GRI, TCFD, or CDP: Which ESG Reporting Framework Is Right for Your Business?

Environmental, social, and governance (ESG) reporting has its own alphabet. GRI, TCFD, CDP, ISSB, and CSDS all appear in requests from customers, lenders, and investors. For a small or mid-sized business, the first challenge is knowing which one actually applies.

The good news is that you rarely need all of them. The frameworks overlap heavily, and most rely on the same core data. Once you understand who uses each one, the choice becomes much clearer.

This guide explains why several frameworks exist and what each one covers. It then shows how to choose based on who is asking, and how to build one data set that serves them all.

Why there are multiple frameworks and which stakeholders use which

The frameworks grew up separately, over roughly two decades, to serve different users. That history explains much of the confusion. It also explains why they are now converging.

Each framework was built to answer a different question. Some focus on your company’s impact on the environment and society. Others focus on how climate change affects your company’s finances. Some are reporting standards, and others are disclosure platforms that collect your answers.

A simple way to sort them is by audience:

• GRI serves a broad audience, including communities, employees, customers, and civil society.
• TCFD, and the standards that replaced it, serve investors and lenders who want to understand financial risk.
• CDP serves investors and large buyers who want comparable climate data through a single questionnaire.

Single and double materiality

The difference in focus is often described as single and double materiality. Investor-focused standards ask which sustainability matters affect the company’s finances. GRI asks which matters the company affects. Both views are legitimate, and many stakeholders want to see both.

Consider rising wildfire risk in Alberta. From a financial view, the question is how smoke, evacuations, or insurance costs affect the business. From an impact view, the question is how the business contributes to the emissions behind the risk.

The data underneath is largely the same. What changes is the question it is used to answer.

Many businesses use more than one framework. An Alberta manufacturer might publish a short GRI-referenced sustainability report for its community and customers. The same company might also answer a CDP supply chain request from a major buyer.

GRI: who asks for it and what it covers

The Global Reporting Initiative publishes the GRI Standards, the most widely used sustainability reporting standards in the world. GRI focuses on impact: how your business affects the economy, the environment, and people.

The standards have three parts. Universal Standards apply to every reporter. Sector Standards apply to specific industries, such as oil and gas or agriculture. Topic Standards cover individual subjects, such as emissions, water, waste, health and safety, and labour practices.

Reporting “in accordance” or “with reference”

GRI asks you to determine your material topics, the issues where your impacts are most significant. You then report on those topics in detail. Organizations can report in accordance with GRI, or report with reference to it when they use only selected standards.

For a first report, the “with reference” option is often the practical choice. It lets you report on the topics you can support with data, using GRI’s definitions and structure. You can move toward full “in accordance” reporting as your data matures.

How emissions fit in

Emissions have their own GRI topic standard, GRI 305. It asks for Scope 1, Scope 2, and, where available, Scope 3 emissions, along with the methods used. A GHG inventory built on the GHG Protocol feeds directly into it.

Determining material topics

Determining material topics is a structured process. It usually starts with a list of possible topics for your sector. You then consider your actual and potential impacts, and talk with the people affected.

The result is a short list of topics that deserve the most attention. For a small business, that list might hold five or six topics, not 30. Depth on the topics that matter is more useful than thin coverage of everything.

Customers, community partners, and employees are the usual audiences. A family-owned construction firm in Red Deer might use GRI to report on safety, local hiring, and fuel use. That report answers the questions its municipal clients and employees ask most.

When GRI is the right fit

GRI suits businesses whose stakeholders care about more than climate. If customers ask about safety records, community investment, or labour practices, GRI gives you one structure for all of it.

It also suits businesses that want a public report. Municipal tenders, Indigenous partnership agreements, and community relations often benefit from a document anyone can read. GRI gives that document a recognized shape.

TCFD: why it is becoming the default for finance and lending

The Task Force on Climate-related Financial Disclosures (TCFD) published recommendations in 2017. They organize climate disclosure around four pillars: governance, strategy, risk management, and metrics and targets. The focus is financial: how climate change could affect a company’s business, strategy, and results.

Each pillar asks a plain question:

• Governance: who in the business oversees climate-related risks and opportunities?
• Strategy: how could climate change affect the business over the short, medium, and long term?
• Risk management: how does the business identify, assess, and manage climate risks?
• Metrics and targets: what does the business measure, including emissions, and what targets has it set?

Physical and transition risk

TCFD splits climate risk into two types. Physical risks come from the climate itself, such as floods, wildfires, hail, and extreme heat. Transition risks come from the shift to a lower-carbon economy, such as policy, technology, and market changes.

Alberta businesses face both. A Calgary distributor may worry about hail damage to its fleet and yard. The same business may also face rising fuel costs or customers asking for lower-carbon delivery.

From TCFD to the ISSB and CSSB standards

TCFD has since been folded into newer standards. The task force disbanded in 2023, and the International Sustainability Standards Board (ISSB) took over monitoring its recommendations.

The ISSB published two standards in 2023: IFRS S1 on general sustainability disclosures and IFRS S2 on climate. IFRS S2 fully incorporates the TCFD recommendations, so a company that applies it meets them.

In Canada, the Canadian Sustainability Standards Board (CSSB) released two standards in December 2024. CSDS 1 covers general sustainability disclosures and CSDS 2 covers climate. Both are aligned with the ISSB standards and are currently voluntary.

The Canadian Securities Administrators paused work on mandatory climate disclosure rules for public companies in April 2025. That pause affects listed issuers directly. It does not stop the questions flowing to their suppliers and borrowers.

Why lenders care

Voluntary does not mean irrelevant. Large companies that adopt CSDS 2 will need data from their value chains, including suppliers. The standards also give Canadian lenders and investors a common reference point for the questions they ask.

For SMEs, the pressure comes mostly through finance. Federally regulated banks follow OSFI Guideline B-15, which sets expectations for climate risk management and disclosure aligned with the Canadian standards. Banks need information from their borrowers to meet those expectations.

A mid-sized trucking company seeking a fleet loan may be asked how fuel prices and climate policy affect its costs. A short answer organized around the four pillars shows the lender that management has thought it through.

A TCFD-style answer for a small business

You do not need a 40-page report to use the TCFD structure. One page per pillar is often enough for a lender conversation.

• Governance: name the owner or manager responsible, and how often climate topics reach leadership.
• Strategy: list the two or three climate risks that matter most, and any opportunities.
• Risk management: explain how those risks are reviewed, even if the process is informal today.
• Metrics and targets: report Scope 1 and Scope 2 emissions, and any reduction goal you have set.

CDP: the supply chain use case

CDP runs a global disclosure system. Companies answer a detailed questionnaire on climate change, and in some cases on water and forests. CDP then scores the responses, and investors and buyers use the results.

For most SMEs, the first contact is through CDP’s supply chain program. A large customer that is a CDP supply chain member can request that its suppliers respond. The questions cover emissions by scope, reduction targets, governance, and risks and opportunities.

The CDP questionnaire has been aligned with the ISSB’s climate standard. Preparing for CDP therefore builds skills that carry over into other climate reporting.

How CDP scoring works

Responses receive a score on a scale from A, the highest, down to D-. Companies that are asked to respond and do not are marked as not disclosing. Buyers can see how their suppliers score, which is why a credible first response matters more than a perfect one.

Scores reward progress, not just results. A supplier with a modest footprint but no data, governance, or targets will score lower than one that measures and manages carefully.

Planning your response

Responding takes planning. The questionnaire opens on a set schedule each year, and customers set their own deadlines for suppliers. Starting early leaves time to gather data and get internal sign-off.

Picture an Edmonton packaging supplier whose largest customer is a national consumer goods company. The customer requests a CDP response as part of its own supplier engagement program. The supplier needs an emissions inventory and a clear account of its reduction plans to respond credibly.

A practical sequence looks like this:

1. Confirm the request. Check which questionnaire modules your customer wants and the deadline it has set.
2. Build the inventory. Complete Scope 1 and Scope 2 first, using the GHG Protocol.
3. Document governance. Name who oversees climate topics and how decisions are made.
4. Set a target, if you can. Even a simple reduction goal shows direction.
5. Review and submit. Have a senior leader approve the response before it goes out.

How to choose based on your business situation

Start with who is asking and why. The framework your most important stakeholder requests is usually the right first step.

• A customer sends a CDP request. Respond to CDP, starting with a solid Scope 1 and Scope 2 inventory.
• Your bank asks about climate risk. Organize your answer around the TCFD pillars, which now sit inside the ISSB and CSSB climate standards.
• Customers, employees, or your community want to know your broader impact. A GRI-referenced report covers environmental and social topics together.
• Nobody has asked yet. Build a GHG inventory first. Every framework relies on emissions data, so it is never wasted effort.

When requests arrive together

Sometimes two requests land in the same quarter. A trucking company might receive a CDP request from a retailer and a climate questionnaire from its bank.

In that case, start with the request that has the nearest deadline or the largest commercial impact. Build the data so it serves both, and reuse the same figures in each response.

Where the frameworks overlap

The frameworks share more than their acronyms suggest. All of them rely on GHG Protocol emissions data. GRI and the ISSB standards both ask how sustainability is governed. CDP and the ISSB climate standard ask similar questions about climate risks and targets.

That overlap is good news for a small team. One well-built data set can answer several requests, with different formatting for each audience.

Building one data set for every framework

The most efficient approach is to separate data collection from reporting. Collect your figures once, in one place, and then format them for each audience.

A core ESG data set for an SME usually includes:

• Scope 1 and Scope 2 emissions, with the method and emission factors used.
• Energy use by source, such as natural gas, electricity, and vehicle fuel.
• Any reduction targets, with a base year and a target year.
• The person or committee responsible for sustainability topics.
• A short list of material risks and opportunities.
• Social data your stakeholders ask about, such as safety records or local hiring.

Keep the records behind each figure: invoices, service logs, and payroll summaries. Every framework expects claims to be backed by evidence, and auditors and customers may ask to see it.

Assign one owner for the data set. That person does not need to produce every number, but they keep the definitions consistent from year to year.

What a first ESG report looks like for an SME

A first report does not need to look like a large company’s annual sustainability report. For most SMEs, eight to 12 pages is plenty. Clarity matters more than length.

A practical outline looks like this:

1. A short message from the owner or president. Two or three paragraphs on why the business is reporting and what it has learned.
2. About the business. What you do, where you operate, and how many people you employ.
3. How the report was prepared. The framework used, the reporting period, and the boundary.
4. Material topics. The issues you chose to cover, and why they matter to your stakeholders.
5. Performance data. Emissions, energy, and any social figures, with a note on method.
6. Goals and next steps. What you plan to improve before the next report.

Write in plain language. A customer, a lender, and a new employee should all be able to read it in one sitting.

Be clear about what is not yet measured. Stating that Scope 3 work begins next year is more credible than leaving the gap unexplained.

Preparing for what comes next

Reporting expectations in Canada are still settling. The CSSB standards are voluntary today, and mandatory rules for public companies are paused. That can make it tempting to wait.

Waiting carries its own risk. Large buyers and lenders are building their own reporting systems now, and their questions reach suppliers first. The businesses that answer early tend to become the preferred suppliers when expectations tighten.

There is also a practical reason to start. Emissions data improves with each year of collection. A business with three years of consistent data can show a trend, which a first-year reporter cannot.

Watch for three signals over the next few years. The first is any change in Canadian securities rules on climate disclosure. The second is how your bank applies OSFI Guideline B-15 in its lending conversations. The third is what your largest customers ask of their suppliers.

A quick glossary of the acronyms

The alphabet is easier to manage with a reference list. Here are the terms used in this guide.

• CDP: a global disclosure system that collects and scores company responses on climate, water, and forests.
• CSA: the Canadian Securities Administrators, the umbrella group for provincial and territorial securities regulators.
• CSDS 1 and CSDS 2: the Canadian Sustainability Disclosure Standards, covering general sustainability and climate.
• CSSB: the Canadian Sustainability Standards Board, which issues the CSDS standards.
• GHG Protocol: the most widely used method for measuring and reporting greenhouse gas emissions.
• GRI: the Global Reporting Initiative, publisher of impact-focused sustainability reporting standards.
• IFRS S1 and IFRS S2: the ISSB’s general sustainability and climate disclosure standards.
• ISSB: the International Sustainability Standards Board, part of the IFRS Foundation.
• OSFI: the Office of the Superintendent of Financial Institutions, which oversees federally regulated banks.
• TCFD: the former Task Force on Climate-related Financial Disclosures, now absorbed into the ISSB standards.

Common mistakes when choosing a framework

The most common mistake is starting too big. A business that attempts a full GRI report, a CDP response, and a climate scenario analysis at once often finishes none of them.

The second is reporting without a baseline. Claims of progress mean little without a base year to compare against. Build the inventory first, then report.

The third is copying another company’s report. Material topics, risks, and targets should reflect your business, not a larger competitor’s. Stakeholders can tell the difference.

The fourth is treating reporting as a one-off project. Frameworks expect annual updates. Plan for the second year when you design the first.

Making the decision

There is no single best framework. The right choice depends on your audience, your sector, and the questions you are already receiving. Most SMEs start with one framework and add others as requests grow.

Two practical points apply in every case. First, collect data once and report it many times. Second, report only what you can support with records, because every framework expects claims to be backed by evidence.

If you are unsure which framework fits, or you have a request with a deadline, talk to a Terrivis advisor. Book a free consultation and we will help you map the right path for your business.