced separately, with a Phase I environmental site assessment at $2,000 to $6,000 per site and a Phase II at $10,000 to $100,000.

### Who performs ESG due diligence?

A sustainability advisory practice or the ESG team of an accounting firm normally leads, supported by 3 or 4 specialists: environmental engineers for permits and site assessments, employment counsel for labour and workforce data, and a screening firm for sanctions and forced labour checks.

### Why is Scope 3 so hard to evidence in due diligence?

Scope 3 covers 15 value chain categories, 8 upstream and 7 downstream, and for most companies it is the majority of the footprint while also being estimated rather than measured. Spend-based estimates move with procurement prices, so a target set against that baseline is unmanageable.

### Does CSRD still apply to my target in 2026?

Only if it has more than 1,000 full-time equivalent employees and more than €450 million in net annual turnover, since Directive (EU) 2026/470 entered into force on 18 March 2026 and applies both tests together. Second-wave reporters still in scope file their first reports in 2028 covering financial year 2027.

### When do the CSDDD obligations actually start?

Member states must adopt transposition measures by 26 July 2028 and apply them from 26 July 2029, with the Article 16 reporting requirement applying to financial years starting on or after 1 January 2030. Full due diligence beyond direct business partners is required only where plausible information suggests an adverse impact.

### What are the biggest ESG red flags in a transaction?

A carbon neutral claim backed only by retired offsets with no reduction pathway, unaudited tier two suppliers in a high-risk region, an incident rate above the sector norm over 3 years, an empty whistleblowing case log for a workforce of thousands, and undisclosed related-party arrangements.

### Do I need a data room for ESG due diligence, or is a shared drive enough?

A shared drive gives you one permission set, and ESG diligence needs at least 5: the ESG adviser sees everything material, employment counsel sees labour and workforce data, the lender sees emissions and targets, the insurer sees the claims folder, and the environmental engineer sees permits. A data room for ESG due diligence sets permissions per link and keeps personal data folders view-only and watermarked, and the Papermark Data Rooms plan covers 3 team members at €99/month.

## Related resources

- [Best virtual data rooms in 2026](/blog/best-virtual-data-rooms.md)
- [Environmental due diligence](/blog/environmental-due-diligence.md)
- [Private equity due diligence](/blog/private-equity-due-diligence.md)
- [M&A due diligence checklist](/blog/m-and-a-due-diligence-checklist.md)
- [Operational due diligence](/blog/operational-due-diligence.md)
- [Data room checklist for 2026](/blog/data-room-checklist-2026.md)

---

_Markdown version of [this article](https://www.papermark.com/blog/esg-due-diligence) for AI agents and LLMs._
_More Papermark content: [llms.txt](https://www.papermark.com/llms.txt) · [full index](https://www.papermark.com/llms-full.txt)._