From disclosure to defence

For most of the last decade, sustainability and social value teams have been judged on what they could publish. Increasingly, they are being judged on what they can defend.

The shift is quiet but consequential. Procurement evaluators are asking for the workings behind a number, not just the number. Contracts increasingly carry audit and clawback rights. Lenders and insurers now expect audit-grade evidence in routine diligence. Regulators are imposing material penalties for missed deadlines on non-financial reporting. And practitioners, the people who know where the figures come from, are finding themselves in conversations that look more like financial audit than corporate communications.

This is the assurance shift, and it is also the moment that Evidence Debt becomes payable. For organisations carrying a backlog of unstructured evidence, undocumented methodology and untraceable claims, the disclosure era was forgiving: most claims were never tested. The defence era is not. What was previously a slow internal drag on bid teams and reporting cycles is now a live commercial and regulatory exposure.

Disclosure is what you publish. Defence is what survives examination.

This whitepaper is for the practitioners on the receiving end of that change. It sets out what “auditable” actually means for non-financial evidence, introduces five tests that any claim can be checked against, names the ways claims fail when somebody informed and sceptical starts asking questions and offers a working pattern any team can adopt in the next quarter, before the audit lands rather than during it. The aim is deliberately modest: a focused set of moves that any sustainability or social value lead can begin now, working with what they already have.

The old model of sustainability and social value reporting was disclosure-shaped. An organisation made a series of claims, mostly annually, packaged into reports and tender responses, and the standard for those claims was that they were defensible at the point of publication. If the team had a credible methodology, internally agreed numbers and a coherent narrative, the work was largely done. The audience was a generalist reader who would mostly accept what was put in front of them.

That model is fading. What is replacing it is something closer to financial reporting in posture: claims are treated as evidence, audiences include people whose job is to test it and the standard is that claims are defensible at any moment, not just the moment of publication.

The signals are everywhere if you look for them. Our previous paper, Evidence Debt, traced how procurement, reporting and risk are converging on credible evidence produced under deadline. Since then the signals have sharpened, and they share a direction: examination.

In procurement, evaluators increasingly ask not what an organisation will do, but how it knows it can deliver and how it will prove delivery once the contract is live. From January 2027, PPN 026 raises the stakes on central government contracts of £1m and above: social value carries a minimum of 10% of the award score, rising to 20% at £5m and above, and those larger contracts carry at least one social value KPI, published on the government’s central digital platform and reported at least annually. Poor performance against that KPI can count towards exclusion from future tenders, and buyers are writing audit, clawback and continuous-monitoring rights into the contracts that follow. On the largest contracts, a supplier’s delivery record, not just its promises, will be published and consequence-bearing.

In reporting, the bar is moving from disclosure to assurance. CSRD and the European Sustainability Reporting Standards have brought structured sustainability information into the perimeter of external limited assurance, confirmed as the standard by the EU’s 2026 Omnibus directive. In the UK, the FCA has proposed requiring around 500 listed companies to report against the UK Sustainability Reporting Standards for periods beginning on or after 1 January 2027, with final rules expected in autumn 2026.

In diligence, lenders and insurers are pulling audit-grade evidence into routine commercial conversations, particularly where transition risk, modern slavery exposure or social value commitments are material to a deal. Where proof cannot be produced quickly and consistently, risk is repriced and conversations slow.

And enforcement has begun to attach prices. In February 2026, the European Central Bank imposed periodic penalty payments of EUR 7.55m on Crédit Agricole for missing a deadline related to assessing climate-related risk materiality, calculated on the basis of 75 days of non-compliance in 2024. Most organisations will never face that supervisory regime directly. What matters is that non-financial evidence has entered an arena where deadlines have prices and methodology has consequences, and that posture is propagating outward through procurement, diligence and contract management.

For practitioners, this is the moment Evidence Debt, the compounding cost of proving non-financial performance the hard way, stops being an internal inconvenience and becomes external exposure. The debt is now paid down in front of an audience: an evaluator, an auditor, a buyer’s contract manager, a lender’s diligence team. The cost has moved from internal effort to external credibility, and from soft drag to hard consequence.

The implication is direct. The skills that defined the disclosure era (strong narrative, careful framing and well-managed communications) remain valuable, but they are no longer sufficient. What matters now is the operating discipline beneath the disclosure: where the number came from, how the calculation was done, what it covered, who owns it, what changed since last time and whether all of that holds up when an examiner asks. That is the work of defence rather than disclosure, and it is becoming the practitioner’s core craft.

In practice, the most useful question a sustainability or social value lead can ask of any claim is no longer “is this true?”. Most teams pass that bar already. It is: “if a sceptical auditor or a tough procurement evaluator asked me about this number on Friday afternoon, could I show them where it came from, how it was calculated, what it covers and what would happen if any of that changed, without going through three other people first?” Where the answer is no, making it yes is what paying down Evidence Debt looks like in the defence era. The rest of this whitepaper sets out a structured way to do that.

In financial reporting, “auditable” has a settled meaning built up over a century of practice: transactions are recorded once, in a controlled system, with a documented trail from every reported figure back to its source, a stated basis of preparation and a named officer accountable for the result. Nobody in finance considers that exotic. It is simply how the discipline works.

Applied to non-financial evidence, the word is used far more loosely. In practice it often means “we have documents”, or “we could reconstruct this if we had to”. Neither survives an audit. A folder of PDFs is storage, not an audit trail. A reconstruction is an improvisation, however honest.

The working definition that holds up is this:

A claim is auditable when an informed, sceptical outsider can follow it backwards to its source and forwards through its calculation without needing its author in the room.

Auditable is not a property of a team, a report or a platform. It is a property of each individual claim. A report is only as defensible as its weakest load-bearing number.

That definition has a useful consequence: it can be tested. Any claim your organisation makes, in a tender, a disclosure, a board pack or a supplier questionnaire, can be checked against five questions. Together they describe what an evaluator, an assurance provider or a diligence team will ask, in roughly the order they will ask them.

Test 1 · Source. Can you show where it came from?

Every figure and statement traces to a named origin: a document, a dataset, a system export, a signed record. Retrievable in minutes, not reconstructed in days.

Failing looks like: “the number is in last year’s pack”, a source that turns out to be another report citing the original that nobody can find, or a spreadsheet whose provenance is a leaver’s inbox.

Test 2 · Method. Can you show how it was calculated?

The calculation, conversion factors, assumptions and basis of preparation are written down, and the same method applied to the same inputs gives the same answer next cycle.

Failing looks like: methodology that lives in one analyst’s head, a model nobody dares touch, or a figure whose workings have to be written down after the question arrives.

Test 3 · Scope. Do you know what it covers, and what it does not?

The claim states its period, entities, sites and exclusions. “Local employment” means the same thing in the bid as in contract delivery.

Failing looks like: a boundary that quietly shifts between cycles, group figures presented as if they covered a single entity, or an exclusion that was agreed verbally and recorded nowhere.

Test 4 · Ownership. Does a named person stand behind it?

Someone owns the claim and its evidence: they know its source, its method and its scope, and they are accountable for keeping it current.

Failing looks like: a number everyone reports and nobody owns, or ownership that dissolves the moment the person who “just knows” leaves.

Test 5 · Change. Can you explain what moved since last time?

Year-on-year and cycle-on-cycle movements have recorded explanations: what changed, why and whether the change is real performance, a scope change or a method change.

Failing looks like: a delta with no explanation. Under scrutiny, an unexplained movement reads as manipulation even when it is innocent.

Few organisations pass all five tests everywhere. That is not the point. The point is knowing, claim by claim, which tests you pass and which you do not, because your evaluators, auditors and counterparties are going to run exactly this exercise whether you have run it or not. The organisations that struggle in the defence era are not the ones with gaps. They are the ones discovering their gaps live, in front of the audience.

The five tests describe defensibility in the abstract. Under real scrutiny, failure has recognisable shapes. Four shapes turn up often enough to deserve names.

• The reconstructed method. A figure is challenged and the methodology is written down after the fact, from memory, by whoever is left. The answer may even be right. But a method reconstructed under pressure carries no authority, and an experienced evaluator can tell the difference between documentation and archaeology. This is Test 2 failing at the worst possible moment.
• The confident orphan. A number appears in the annual report, three tender responses and the board pack. Everyone reports it. Nobody owns it. When the question comes, it is passed from sustainability to finance to operations and back, and every handoff costs a day and a little credibility. This is Test 4 failing in public.
• The moving boundary. The same metric covers the group one year, the UK entity the next and “operations excluding acquisitions” the year after, and none of this is stated. Each individual figure may be accurate. The sequence is indefensible, because an examiner reads an unexplained boundary change as either carelessness or intent. This is Tests 3 and 5 failing together.
• The single-use answer. A strong response is assembled for one framework, one tender or one questionnaire, then shelved. The next request, asking for substantially the same proof in a different structure, starts from scratch. Same material, different question, every time. Evidence Debt named the questionnaire version of this the questionnaire treadmill. In the defence era it becomes the cost engine that makes defence unaffordable, because every examination is paid for at full price.

These patterns are the day-to-day texture of Evidence Debt under defence-era conditions. They are also, without exception, structural rather than personal: they happen to competent, honest teams because the evidence has no infrastructure underneath it.

None of what follows requires new systems. It requires treating a small number of claims as assets and managing them accordingly.

Weeks 1 to 2 · Build the claim register

List the claims that carry real commercial or regulatory weight: commitments in live contracts and current bids, the headline figures in your most recent disclosures, anything a contract gives audit or clawback rights over. Keep it deliberately small, around 20 to 30 claims: only the ones you would need to defend at short notice.

Weeks 3 to 6 · Run the five tests

Take each claim through Source, Method, Scope, Ownership and Change, and record an honest pass or fail for each. No weighting, no scoring frameworks, a simple pass or fail is enough to direct the work. A row can be one line: the claim, its source, its owner, which tests it passes and which it fails. Expect the first pass to be uncomfortable; that is the exercise working. Fix ownership first and source second: ownership costs a decision, source is hardest to recover later, and every other fix depends on both.

Weeks 7 to 12 · Close the gaps that matter

Write down method and scope for your headline figures while the people who know them are still in the building. Start a change log for each: one line per movement, what changed and why. Then rehearse. Once a month, pick one claim and run a Friday afternoon drill: someone plays the sceptical evaluator, and the owner defends the claim from its records, not from memory. The first drill will find gaps the register missed. That is what it is for.

A quarter of this produces something most organisations do not have: a known, tested, owned core of defensible claims, and an honest map of where the remaining exposure sits. It does not pay down the whole debt. It establishes the discipline that stops it compounding.

The pattern above works, and some teams will keep it working by hand. There is a reason most do not, and it is not a lack of will: every request restarts the same manual work. The evidence arrives as documents, exports and working files; the request arrives in a structure those files do not match; and the gap between the two is closed by hand, under deadline, by the same few people, every time.

Most of the tooling in this market, including its best-known names, does not remove that burden. It relocates it: data must be cleaned and structured before the platform can use it, so the hardest part of the job, turning what actually exists into something a system can work with, still belongs to the practitioner. The tool starts helping after the drag is over.

Most platforms need clean data. ImpactOS takes it as it comes.

Spreadsheets, complex PDFs, system exports and working files are ingested as they are, with no re-keying. The structuring that consumes practitioner weeks is what the platform does, not what it waits for. Evidence is structured once, kept linked to its source and reused across every framework and request that follows. The pipeline is deliberately simple: Ingest, Structure, Trace, Reuse.

For the practitioner, the day-to-day difference is concrete. The Friday afternoon question stops being a scramble, because the workings behind a number can be pulled up while the question is still being asked. The next questionnaire stops being a rebuild, because the same structured records answer it in a different shape. And the claim register no longer needs rebuilding: it becomes a live view of records the platform already holds.

What a platform changes is durability: defensibility stops being an act of heroics each cycle and becomes a property of the system.

ImpactOS is an accounting-grade evidence layer for non-financial data. It turns loose documents, exports and working files into governed, traceable records, mapped to whichever framework a stakeholder requires: the Social Value Model, SECR, CSRD and ESRS, CDP, the UN SDGs, TOMs or custom buyer, supplier and partner frameworks. Against the five tests, the platform’s role is direct:

• Source. No black-box claims. Every answer connects back to the source evidence. “Show your workings” is a query, not a project.
• Method. Evidence is structured once and mapped consistently, so the same records produce the same answers across outputs and cycles.
• Scope. Evidence is standardised into one consistent model and every output draws on the same records, so a boundary cannot quietly shift between a tender response and an annual report.
• Ownership. Commitments and claims have named owners and live status, tracked through delivery rather than reconstructed at contract review.
• Change. Mappings are versioned and deltas are visible: what changed, why and what it affects, so framework updates and restatements are managed events rather than crises.

The platform is in use with customers ranging from multi-billion to single-million-pound organisations, across corporate disclosure and public sector social value delivery.

The disclosure era rewarded organisations for what they could say. The defence era rewards them for what they can show. It is arriving through every channel at once: procurement scoring, assurance regimes, contract terms, diligence questions and, increasingly, enforcement with a price attached.

For teams carrying Evidence Debt, the choice is not whether to face examination. It is whether to meet it with structure or with heroics. The five tests give you the standard. The quarter’s working pattern gives you the start. The infrastructure makes it permanent.

The question is no longer “is this true?”. It is: “could you defend it on Friday afternoon?”

Ready to pressure-test ImpactOS?

james@impactos.tech · www.impactos.tech