Ask most organizations what their ESG strategy is, and the answer is a report: a document produced annually, reviewed by a handful of people, filed, and cited when a customer or investor asks. That report is not a strategy. It is evidence that a strategy is supposed to exist somewhere behind it, and increasingly, the entities asking (regulators, institutional investors, procurement teams running supplier due diligence) are looking for the strategy, not the document that describes it.
Reported and defensible are different tests
A reported ESG position answers "what did the organization do." A defensible one answers "why should anyone believe the number, and what happens when it is challenged." Those are different tests, and an organization can pass the first while failing the second.
The gap shows up in three places, consistently:
The methodology behind the numbers. A reported carbon figure states a total. A defensible one can show how the boundary was drawn (which emissions sources, which time period, which calculation standard), because the first serious question from an auditor or a skeptical board member is rarely "is the number right." It is "how was the number produced, and would it hold up if someone else tried to reproduce it."
The gap between commitment and mechanism. A reported strategy states a target: net-zero by a given year, a supplier-diversity percentage, a governance ratio. A defensible one can show the specific mechanism that gets the organization from where it is to that target, with the intermediate milestones that let someone check progress before the target date arrives rather than only after it has been missed.
Who owns the number when it is wrong. A reported figure has an author, usually whoever compiled the annual filing. A defensible one has an accountable owner with the standing to correct it, explain a shortfall, and revise the mechanism, not just update next year's report to a smaller number with no account of what changed.
Why regulation makes this more urgent, not more complicated
Sustainability regulation is tightening, not loosening, across most jurisdictions organizations operate in, and the direction of travel is consistent: more disclosure, tied more directly to verifiable methodology, with real consequences for a claim that does not hold up. California's Senate Bill 253, the Climate Corporate Data Accountability Act, is one concrete example: it requires companies with more than $1 billion in annual revenue doing business in the state to publicly disclose their emissions, with reporting obligations phasing in starting in 2026. That makes the defensibility question more urgent. It does not make it more complicated. An organization that already required methodology, mechanism, and ownership for its own reasons, before a regulator asked, is mostly reformatting existing work when a new disclosure requirement lands. An organization that built only the report is starting the real work from the requirement forward.
The board-level version of this question
For a board or a sustainability and risk committee, the practical test is simple: pick any claim in the current ESG report and ask who could defend it, under questioning, with the underlying methodology in hand. If the honest answer is "no one specific," the report is ahead of the strategy, and the strategy is the piece worth fixing first. Reordering that (methodology and mechanism before the next report ships, not after) is usually less work than it sounds, because most of the underlying data already exists; it has just never been organized to answer the "why should this be believed" question directly.
Where this fits
This is the scope of environmental and sustainability consulting: ESG methodology, carbon strategy, and the regulatory compliance work that makes a sustainability position defensible rather than merely reported. Where the same defensibility question shows up in board governance and funding strategy for a mission-driven organization rather than a carbon or ESG number, that is the adjacent scope of non-profit and governance consulting.
If the honest answer to "who could defend this claim" is not yet clear inside your own ESG report, that gap is worth closing before the next filing cycle, not after a regulator or an investor closes it for you. Start a conversation.