Four functions ask every unit for the same kind of answer.

The head of sustainability, HR and Group Affairs, the CFO and the CISO each ask every unit for something: figures, follow-ups or evidence. The answer arises at the unit, is mapped to the group's definitions, is checked before anyone signs, and goes up as a sum with a trail down. That is the same in all four. What a row is, what the register holds and who may see the detail differs, and each section below says it in its own words, with the work we have done there.

Working withPeab[Industrial group, awaiting approval][Industrial group, pre-study, awaiting approval][Municipalities, awaiting approval][The Cards customers, awaiting approval]Our own deliveries, reviewed before every release

Sustainability.

What the unit sends
  • Electricity invoicepdf
  • Meter readingkWh
  • Waste contractor's reportkg
  • Purchase order lineSEK
One row in the register
Site 14, electricity
period
2026 Q3
quantity
41 200 kWh
factor
0.031 kg/kWh, grade A
reason
supplier's own factor
source
invoice 88213, page 1
approved
specialist, 14 Oct
What goes up
The group's total, by scope
Scope 118 %
Scope 29 %
Scope 373 %
To The CSRD report, the auditor, and the steering

One site, one quarter: what arrives, the row it becomes, and the total it joins. Made-up values, the form we deliver.

Every site answers the group with invoices, meter readings, waste reports and purchase lines, for energy, water, waste and Scope 1 to 3. We read them where they arrive, map them to a factor from one register, check them before anyone signs, and sum them to the group with the trail kept down to the line. The rows hold up to CSRD and the auditor, and they are what the group steers on.

Built on emission factors, reading source documents, the migration to the revised ESRS and approvals and the trail.

Peab

A factor for every account in the ledger since 2024, delivered as factor tables into the group's own Microsoft environment, with a note on every version change.

[Industrial group, awaiting approval]

Scope 3 from purchase orders across a few hundred reporting units, read from the central spend source. A factor is chosen in a fixed order, supplier-specific, then weight-based, then spend-based, and every row carries a grade that says which it got and what would lift it. A specialist corrects a row at the unit or as a fix in the source and approves the unit's period by role, with every approval logged by name, and the sum goes to the group's sustainability system by unit, region and year. Specialists approve rows instead of retyping them, and the group can walk from a figure in the consolidation down to the purchase order line.

[Industrial group, pre-study, awaiting approval]

A group that grew by acquisition, with reporting companies on several continents, asked what it would take to reduce the manual effort in the environmental reporting its sites deliver every quarter, and what it would be worth. In a few weeks: one working session on Teams, one day on site, and interviews with a handful of units, where we read their own calculation files and followed a quarter from the first invoice to the figure sent up. A unit spent on the order of thirty hours a quarter on its indicators. Four of the five layers a solution needs were already built, by the units, in their own spreadsheets, and the group could receive none of it: what came up was one total per code. The basis for a decision went to group management within the quarter, with the units that carry the result, a first version in the group's own environment, what it takes from the group, its IT and us, and the business case in hours. The material is the group's.

[Municipalities, awaiting approval]

A municipal group where every company counted its climate account its own way, and the requirement was one method with as little manual handling as possible. Open supplier ledgers from eight municipalities are mapped to factors, and the report itself is written in The Cards. Two things learned there are now in the method: the waste contractor's fraction names are agreed before the data is read, and the invoice coding decides how much a model can do. For municipalities, in Swedish.

[The Cards customers, awaiting approval]

Companies and municipalities writing their report under VSME or ESRS in The Cards.

Between companies, your Scope 3 is your supplier's Scope 1 and 2. That is MASSIV+, the standard for climate data in value chains, whose technical development we lead.

The report needs one figure per code. Steering needs the rows under it.

When the rows arrive read, mapped and checked, with a reason on each, the same data answers the questions the report cannot.

Where to act first

In Peab's ledger, the five largest accounts, three percent of them, carried 24 percent of the emissions. The ranking is known before anyone spends an hour on detail.

What to ask a supplier

Every row says which grade its factor has and what would lift it: a weight on the line, a named supplier, the supplier's own factor. Ranked by spend, so the question goes where the answer changes the result.

Which target holds

A deviation against last quarter says whether the number is right. A deviation against the target says whether the plan is. Both run on the same rows while the quarter is still open.

What moved, and why

When the factor database changed version, factors fell by about a fifth while emissions had not changed. The note on the cause went to the auditor before anyone asked.

HR and Group Affairs.

What the unit sends
  • Training completions from the learning platformdata
  • Attestation from an entity outside itform
  • A case, registered when it happenscase
  • Reference from the whistleblowing channelref
One row in the register
Entity 31, country B
period
2026 Q3
trained
212 of 230 staff
cases
2, conflict of interest
case detail
stays in country B
evidence
attendance kept at the entity
approved
HR manager, four eyes
What goes up
Code of conduct trained, by division
Division A96 %
Division B92 %
Division C81 %
Not reported3 entities
To The audit committee and the annual report, as counts

One entity, one quarter: the counts go up, the detail of a case stays in the country. Made-up values.

The group asks every unit that staff are trained in the code of conduct, that cases of misconduct are registered and followed up, that a policy is in force, and that it can show the audit committee, and state in the annual report, that this is so. Today the answer usually comes once a quarter, in a spreadsheet per country, assembled by hand.

What differs here is where the detail may go. The detail of a case stays in the country, with the roles whose job it is, and the group sees counts, categories and trends. A unit outside the learning platform reports its training figures as an attestation, with the attendance records kept at the unit. The evidence exists and reaches the one whose role allows it; nobody else walks down to it.

Built on approvals and the trail, with the requirements per area in the requirement catalogue. The companies in the group's HR and learning systems come in through their data. The acquired companies and the brands kept apart come in through a named person, an open period and the same definitions.

Who sees a case:

RoleSees
HR manager in the countryThe cases of their own country, in full
Group security and complianceCounts by category, division, country and outcome by default. The content of the categories you decide, such as serious cases
The auditorApproved figures and the trail, read-only
AdministratorPeriods, roles and settings. Case content [to confirm per assignment]
Icons Of[Access in production to confirm per assignment]
AI and agentsNo case text goes to an external model. An agent reaches only what its scope allows, and cases can be left out entirely

The whistleblowing channel stays as it is and keeps its own follow-up. A case from the channel can be registered with its reference, so that the group's counts are complete without the content leaving the channel. Retention per category is set with your privacy owner, and access is removed when a role ends.

[Industrial group, awaiting approval]

A global industrial group that already reports Scope 3 this way asked for its second requirement on the same register, periods and approvals. Cases of misconduct and security incidents registered as they happen across every country, with a category that decides who may see them. Code of conduct training from the entities outside the learning platform, submitted per entity as a quarterly attestation with a name, a date and four eyes on the entity's side, and the group sees which entities have not reported. In its own Azure, on the platform it already uses for Scope 3. The first quarter in the tool is planned for early 2027.

Finance.

What the unit sends
  • The ledger, every accountSIE
  • Voucher behind the entrypdf
  • The chart of accountscsv
  • Periods and their close datesdate
One row in the register
Account 5460, consumables
period
2025-09 to 2026-08
spend
0.9 % of the group
factor
427 t CO2e per MEUR
reason
four sectors, weighted
change
a new entry, never overwritten
approved
controller, not the submitter
What goes up
Emissions by account, largest first
Purchased steel11 %
Freight7 %
Energy5 %
Account 54601.3 %
To The CFO and the auditor, with the trail to the voucher

One account from the ledger, given the discipline finance already has. Made-up values; account 5460 is followed all the way in emission factors.

Finance is the one function where the book already exists: a voucher behind every entry, a chart of accounts everyone posts against, periods that close, corrections as new entries. We read the ledger where it is, without replacing it, and apply its discipline to the figures the group asks for that the ledger does not hold.

Built on emission factors, which maps every account to its impact, as it has on Peab's ledger since 2024, and approvals and the trail, which gives the emissions, the follow-ups and the training records the controls finance has always had: a period with dates, a submission with a name, an approver who is not the submitter, a figure frozen on approval, a change as a new entry.

The close itself is the next step: the figures from every company, read from each ledger and matched before anyone consolidates. [No reference yet]

Security.

What the unit sends
  • The repository and its pipelinegit
  • The deployed environmentAzure
  • An exported low-code solutionzip
  • Your control requirementspolicy
One row in the register
Control DAST-002
claim
CSP header not set, 3 URLs
verified
by hand, live response
decision
fix
reason
written by a person
maps to
your A.8.26
proven
rerun passes
What goes up
61 controls, by decision
Approved44
Not applicable7
Fix4
Risk accepted3
Not verifiable3
To The CISO, the CIO and internal audit, as a plan in waves

One control from claim to proof, and the review it is part of. Followed all the way in the security review.

For the CISO, the CIO and internal audit: the evidence your own security review asks for before go-live, with each finding mapped to your control requirements.

Built on the security review of code, delivery and platform and approvals and the trail, the part of every delivery your auditor will ask about.

Many groups run their reporting on a low-code solution built a few years ago that is now larger than the platform was meant to carry.

[Industrial group, platform review, awaiting approval]

A group's site reporting had grown over several years into apps, flows, a shared data layer, connectors and a reporting layer, with no consolidated documentation and a bug list longer than anyone had read in one piece. Two model families read the exported solution against the vendor's own guidance, two hundred and forty-two rules from Microsoft's documentation, and a person approved every finding and wrote the reason. The result is a plan in waves, bundled by root cause, and the system documentation that did not exist before. The plan names the parts to rebuild as code in the group's own Azure.

Start with a pre-study.

In any of the four functions the first step is one requirement and a few units that volunteer, and in security one review.

Start with a pre-study
Om designen: V3.1, första liveversionen

Kräver granskning före publicering. Texten på Partnerships (engelska och svenska) är skriven ur MASSIV+-sidan och How we work och ska granskas av Birger och Hans. Partnerraden på startsidan sätter namnen typografiskt; riktiga logotyper (MASSIV+, FKG, Vinnova) kräver tillstånd från respektive organisation innan de byts in. Elmhav Sweden står inte med: repot har ingen publik beskrivning av partnerskapet.

Vad som är med. v2 oförändrad visuellt, med Crosbys avskalade startsida: heron med "Talk to a senior expert", bandet "Tested before you" utan stapelfiguren, människorna med karusellen ("Join us" går till info@iconsof.se), bandet "Start with one requirement, at a fixed price" som sajtens enda prisbudskap, partnerraden, lagren och avslutningen på petrol. Menyn: Where we work, How we work, People, Partnerships, Start, EN/SV och knappen till bokningen. Ny sida: Partnerships, på båda språken.

Vad som väntar. Intelligence, Letters, What we build och The Cards är avstängda. De byggs inte, står inte i menyn, sitemap, llms.txt eller bland .md-kopiorna, och länkar in i dem visas som vanlig text.

Så läggs en del tillbaka. Sätt brytaren till true i release i src/lib/site.ts och bygg om. Menyraden, sidorna, länkarna och Intelligence-annonsen på startsidan kommer tillbaka av sig själva. Startsidans v2-text ligger i content/archive/, som inte publiceras.

Logotyperna. Listan står i partners i src/lib/site.ts. Lägg en bild i public/images/partners/ och skriv sökvägen i logo; höjd och gråskala sköts av CSS.