Many companies already have a report lying around. An advisor has mapped out the exposure, there has been a presentation, there is a document of several dozen pages with findings. And yet no one on the board knows exactly who is responsible for which obligation, what evidence exists for it, and whether that evidence survives an audit. That is the difference this page is about: a report describes a state at a moment in time. A compliance check delivers a structure that keeps working after the report has disappeared into a drawer.
A report is a photograph. It records what applied at the moment of writing, which risks were identified, and often also what should happen. That is useful as a starting point. But a photograph doesn't tell you who should hold the camera next time. A report rarely contains an owner per obligation, rarely a description of what evidence is sufficient, and almost never a control that is repeatable. Over time, the report becomes dated, regulation has changed, and the organisation is back to zero. That happens more often than boards expect; why companies are caught off guard by legislation is exactly this repetition.
The Compliance Check does not start with a judgement, but with a question: which obligations apply to this organisation, given sector, size and structure. For each obligation it is recorded who the owner is, what evidence is needed to demonstrate that the obligation has been met, and which control makes repetition possible. That is not a synonym for a report with a different layout. It is a different kind of object: something a board can consult when a regulator, an auditor or a shareholder asks how it knows it is in control. What that demonstration looks like in practice is described on the page about how a board demonstrates that it is in control.
Most compliance problems do not arise because no one knew the rule. They arise because no one knew they were responsible for it. A report names a risk; it rarely assigns a name. The Compliance Check does, per obligation, so that no room remains for the assumption that someone else is dealing with it. That sounds simple, but it is exactly the point where many compliance efforts get stuck: policy that exists on paper, and practice that does not match it. That distinction is further explored on the page about the difference between policy and practice.
A compliance check is not a guarantee. It does not deliver a legal judgement, and it does not replace advice on a specific situation. It cannot predict how a regulator will assess an individual case, and it cannot rule out that regulation changes after the check has been carried out. What it does do is enable an organisation to show, at any moment, which obligations have been identified, who is responsible for them, and what evidence belongs to them. That is a different kind of certainty than a legal judgement, and it is deliberately a smaller claim. A report sometimes suggests more certainty than it can deliver, precisely because it looks like an endpoint. The Compliance Check is explicitly not an endpoint, but a structure that requires maintenance.
One reason reports become outdated quickly is that they are often written at European level while implementation varies nationally. The same European rule can lead to a different threshold, a different deadline or a different regulator in one country than in another. A report that does not explicitly account for this national variation gives a distorted picture of what actually applies. The Compliance Check builds this question in structurally: not only which European rule applies, but also how the national add-on deviates from it. How sector and size together determine which rules apply is covered on the pages about how your sector determines which ESG rules apply and how your size determines which ESG rules apply.
A report that is not translated into ownership and evidence costs more than it appears to. Not in direct expenses, but in the risk that no one can reconstruct who knew what and when. What that uncertainty actually means for an organisation is set out on the page about what it costs not to know what you fall under. The Compliance Check is intended to prevent those costs by recording the evidence and the ownership at the moment the obligation is identified, not only once it is asked for.
The Compliance Check from csrdcompliance.net is now being built. Anyone who wants to use the questionnaire and the accompanying structure once it becomes available can sign up for the waitlist. There is currently no working instrument to offer, only the intention to deliver one.
Once obligations have been assigned to owners and substantiated with evidence, a follow-up question often arises: who actually carries out the work, and how much of it can be done with AI. FTE TO AI offers a work scan for that purpose, which calculates per task which part of the work can be taken over by AI, so that the people who own an obligation also know how much of their time will actually still be needed.
Vraag maar welke verplichting op u van toepassing is, en waaraan u dat kunt aantonen.
Answers come from this site’s knowledge base. Not tailored advice, and not a scan of your company.