Compliance and conformity in ESG are how an organisation demonstrates, reliably and openly, its commitment and accountability to ESG principles, and every ESG reporting framework or request, regulated or not, expects that a claim (for example that emissions fell by a stated percentage last year) has been assessed and fairly reflects the position. Meeting ESG standards and requirements, whether imposed by regulation or contract or taken on voluntarily, signals the organisation's commitment, its maturity and its confidence and performance. Compliance usually denotes legal or regulatory obligations binding on an organisation that meets the criteria (sector, size, turnover); conformity is a voluntary showing that something meets standards, documented requirements or specifications, and conforming is one way of showing that legal requirements have been met; of the two, conformity assessment is likely to be used far more widely as organisations seek to show their ESG credentials. Many elements (carbon footprints, environmental management systems, emissions inventories) can be assessed individually and feed an overall ESG assessment, and a robust assessment starts from knowing who has an interest in the claim, who will use it and what they need from it, which keeps it from looking like box-ticking or greenwashing. Assessing conformity means showing that specified requirements (stated needs or expectations) are fulfilled, by systematic evaluation, validation of forward-looking claims and verification of current or historic ones against documented claims and the quantitative and qualitative evidence behind them, using the CASCO standards that govern impartiality, competence and consistency across testing, auditing, inspection, validation, verification, certification and accreditation; some claims are process-driven and simple to assess, others need the expertise and judgement of a competent assessor, and all are read in the context of place, market position, criteria, specifications and regulation. The organisation explains how it chose its evidence, methods and actions and why they suited the claim; the assessing body or assurance practitioner judges, within reason, whether the claim has merit and may probe the soundness of internal checks and the impartiality and competence of those who did them. Assessment may be carried out by a first party (the organisation itself or a body it controls), a second party (someone with a user interest such as an investor, a purchaser or a due diligence expert acting for them) or a third party (independent of both, able to give an opinion or a certificate), and a regulator or other mandating body may insist on third-party assurance or certification before a claim, report or disclosure counts as valid. Because a claim, a disclosure or a report stands on its evidence, the quality and truth of that evidence set the confidence and the assurance level an assessor can give, so the organisation checks the accuracy and certainty of its information and data sources when it builds a claim and manages them transparently; and responsibility for the claim stays with the organisation, never passing to the assessor.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.