Every CSR claim eventually meets somebody who asks for proof. Here is the evidence hierarchy assessors use, and how to rank your own before someone else does.
The moment it goes wrong
There is a particular meeting that happens in a lot of companies. Something has been claimed in writing. An award submission, a tender response, a customer audit, an assurance process. And somebody, politely, asks to see the proof.
What follows is familiar. People start searching email. Somebody says they are sure there was a letter. A colleague who ran the programme has left. The photographs exist but nobody recorded the date. Eventually the company produces an internal presentation that mentions the activity, and offers it as evidence, and it is accepted as roughly nothing.
The activity was real. It happened, it was worthwhile, and the people involved remember it clearly. None of that is in question. The problem is that nothing was created at the time that anybody outside the company could rely on now.
The evidence hierarchy
Assessors, auditors and questionnaire reviewers all use some version of the same ranking, whether or not they write it down. Strongest to weakest:
1. An external award. Somebody outside the company ran an evaluation and made a decision. It is the strongest form of evidence because a third party staked their own credibility on it.
2. External recognition in writing. A letter, an email, a certificate of appreciation, a speech, a formal acknowledgement from a partner organisation or a public authority. Weaker than an award because there was no evaluation, but strong because the source is external and identifiable.
3. Public disclosure. Something you published that anybody can find. It is your own word, so it ranks below external sources, but publishing carries reputational exposure, which is what gives it weight.
4. Internal documents. Approved policies, board or committee minutes, signed approvals, formal internal reports. Real evidence of process and decision making. Entirely your own word, so it sits mid table.
5. Internal email. Shows something was discussed or arranged. Rarely shows it was completed, and almost never shows its effect.
6. A report written for another purpose. A slide in a sales deck, a paragraph in an induction pack, a mention in an internal newsletter. Weakest, because the document was never intended to establish the fact and nobody checked it when it was written.
Why the order is what it is
Two principles do all the work.
Distance from the company. The further the source sits from your organisation, the more the evidence is worth. Your own account is the least persuasive version of any event, not because you are dishonest but because you are the interested party.
Whether someone with nothing to gain put their name to it. This is the sharper of the two. An award body that names you as a winner has exposed its own reputation. A community partner who writes a letter has put their organisation’s name behind your account. That exposure is what converts a statement into evidence.
Once you understand those two principles you can rank any piece of evidence you hold without needing a list, including forms of evidence nobody anticipated.
Your own account of what you did is the least persuasive version of it, no matter how carefully you write it. Evidence gets its strength from who else was willing to say it.
The trap: confusing rigour with publicness
This one catches sophisticated companies more often than unsophisticated ones, which is what makes it worth spelling out.
Many companies produce genuinely rigorous reporting that is not public. Detailed sustainability submissions to a lender. Comprehensive performance packs to a parent company or a group head office. Data returns to a joint venture partner or a major customer under an agreement. This reporting is frequently far more thorough, more granular and more carefully checked than anything the company publishes on its website.
It is still not public disclosure.
If the criterion asks what is publicly available, then the test is what a member of the public can find and read without asking your permission. Confidential reporting fails that test regardless of quality. The distinction is about accessibility, not about rigour.
This lands badly, because the company knows its lender reporting is the best work it does in this area, and it feels like the assessment is refusing to look at the strongest thing it has. But the assessment is measuring something specific, which is transparency, and confidential reporting does not evidence transparency however good it is.
The practical consequence. If you hold rigorous confidential reporting and thin public disclosure, you are usually a short step away from a much better position. The data exists and has already been checked. What is missing is a published version. Producing a public summary from reporting you already prepare is one of the cheapest genuine improvements available to most companies.
Data integrity: the same number three ways
Here is a problem that appears in most evidence reviews and surprises people every time.
The same metric appears as three different figures in three different documents. The annual review says one thing, the award submission says another, the internal deck says a third. Nobody was careless and nobody inflated anything.
What happened is that nobody defined the unit.
Take volunteering. One programme can honestly produce all of these:
| Figure | What it counts |
|---|---|
| 120 | Individual people who took part at least once |
| 960 | Hours contributed in total |
| 310 | Participations, counting each person each time they attended |
All three are correct. All three describe the same programme. Published side by side across three documents without their definitions, they look like an organisation that cannot keep its story straight, and an assessor who notices will start checking everything else.
The same pattern hits beneficiary counts, which can be direct or indirect, training numbers, which can be sessions or attendees or completions, and contribution figures, which can be cash only or cash plus in kind plus staff time.
The fix is the definition, not the figure. Write down what each metric counts, in one line, before you argue about which number is right. Then restate every document to that definition. Companies that skip straight to reconciling numbers spend weeks and end up with an agreed figure that nobody can reproduce next year.
A short self audit
This takes an afternoon and it is the most useful hour of preparation available before any submission.
- Write down your five biggest CSR claims. The ones you would lead with.
- For each, find the strongest piece of evidence you actually hold, not the evidence you assume exists. Go and look.
- Mark it against the hierarchy, one to six.
- For anything at level four or below, ask whether level two or three evidence could still be obtained. A partner will usually write a letter about something from last year. They rarely will about something from four years ago.
- For anything you cannot evidence above level four, decide now whether to soften the claim or to drop it.
Most companies find their headline claims cluster at levels four and five. That is normal and it is fixable, but only forward in time, which is why doing this before a deadline rather than during one matters so much.
If several of your claims also fail the tests in when CSR earns you credibility, fix the evidence first. A well evidenced modest claim beats an unevidenced impressive one in every assessment there is.
How ESGweise helps
We run evidence reviews. That means taking your claims, finding what you actually hold against each one, ranking it, and telling you where it will not hold up. Where evidence is missing we identify what can still be obtained and from whom, and where it cannot, we say so, because discovering that during an assessment is considerably worse than discovering it now.
We also fix the definition problem, which is usually a half day of work that prevents a recurring embarrassment.
See our assurance readiness and sustainability reporting services, and our guide to social audit standards for how formal verification works.
If you have a submission, tender or audit coming, the evidence review should happen before you write, not after. Speak with our team.
Conclusion
Every CSR claim eventually meets somebody who asks for proof, and at that point the quality of the work stops mattering and the quality of the record takes over. Evidence is ranked by distance from your company and by whether someone with nothing to gain put their name to it. Confidential reporting, however rigorous, does not evidence transparency. And when the same figure appears three ways, fix the definition before you argue about the number. Rank your five biggest claims this week, while there is still time to improve them.
Frequently asked questions
What counts as evidence in a CSR assessment?
Anything that shows an activity happened, ranked by how far the source sits from your company. An external award is strongest, followed by written external recognition such as a letter or email from a partner or authority, then public disclosure, then internal documents like approved policies and board minutes, then internal email, and weakest of all a report written for a different purpose that happens to mention the activity.
Is our sustainability report to our lender public disclosure?
No, however detailed it is. Public disclosure means a member of the public can find and read it without your permission. Reporting to a lender, an investor or a parent company is confidential reporting. It is often far more rigorous than anything published, but if the assessment criterion asks what is publicly available, rigour does not substitute for accessibility. Companies confuse these two constantly.
Why do the same CSR figures differ across our documents?
Almost always because nobody defined the unit. A volunteering figure can count people, hours, or participations, and one activity can produce three legitimate but very different numbers. The fix is to write the definition down first and restate every document to it, rather than to argue about which number is correct.
How far back can we reconstruct CSR evidence?
Usually one to two years, sometimes three if the activity involved external parties who keep their own records. Beyond that, reconstruction becomes unreliable, because the people involved have moved on and the contemporaneous record was never created. This is the practical argument for collecting evidence as activity happens rather than at submission time.