The three terms overlap but answer to different audiences. Here is what each one means in practice, who is asking for it, and how to avoid buying the wrong one.
Three words, three different audiences
Companies hear all three terms in the same week, often from the same consultant, and reasonably assume they are variations on one idea. They are related, but they are not interchangeable, and buying the wrong one is one of the more expensive mistakes available in this field.
Here is each in one line, without the hedging.
CSR is what you give and how you behave. Contribution, conduct, community.
ESG is what you are measured on. Environmental, social and governance factors, scored by somebody outside your company.
Sustainability is the operating change. Doing the business itself differently, in energy, waste, water, materials or supply chain.
That is the whole distinction. Everything else is detail.
Where they overlap and where they do not
They overlap in content. A workplace safety programme is a CSR initiative, an ESG social indicator and an operational sustainability measure all at once. Nothing is stopping one activity from serving all three.
Where they separate is in purpose and in audience. CSR is judged on whether it is genuine and well run. ESG is judged on whether it is disclosed, comparable and verifiable. Sustainability is judged on whether the numbers moved.
This is why a company can be genuinely good at CSR and score badly on ESG. The work happened. It was never written down in a form somebody outside the company could check. The assessor is not disputing that you did it. The assessor cannot see it.
CSR asks whether you did something worthwhile. ESG asks whether you can prove it in a format somebody else chose. Most companies are much stronger on the first than the second.
Who is actually asking
This is the part that decides your answer, so be precise about it.
Community, employees and the public ask CSR questions. What do you do for the country you operate in? What is it like to work here? Did you turn up when something happened locally? Award bodies mostly sit here too.
Lenders, investors and rating agencies ask ESG questions. They want scores, policies, governance structures and disclosed data. They are assessing you as a risk, and an absence of information reads as risk.
Regulators and large customers increasingly ask sustainability questions. These arrive as specifics. What are your emissions. What is in your product. Where does this material come from. What happens to the packaging. These questions cannot be answered by a policy document, because they need actual data from actual operations.
If you can name the person asking, you can name the workstream you need.
A short decision guide
| If the pressure is | Start with | Because |
|---|---|---|
| A single customer questionnaire | Answering that questionnaire properly | It is a bounded task with a deadline, and it tells you which framework your customer uses |
| An award or recognition application | CSR strategy and evidence | Assessors test structure and proof, not spend |
| A lender or investor request | ESG, targeted at their framework | They will name the standard they read, so build to that one |
| A regulator or a disclosure rule | Sustainability data and controls | Regulatory answers need measured data, not narrative |
| Employee or community expectations | CSR strategy | The audience cares about substance and consistency, not disclosure format |
| Nobody, but the board asked | CSR strategy, one page | Cheapest way to get organised before pressure arrives |
The pattern across that table is simple. Build toward the person who is actually asking, in the format they actually read.
The expensive mistake
Watch for this one. It happens often, and it is costly in a way that is hard to reverse.
A large customer sends a supplier questionnaire. It has forty questions. Somewhere in it there are ESG headings. The company panics slightly, concludes it needs an ESG programme, and commissions a full reporting exercise. Six months and a substantial fee later there is a report.
The customer did not want a report. The customer wanted forty boxes filled in, most of which asked for policies the company already had and data it could have assembled in a fortnight. The report is not useless, but it answered a question nobody asked, and the actual deadline was probably missed while it was being written.
The reverse mistake also exists and is less discussed. A company facing a genuine investor ESG assessment decides to run a CSR campaign instead, because CSR is more visible and more enjoyable. The investor assessment does not improve, because it was never measuring that.
Both mistakes come from the same root, which is choosing the workstream by what it is called rather than by who is asking.
What each one honestly costs in effort
Fees vary too much to be useful, but internal effort is more predictable, because it is driven by how many departments have to be involved and how much data has to be assembled.
CSR strategy is the lightest. It needs a handful of interviews, an inventory of what you already do, one or two workshops to choose themes, and sign off. The people involved are mostly senior, and the volume of data required is low. It is the only one of the three that a company can realistically complete in a quarter alongside normal work, which is covered step by step in our guide to the first 90 days.
ESG is heavier, and the weight is in data rather than thinking. It pulls information from finance, HR, procurement, facilities and operations, usually for a defined reporting period, and it typically exposes that the same metric is recorded differently in different systems. Expect the data reconciliation to take longer than the writing. If a rating is the goal, our overview of ESG ratings for financial institutions covers how the scoring logic works.
Sustainability is the heaviest, because it is the only one that requires the business to change what it does. Anything real here involves capital decisions, procurement changes or process changes, and those move at the speed of the operations they affect rather than the speed of the project. The reporting part is small. The operational part is not.
None of that is a reason to avoid the harder ones. It is a reason not to start with them by accident.
They do converge
Over a few years these three stop being separate. A CSR strategy gives you the governance and the themes. ESG gives you the measurement discipline and the external framing. Sustainability gives you results that are worth measuring in the first place. Companies that have been at this a while find the distinction increasingly artificial, and they are right.
That convergence is the destination, though, not the entry point. Starting everywhere at once from a standing start reliably produces three half-built workstreams competing for the same finance manager’s time.
How ESGweise helps
Most of the value in this decision is in the first conversation, before anything is commissioned. We scope which of the three your situation actually calls for, based on who is asking and what they will accept, and we will say when the answer is smaller than you expected. If you are still working out whether you have a CSR strategy at all, start with what a CSR strategy actually is.
See our sustainability strategy and sustainability reporting services.
Scoping the right starting point is a short conversation and it saves months. Speak with our team.
Conclusion
CSR is what you give and how you behave. ESG is what you are measured on. Sustainability is the operating change. They overlap in content and separate in audience, and the correct starting point is decided by naming who is asking you the question. Answer that person, in the format they read, and let the rest follow.
Frequently asked questions
Is CSR the same as ESG?
No. CSR describes what a company contributes to society and how it behaves, and its audience is mostly communities, employees and the public. ESG is a set of factors that external parties measure you against, and its audience is lenders, investors, rating agencies and large customers. A company can have a strong CSR record and score poorly on ESG, usually because the CSR work was never documented in a form an assessor can use.
Which should a company start with?
Start with whoever is applying pressure. If the questions are coming from the community, employees or an award body, start with CSR. If they are coming from a lender, an investor or a rating agency, start with ESG. If they are coming from a regulator or a large customer asking about emissions, waste or supply chain, you are being asked about sustainability and the answer involves changing operations, not writing a report.
Do we need ESG reporting if nobody has asked for it?
Usually not yet. Full ESG reporting is a significant undertaking that pulls data from finance, HR, procurement, facilities and operations. Doing it before anyone requires it is a common and expensive misstep. A better sequence is to answer the specific request in front of you properly, then build toward reporting once you know which framework your audience actually reads.
Can we do all three at once?
You can, but it rarely goes well as a first move. The three draw on the same internal people and the same underlying data. Running them in parallel from a standing start tends to produce three half-finished workstreams. Sequencing them, starting with the one under real pressure, gets you to a defensible position faster.