CSDDD and double materiality: What risk leaders need to know

The ESG regulatory environment is continuing to evolve, and with it comes new responsibilities for internal audit and risk leaders. Among the most significant developments is the Corporate Sustainability Due Diligence Directive (CSDDD) – a regulation that requires organisations to take accountability for adverse human rights and environmental impacts across their own operations and their value chains.

At the same time, ESG reporting is shifting toward a double materiality lens, requiring companies to assess not only how ESG issues affect the business, but also how the business impacts the environment and society. These changes bring new expectations – and opportunities – for internal audit to lead in readiness, assurance, and governance.

What is the CSDDD?

The CSDDD aims to foster sustainable and responsible corporate behaviour by requiring organisations to:

• Identify and assess human rights and environmental risks
• Address those risks across both internal operations and supply chains
• Ensure appropriate policies, controls and reporting mechanisms are in place

This is not just a compliance issue. It reflects a fundamental shift in how companies are expected to operate, engage with stakeholders, and demonstrate their impact.

Double materiality: A new risk perspective

Double materiality expands the traditional concept of financial materiality by asking two key questions:

1. How does ESG affect the business (financial materiality)?
2. How does the business affect people and the planet (impact materiality)?

This approach is central to EU frameworks like the CSRD and ESRS and is critical for preparing credible, comprehensive ESG reports. Internal audit has a key role to play in ensuring both perspectives are considered in risk assessment, audit planning, and assurance work.

Internal audit’s role in CSDDD and double materiality

The breadth of CSDDD and the depth of ESG reporting standards call for greater coordination between internal audit, risk management and senior leadership. Key areas where internal audit can support include:

• Regulatory and operational readiness: Internal audit can examine how well the organisation is prepared to meet the requirements of CSDDD, including due diligence over environmental and human rights impacts.
• Supply chain governance: Given the directive’s emphasis on value chain accountability, internal audit must assess the organisation’s outsourcing and supplier controls, particularly in high-risk areas.
• Data and audit trails: As external auditors prepare to issue limited – and later reasonable – assurance over ESG reports, internal audit will be expected to provide early insight into how ESG data is gathered, validated and monitored across the year.
• Risk coverage in audit plans: Internal audit should review the organisation’s risk register and audit plan to ensure ESG-related risks, including double materiality assessments, are appropriately covered.
• Challenging assumptions and interpretation: ESG disclosures are increasingly subject to scrutiny. Internal audit must support credibility by challenging how ESG data is interpreted, what assumptions underpin it, and how those decisions are made.
• Greenwashing risk mitigation: Double materiality brings added focus on integrity. Internal audit should play a role in ensuring key ESG data points are well-supported and not misleading, helping the organisation avoid reputational or regulatory risk.

Building awareness and engagement

Internal audit leaders and risk managers can also help prepare the organisation by:

• Facilitating regular dialogue with the board and executive teams
• Driving awareness of how ESG strategy links to operational controls
• Supporting internal training and upskilling across departments
• Leading or participating in entity-level readiness assessments

By engaging early, internal audit can help organisations move beyond checklists and build resilience around ESG and CSDDD compliance. These developments are not temporary – they represent a long-term shift in how companies are expected to operate responsibly and transparently.

At Crowe, we support organisations in preparing for CSDDD and double materiality by embedding ESG risks and controls into audit frameworks, governance processes and risk strategies.