Companies interested in “ESG” disclosure and accounting may be having the same reaction we are to much of the recent popular business press. Thinking carefully about Environment, Social, and Governance policies and practice, we think, still makes sense.

Companies have customer-, investor-, and other stakeholder-relations purposes for paying attention to ESG. The Wall Street Journal reported Oct. 25 (subscription required) that those with good ESG policies may be able to obtain more favorable terms on business insurance, for example. And there is an endless stream of articles on ESG from all sides, including company initiatives, ESG financing and bonds, and ESG ETFs. But everyone recognizes that ESG disclosure and accounting – like “sustainability” reporting and accounting before it – carries risks similar to financial disclosure and accounting. If what you say is not true, you can be criticized or sued. Hence the involvement of lawyers.

Many are looking to the Securities and Exchange Commission’s promised rulemaking on climate risk disclosure and accounting as a guide to ESG practice. The SEC may have useful things to say, but one should be clear that climate risk is only a component of ESG. It may be important, quantifiable, and highly scrutinized, but it is distinct from compliance with environmental regulations, success of diversity, equity, and inclusion policies, stakeholder and community engagement, avoidance of corruption, slave labor, and so forth. The SEC has not said that it intends to propose regulations on disclosure or accounting of any of those other ESG matters. Equally important, pronouncements on disclosure typically do not extend to how you achieve the performance underlying and necessary to support the disclosure.

Think of what a company does with respect to ESG as having two parts: what happens before any disclosures and what happens after. It is important not to confuse the two: talking about ESG is not the same as doing ESG. Recently, the emphasis has been on the former, not the latter. Companies want to derive benefits from their ESG disclosures but avoid having those disclosures harm their reputation and brand or become liabilities in related environmental, labor and employment, fraud and corruption, or other matters. A company doesn’t want its own statements cited against it and seeks to avoid claims for fraud or misrepresentation in the securities or other contexts. A company wants to have done what it needs to have done before making disclosures to avoid criticism, to defend against lawsuits, and to defend its overall brand.

Up front, the company may want to examine the systems it has in place behind its planned ESG disclosure and accounting that allow it to know that what it says is true. For example, it may want to consider whether its environmental, anti-corruption, human resources, or compliance management systems provide suitably reliable and complete information to back up its ESG reporting. Building ESG disclosure on a concrete and demonstrable foundation of sustained and superior performance is easier and less risky than the other way around: wanting to make ESG claims and then figuring out if there is anything to back them up.

These management systems are often more effective when the company integrates them with its overall business. If the newly-minted “ESG systems” are pasted over the top of what the operating management must do anyway, such systems may not help and may not be well-received by internal or external stakeholders. The systems ought to be seen as useful for the day-to-day tasks of running the business and generating superior ESG performance on a routine basis, not just fodder for creating an annual or quarterly report. Many companies already have in place many of the systems necessary for effective ESG performance, even though they might not recognize them as such (e.g., anti-corruption and environmental management systems, diversity programs, anti-child labor and slavery policies, etc.).

The systems should also generally provide information, but not in a way that will inappropriately increase enforcement risk. Cautions are important, but alarms on a hair trigger often do not help. Finally, the systems cannot be so bureaucratic and resource-intensive that they become manuals on a shelf that no one implements. That’s worse than nothing.

Management systems and the performance and information they generate provide among the best defenses to criticism or litigation. So, having set them up at the outset, one can use them to prevent turbulence in the first instance and to mitigate the downside when things go awry.

Note that by “management system” we do not mean a subjective scoring system for the purpose of making that annual report. We mean the operational and business processes and procedures used consistently to produce superior ESG performance. That includes, but certainly is not limited to, measuring that performance, recognizing that in some contexts subjective scoring may be helpful. But scoring systems have issues should public scrutiny be attracted or litigation arise. As everyone knows from restaurant reviews and employee evaluations, subjective “point” scales are ordinal, not cardinal. For example, 5 may be better than 4 and 4 better than 3, but typically, the distance between 5 and 4 is much smaller than the difference between 4 and 3 in the reviewer’s mind. 5 is a great score, 4 is a good one, but 3 is a bad one and infrequent. 2 and 1 may never appear at all. So arithmetic averages of scores are of questionable use. Comparison of scores on incommensurate topics can also be difficult. Exactly how many environmental compliance points are equal to a diversity and inclusion point? And, undue attention to scoring may ultimately reduce the credibility of the underlying effort to achieve sustainable and meaningful ESG performance if companies are perceived to be “working to the test” rather than doing the right thing.

In sum, ESG merits some disciplined thinking and doing. It’s not only about the promised SEC climate risk regulation. It’s not only about point systems. It’s a question of doing ESG before talking ESG (that is, “walking the talk”). It’s a question of what needs to be done to achieve the customer-, investor-, and other-focused purposes without undue increase in risk and how systems must be deployed to achieve the promised and intended ESG performance reliably and consistently, which can also be beneficial in the event that criticism or litigation arises in the aftermath of ESG disclosures.