ESG Score for executive committees: strategic management and capital optimisation

Almost every executive committee has now seen an ESG rating: the score an external agency assigns to a company, once a year, for third-party use. Far fewer work with an internal score — the dynamic indicator showing how performance stands today, what is dragging it down and how much room there is for improvement. The difference between the two is not cosmetic: the rating is a snapshot for the market; the score is the dashboard used to make decisions.

In this article, we explain how to build an ESG Score for executive committees that can withstand scrutiny from a bank or an independent verifier: the data architecture it needs, how its components are weighted, its relationship with financing costs and how it integrates into risk management through COSO ERM. No promises of a magic wand: a score is worth exactly as much as the data and evidence supporting it.

 

From static reporting to governance: the score's new role

Investors and lenders are no longer satisfied with an annual sustainability report. They want to see that non-financial factors are being managed — not merely described — and that there is a demonstrable connection between that performance and protecting the company's value. A well-designed internal score answers both requirements: it flags deviations before they reach the public rating and gives the board a common language with finance.

The end of spreadsheet-based management

The obstacle is usually not ambition but the underlying plumbing. When data is distributed across scattered files, every update introduces a risk of error, nobody owns each figure and traceability — the first thing CSRD and any verification process require — has to be reconstructed afterwards. A single data model, in which information is captured once together with its evidence and flows into the frameworks (GRI, CDP, ESRS), is not a technical luxury: it is the prerequisite for a credible score.

Which indicators an executive committee looks at

Not all data carries the same weight. The committee is interested in material KPIs — those that affect EBITDA: energy efficiency, supply chain resilience, accident rates — reviewed quarterly rather than annually. And one governance lever works better than any internal circular: linking part of variable remuneration to verified sustainability targets. When incentives depend on the data, data quality stops being the sustainability department's problem and becomes everyone's concern.

 

The technical architecture of a dynamic score

A score intended for discussion at board level needs explicit, defensible weighting. For the mid-market, the reference distribution is E40 · S35 · G25: the environmental pillar accounts for 40 % (Scope 1, 2 and 3 emissions, water resources, biodiversity), the social pillar for 35 % (labour practices, health and safety, supply chain due diligence) and governance for 25 % (corporate ethics, risk management, tax transparency, board structure). This distribution follows the logic of the major agencies, adapted to companies that are not IBEX-listed corporations.

Normalisation: the real technical challenge

Converting tonnes of CO₂, training hours and diversity percentages into a coherent score is where most home-grown models break down. Three things are needed: normalising raw data against sector benchmarks (a tonne of CO₂ does not mean the same thing in logistics as in services), adjusting for materiality so that the factors with the greatest business impact carry more weight, and separating what management can influence from what is structural — management cannot be asked to eliminate the baseline imposed by its sector. Without that final adjustment, the score rewards complacency or penalises the unavoidable.

Without evidence, there is no score

Every point in the assessment must be traceable to a document: an invoice, a certificate, a record. That is what turns the score into an argument rather than an opinion — and what makes it possible to generate the XBRL outputs required by European digital reporting. A centralised ESG data governance platform does this work when the data is captured, not on the eve of the audit.

 

The score and the cost of capital

This is why the subject has reached boardrooms: demonstrable ESG performance is already translating into financing terms. Banks adjust spreads according to the borrower's profile, and in sustainability-linked loans the interest rate changes with the achievement of agreed KPIs — KPIs which, following the update to the Sustainability-Linked Loan Principles, require external verification. Traceable data reduces the credit analyst's uncertainty and, with it, the premium: depending on the starting bracket, the improvement can range from 5 to 15 basis points. For a medium-sized debt facility, that affects net profit, not just the corporate narrative.

The European Taxonomy and what the bank requests

Conversations with banks increasingly include a breakdown of CAPEX and OPEX aligned with the EU Taxonomy: what proportion of investment and expenditure corresponds to eligible and aligned activities. Preparing this manually every time a bank requests it creates discrepancies; automating it using the same data as the score removes friction from due diligence and prevents an inconsistency from penalising the credit assessment.

 

The score within the risk map: COSO ERM

An isolated score is a number; integrated into the internal control framework, it becomes management. COSO ERM allows ESG factors to be handled using the same structure as other corporate risks: identify the risk (physical or transition), assess probability and financial impact, apply controls and measure residual risk — which, it is worth saying, never falls to zero. Physical risks threaten assets and facilities; transition risks threaten entire business models when regulation or technology changes. Both feed into the score, and the score feeds into the risk map.

The supply chain also contributes to the score

Scope 3 and due diligence require looking beyond the company: a critical supplier's environmental non-compliance ultimately affects the balance sheet of the company hiring it. Although, following the Omnibus, mandatory due diligence (CSDDD) was restricted to companies with more than 5,000 employees and postponed until 2029, large customers are already passing these requirements on through contracts — so monitoring suppliers with the same rigour as your own performance is not getting ahead of events: it is responding to what is already happening. An ESG risk module aligned with COSO ERM turns that monitoring into actionable data.

The dashboard the executive committee needs

Ultimately, the committee does not want forty indicators: it wants three answers — how much risk there is, how much is covered and how much the uncovered portion costs, in euros — plus early warnings when a material indicator deviates and scenario simulations to justify transition investments. That is the format in which sustainability earns its place on the agenda without needing an interpreter.

 

What Voombu contributes

Voombu generates the score using a single-data infrastructure: information is captured once, together with its source and evidence, and simultaneously feeds multi-framework reporting, the risk map and the score itself, calculated using E40 · S35 · G25 weighting in both current and projected versions — because the delta between the two represents the real room for improvement, translated into terms a CFO can take into a banking negotiation. Executive dashboards present that result in boardroom language, and outputs are available in editable Word, PDF and XBRL, ready for the verifier.

And the usual qualification, which matters more here than anywhere else: Voombu does not audit or certify the score. It documents it and makes it traceable so that an independent third party can review it. A self-certified score has little value; a verifiable one is a financial asset.

If you want to see what your company's score would look like, request a demo: in 30 minutes, we will review which frameworks apply to you and what data you already have to get started.

 

Frequently asked questions about the ESG Score

What is the difference between an internal ESG Score and an external rating?
An external rating is a static assessment issued by an agency for third parties, at the frequency and according to the criteria set by that agency. The internal score is a management tool: it updates with actual data, shows what is holding it back and allows corrective action before performance is reflected in the public rating. Ideally, the latter anticipates the former.
 

How does the score affect the interest rate on my loans?
Through the risk profile. In sustainability-linked loans, the rate adjusts according to the achievement of agreed and verified KPIs; in general financing, demonstrable performance reduces the uncertainty premium. Depending on the starting bracket, the improvement typically ranges from 5 to 15 basis points.

Is COSO ERM mandatory for ESG risks?
There is no legal obligation, but it is the internal control framework the board and auditor already know, which reduces friction: ESG risks are assessed using the same language as financial risks, rather than existing in a separate document that nobody cross-references against the risk map.

What weight does governance carry in the total score?
25 %, compared with 40 % for the environmental pillar and 35 % for the social pillar. It may appear to be the smallest component, but it supports the other two: without corporate ethics, transparency and a control structure, the reliability of everything else is open to question.

How does Voombu help prepare for verification under CSRD?
By centralising data with its evidence from the moment of capture, automatically mapping it to the ESRS and generating XBRL outputs. The verifier receives complete traceability instead of a reconstruction, shortening the process and reducing its cost. The audit itself is always performed by an independent third party.

Can poor ESG performance exclude me from public tenders?
Yes. European public procurement incorporates ESG criteria as suitability requirements or scored criteria, and some tender specifications directly exclude companies without a decarbonisation plan or due diligence. It is one of the three channels — alongside banks and large customers — through which pressure reaches companies even when they have no reporting obligation.

What is XBRL and why does it matter to the committee?
It is the digital tagging language that allows regulators and analysts to process information automatically; CSRD requires it for sustainability reporting. For the committee, it has one practical implication: data needs to be structured from the outset, because converting it manually at the end is expensive and error-prone.

How long does implementing a scoring system take?
It depends on the maturity of the starting data. With sources identified and a single data model, an operational score and its dashboards can be ready within weeks; the most time-consuming part is not the calculation but putting the data house in order for the first time — work which, once completed, serves all frameworks simultaneously.