ESG Due Diligence: Requirements, Process & Best Practices

ESG due diligence is the process of identifying, assessing, and addressing environmental, social, and governance risks across a company's operations and value chain. It is conducted in two distinct contexts — ongoing supply chain risk management, and transactional due diligence in mergers, acquisitions, and investments — and the requirements for each are increasingly codified in law.

The Corporate Sustainability Due Diligence Directive (CSDDD), adopted by the EU in 2024, makes supply chain ESG due diligence a legal obligation for large EU companies and non-EU companies with significant EU revenue. This shifts ESG due diligence from a voluntary best practice to a compliance requirement with enforcement consequences — including civil liability for harms that could have been prevented through adequate due diligence.

What ESG Due Diligence Covers

ESG due diligence spans three categories of risk:

• Environmental: pollution and contamination (soil, water, air), GHG emissions across the value chain, deforestation and biodiversity impacts, hazardous waste handling, and climate transition exposure in capital-intensive assets
• Social: forced and child labour, unsafe working conditions, freedom of association violations, discriminatory practices, land rights abuses in supply chain communities, and modern slavery exposure in higher-risk sourcing regions
• Governance: bribery and corruption (particularly in high-risk jurisdictions), sanctions exposure, money laundering risk, data protection failures, and conflicts of interest in ownership structures

The scope of the assessment — which entities and relationships it covers — depends on the legal framework and the purpose. CSDDD focuses on adverse impacts in the value chain. M&A due diligence typically focuses on the target company's direct ESG liabilities and disclosure quality.

CSDDD — What the EU Mandate Requires

The Corporate Sustainability Due Diligence Directive requires in-scope companies to: integrate due diligence into their policies and risk management systems; identify and assess actual and potential adverse impacts on human rights and the environment in their own operations, subsidiaries, and value chains; prevent, mitigate, and remediate those impacts; establish a complaints mechanism; monitor the effectiveness of their due diligence; and communicate publicly on their due diligence process and outcomes.

CSDDD applies in phases based on company size:

• EU companies with >5,000 employees and >€1.5bn global turnover: from 2027
• EU companies with >3,000 employees and >€900m global turnover: from 2028
• EU companies with >1,000 employees and >€450m global turnover, plus non-EU companies with >€450m EU-generated turnover: from 2029

Non-EU companies meeting the turnover threshold for EU-generated revenue are in scope regardless of where they are headquartered. The civil liability provision — which allows individuals harmed by inadequate due diligence to sue in-scope companies in EU courts — is the most significant enforcement mechanism and applies regardless of where in the value chain the harm occurred.

ESG Due Diligence in M&A and Investment

In transactional contexts, ESG due diligence assesses the target entity's ESG risk profile and disclosure quality before a deal closes. The purpose is to identify:

• Contingent liabilities — environmental contamination, pending regulatory enforcement, unresolved labour disputes, historical safety incidents with ongoing exposure
• Disclosure gaps — ESG data that is materially incomplete or incorrect in the target's existing reporting, creating restatement risk post-acquisition
• Regulatory exposure — unreported or under-reported GHG emissions that create assurance and penalty risk under CSRD, SB 253, or other applicable frameworks
• Stranded asset risk — capital-intensive assets exposed to climate transition that are not reflected in the target's financial or ESG disclosures
• Reputational risk — supply chain relationships, sourcing practices, or governance structures that conflict with the acquirer's commitments or investor expectations

Private equity and institutional investors increasingly require ESG due diligence as a condition of investment. UNPRI signatories — managing over $120 trillion in assets — have committed to incorporating ESG factors into investment analysis. For PE funds, ESG due diligence has moved from an ethical preference to a fiduciary duty, since unidentified ESG liabilities represent real financial risk at exit.

How to Structure an ESG Due Diligence Programme

For ongoing supply chain due diligence under CSDDD or equivalent frameworks, a risk-proportionate approach is standard: the depth of due diligence is calibrated to the severity and likelihood of adverse impacts, not applied uniformly to every supplier.

• Tier the supplier base: segment by risk level using spend data, geography (high-risk jurisdictions for labour or environmental standards), sector (extractives, manufacturing, agriculture carry higher inherent risk), and relationship type (direct vs. indirect spend)
• Screen at scale: use supplier questionnaires aligned with established frameworks (EcoVadis, CDP Supply Chain, Sedex SMETA) for the broad supplier base; reserve deeper audit-based assessments for high-risk, high-spend relationships
• Identify and document adverse impacts: for identified risks, document the nature of the impact, the company's connection to it (cause, contribution, or direct linkage), and the severity and likelihood
• Implement prevention and mitigation measures: contractual requirements, corrective action plans with timelines, supplier development support, and sourcing alternatives where remediation is not feasible
• Monitor and verify: re-assessment cycles, third-party audit verification for high-risk suppliers, tracking of corrective action plan completion

The Data and Systems Challenge

Effective ESG due diligence at scale is a data management problem. Maintaining an accurate picture of thousands of supplier relationships — their risk profiles, their questionnaire responses, their audit outcomes, and their corrective action status — requires structured data systems rather than spreadsheets and email threads.

The data inputs for supply chain ESG due diligence also feed directly into Scope 3 GHG reporting (Category 1 purchased goods and services, Category 11 use of sold products) and ESRS S2 (workers in the value chain) and ESRS E1 (Scope 3 emissions). A well-designed due diligence programme collects data that serves both the compliance purpose and the ESG reporting purpose simultaneously — reducing the total data collection burden.

See our guide to supply chain sustainability for how Brightest approaches supplier data collection and risk management, and ESG data collection software for the platform capabilities that support both due diligence and disclosure.