ISSB vs ESRS vs GRI: Which Question Is Each One Asking?

Your team says it's “doing ISSB and GRI and ESRS.”

Three workstreams. Three questionnaires. Three sets of sign-offs.

There's a problem with that sentence.

ISSB, GRI and ESRS are not three difficulty levels of the same reporting exercise. They start from different questions, serve different audiences, and draw different boundaries around what counts as material. Treat them as one exercise and you risk collecting too much data, duplicating work, and still missing what a specific framework actually requires.

So the better starting point isn't “which frameworks are we doing?” It's:

What question is each one asking?

ISSB asks: How could sustainability affect the business?

The ISSB's IFRS S1 and S2 standards are built around sustainability-related financial disclosures.

IFRS S1 covers sustainability-related risks and opportunities that could reasonably be expected to affect an entity's cash flows, access to finance, or cost of capital over the short, medium or long term. IFRS S2 applies that same lens specifically to climate.

The primary audience is investors and other users of general-purpose financial reporting.

So ISSB effectively starts from one question:

Could this sustainability issue affect the company's prospects?

That makes the lens financially oriented. It doesn't mean impacts on people or the environment are irrelevant. They become relevant to ISSB when they connect to risks, opportunities and financial effects for the entity.

The standards took effect for annual reporting periods beginning on or after 1 January 2024, subject to each jurisdiction's adoption or use requirements.

Adoption is progressing across markets, but the regulatory approach differs by country. The IFRS Foundation maintains jurisdiction-level profiles showing how each one is adopting or otherwise using the standards.

GRI asks: How does the business affect the world?

GRI starts from the opposite direction.

The GRI Standards focus on an organisation's most significant impacts on the economy, environment and people, including impacts on human rights.

The audience is far broader than investors. Employees, communities, customers, regulators and civil society can all have an interest in those impacts.

The central question is:

What significant impacts does our organisation have, and how are we managing them?

That is impact materiality.

GRI gives companies a way to report on the effects of their activities and business relationships, rather than starting from whether those effects change enterprise value.

The distinction matters because an issue can have a significant impact on people or the environment even when its financial effect on the company isn't yet clear.

ESRS asks both

ESRS deliberately combines the two.

Under the European Sustainability Reporting Standards, companies assess sustainability matters through double materiality. Two questions, not one:

• Impact materiality: How does the company affect people and the environment?
• Financial materiality: How do sustainability matters affect the company's development, performance, position, cash flows, access to finance or cost of capital?

A topic can become material through either lens.

That's the key difference.

ESRS doesn't ask you to choose between impact and financial materiality. It asks you to assess both.

The distinction that sets your scope

This isn't academic. It directly determines your reporting workload.

Under a financially focused lens, you start with sustainability risks and opportunities that could affect the company's prospects.

Under double materiality, you add a second, independent assessment of the organisation's impacts on people and the environment.

Take a manufacturing company with operations near a local community.

Suppose its water use creates a significant local environmental impact, but the financial consequences for the company are currently limited.

Under an impact-focused assessment, that issue could still be material.

Under a purely financial assessment, it would need to connect to the company's prospects to qualify.

Under ESRS, either dimension can make it material.

That's why materiality isn't a reporting formality.

It decides what enters your reporting scope in the first place.

Where you sit changes which framework matters most

For companies in India and the Gulf, the answer is increasingly shaped by regulation, investors and customers.

For Indian listed companies, BRSR remains the domestic requirement, while ISSB is becoming increasingly relevant as a global, investor-focused baseline.

Across the Gulf and wider Middle East, jurisdictions are moving toward ISSB-aligned sustainability and climate disclosures, though the exact requirements and timelines differ by market.

Europe creates a third route, and you don't need to be an EU company to feel it.

A company outside the EU that supplies products, services or financing to a European company within CSRD scope can find that customer asking for sustainability information from its value chain.

The reporting requirement might not apply to you directly, but the resulting data request can still reach you through the value chain.

The 2026 EU shift you can't ignore

Two changes have reshaped the European picture, and both point in the same direction: fewer companies in scope, less to report, but the underlying architecture intact.

Scope narrowed

Directive (EU) 2026/470, the Omnibus I package, limits the main CSRD scope to companies exceeding both 1,000 employees and €450 million in net turnover, for financial years beginning on or after 1 January 2027.

That removes a large number of companies from direct CSRD obligations.

It does not remove sustainability data requests across supply chains, though the revised framework does add protections limiting how much information larger reporters can demand from smaller value-chain companies.

Reporting simplified

On 3 July 2026, the European Commission adopted revised ESRS, cutting mandatory datapoints by more than 60% and total datapoints by more than 70%.

One timing point matters: these revised standards are not yet legally effective. They enter force after the EU scrutiny process and are intended to apply from financial years beginning on or after 1 January 2027, subject to completion of the legal process.

The headline isn't the datapoint count.

It's the direction of travel.

The EU is simplifying reporting while retaining the core double-materiality architecture.

So the underlying question is unchanged:

What affects the company, and what impact does the company have?

The landscape is converging

Here's the point many reporting teams miss:

These frameworks are different, but they're not isolated.

EFRAG and GRI have published an interoperability index mapping how ESRS disclosure requirements and GRI disclosures relate, aimed at reducing duplicate reporting.

EFRAG and the IFRS Foundation have also published guidance on the alignment between ESRS and the ISSB Standards and how to apply both more efficiently.

The direction is clear:

More interoperability. Less unnecessary duplication.

One data foundation, not three projects

This is where the practical lesson lands.

If you treat ISSB, GRI and ESRS as three independent reporting projects, you build three overlapping data-collection exercises and answer the same question three times over.

A better sequence:

1. Start with the reporting obligation that matters most to your business.
2. Identify the materiality lens behind it.
3. Map the required disclosures and datapoints.
4. Build a controlled source dataset.
5. Reuse the underlying information wherever the interoperability mappings support it.
6. Add framework-specific information only where it's genuinely required.

ESRS and ISSB have substantial areas of alignment but are not identical. GRI and ESRS have significant commonality, but a mapping never means every requirement is automatically satisfied.

So the objective isn't “one report for everything.”

It's one controlled data foundation that supports multiple reporting outputs.

Collect the underlying data once where possible. Map it carefully. Reuse it where the standards allow.

That's how you cut duplication without cutting quality.

The harder problem is data governance

Framework selection gets most of the attention.

Data governance is usually the tougher problem, and it's where every framework converges again.

Whichever standard you report under, the numbers behind your disclosures have to be traceable.

Who entered the number?

Where did it come from?

Who reviewed it?

What evidence supports it?

Who approved the final disclosure?

The framework might change.

The need for controlled, reviewable, defensible data does not.

This is where Karbon fits.

Karbon gives you a single controlled data foundation underneath your reporting workflows, with clear ownership, supporting evidence and a configurable maker-checker-approver workflow before information reaches your disclosures.

When the same emissions or workforce number is used across an ISSB filing, a GRI report and an ESRS disclosure, you're working from one governed source with a clear audit trail, rather than reconciling three separate spreadsheets and hoping they agree.

The takeaway

ISSB, GRI and ESRS ask different questions.

ISSB focuses on the sustainability risks and opportunities that could affect the company's prospects.

GRI focuses on the organisation's most significant impacts on the economy, environment and people.

ESRS brings both together through double materiality.

Once that distinction is clear, your reporting strategy gets much simpler.

You don't need three disconnected data-collection exercises.

You need a clear materiality approach, a mapped data model, and a controlled process for collecting, reviewing and approving the information behind your disclosures, so the question you answer once can serve every report that asks it.

Collect the underlying data once where possible.

Map it carefully.

Reuse it where the standards allow.

That's how you reduce reporting duplication without reducing reporting quality.

Sorting out which reporting questions apply to your business, then collecting and governing the data behind them with a defensible audit trail, is where Karbon fits.