BCCD Green

For boards and executive teams, ESG is not about publishing and although the prevailing winds may have blown to and fro since then, for most boards and executive teams, ESG is not about publishing an annual sustainability report or articulating a commitment to net zero. It is about whether the organisation has the governance, data, controls and assurance needed to know that its commitments are real, deliverable and evidenced: “We’re on track with ESG, and I know we are.”

In this article, Michael Lucas, a partner at BRAVE, argues that having the right ESG infrastructure matters in the UAE, in particular. Since COP28, the regulatory and market environment has continued to mature. The UAE’s Federal Decree-Law No. 11 of 2024 on the Reduction of Climate Change Effects has created a more formal national framework for emissions management, mitigation and adaptation. Listed companies on UAE exchanges are already subject to sustainability reporting expectations. ADGM has introduced an ESG Disclosures Framework for larger in-scope entities. The UAE Sustainable Finance Working Group, including the Central Bank of the UAE, SCA, DFSA and FSRA, has also advanced principles on climate-related financial risk, sustainability-related disclosures and climate transition planning.

The direction of travel is therefore unmistakable. UAE company directors are increasingly expected to explain not only what they are doing on ESG, but how ESG risks and opportunities are governed, how data is produced, how targets are monitored, and how stakeholders can trust the disclosures being made.

There are already strong local and regional examples of good practice. First Abu Dhabi Bank won the 2024 MEIRA award for Best ESG & Sustainability Report in the Middle East in the large-cap category. Tabreed won the equivalent mid-cap category. Dolphin Energy won Best Sustainability Report at the 2025 Abu Dhabi Sustainable Business Leadership Awards. These examples matter because they show that credible ESG reporting is no longer judged by presentation alone. Good reporting links strategy, governance, risk, targets, performance and stakeholder accountability.

For directors, the fundamental question is therefore changing. It is not: “What do we want to say about ESG?” It is: “Are we confident in the statements we are making”. The ‘Say-Do’ gap is closing.

That requires clear ownership at board and executive level. Some organisations will establish a dedicated sustainability or ESG committee. Others will embed responsibility through the full board, the audit committee, the risk committee, or a combined governance structure. The structure matters less than the quality of attention. ESG needs sufficient board time, clear management accountability, reliable reporting lines and a direct link to business strategy, capital allocation, risk appetite and performance management. This can be a challenge for companies that have traditionally focused on financial assurance and audit only.

The risk of weak governance is not theoretical. Overstated claims, inconsistent data, unsupported targets and vague transition plans can all create exposure to allegations of greenwashing. They can also undermine investor confidence, customer trust, employee engagement and regulatory credibility. In a market such as the UAE, where sustainability is increasingly linked to national strategy, finance, infrastructure, real estate, tourism, logistics and energy transition, weak ESG governance can quickly become a strategic issue.

Confidence comes from having the right internal architecture. Directors need to have confidence – they need to know that ESG reporting is supported by defined responsibilities, documented methodologies, effective systems and appropriate assurance. The same discipline that has developed around financial reporting now needs to be applied to material ESG and climate information.

For internal audit and GRC teams, this creates a clear mandate. They should help the organisation move beyond narrative and into evidence. That means providing insight and assurance over:

• Strategy design, including whether ESG priorities are genuinely connected to business objectives, risk appetite and stakeholder expectations.
• Governance and accountability, including board oversight, executive ownership, policies, procedures and delegated authorities.
• Metric definitions and reporting criteria, including whether ESG KPIs are clearly defined, consistently applied and understood by the business.
• Data management, including source systems, manual inputs, controls over data collection, completeness, accuracy and ownership.
• Calculations, estimates and judgements, including emissions calculations, baselines, targets, assumptions and methodologies.
• Operational controls, including the end-to-end processes that generate ESG performance data across assets, business units, functions and third parties.
• Consolidation and disclosure, including the review, challenge and approval of information before it is reported externally.
• Delivery of transition and improvement plans, including whether sustainability commitments are being translated into funded, governed and monitored change programmes.

This is especially important because the transition to lower-carbon, more sustainable and more resilient business models is not just a reporting exercise. For many UAE organisations, it is a transformation programme. It may affect energy use, buildings, fleets, procurement, technology, financing, insurance, supply chains, customer propositions and workforce capability. It may also require difficult trade-offs between growth, cost, resilience and climate commitments.

Internal audit and risk professionals therefore need to provide more than hindsight. They need to provide foresight. That means identifying where ESG commitments are not yet supported by sufficient capability, data or controls. It means challenging whether targets are realistic. It means testing whether sustainability risks are integrated into enterprise risk management. It means assessing whether climate-related risks are reflected in business continuity, investment decisions, third-party management and strategic planning.

Technology will play an increasingly important role. ESG data often sits across multiple systems, spreadsheets, suppliers and operating companies. Organisations that rely only on manual collection and annual reporting cycles will struggle to provide timely, reliable and decision-useful information. Better practice will involve clearer data ownership, automated feeds where possible, workflow controls, exception reporting, evidence repositories and dashboards that allow management to monitor progress during the year, not only after year-end.

The opportunity for UAE organisations is significant. Strong ESG governance and assurance is a sign of corporate maturity – it can help companies demonstrate credibility to regulators, investors, lenders, customers and employees – both at home and internationally. It can also improve resilience, reduce inefficiency, support access to sustainable finance and strengthen the organisation’s ability to deliver on national and global climate ambitions.

But this will only happen if ESG is treated as a core governance and performance issue, not a communications exercise. Reporting may be the visible output, but the real work sits underneath: strategy, accountability, data, controls, assurance and continuous improvement.

Only when those foundations are in place can directors be confident that what they disclose is not simply well-written, but true.

Michael Lucas is a partner at BRAVE, a leading advisor on governance, risk management and assurance.  You can reach him at [email protected]