Four functions ask every unit for the same kind of answer.
The head of sustainability, HR and Group Affairs, the CFO and the CISO each ask every unit for something: figures, follow-ups or evidence. The answer arises at the unit, is mapped to the group's definitions, is checked before anyone signs, and goes up as a sum with a trail down. That is the same in all four. What a row is, what the register holds and who may see the detail differs, and each section below says it in its own words, with the work we have done there.
[Industrial group, awaiting approval][Industrial group, pre-study, awaiting approval][Municipalities, awaiting approval][The Cards customers, awaiting approval]Our own deliveries, reviewed before every releaseSustainability.
- Electricity invoicepdf
- Meter readingkWh
- Waste contractor's reportkg
- Purchase order lineSEK
- period
- 2026 Q3
- quantity
- 41 200 kWh
- factor
- 0.031 kg/kWh, grade A
- reason
- supplier's own factor
- source
- invoice 88213, page 1
- approved
- specialist, 14 Oct
One site, one quarter: what arrives, the row it becomes, and the total it joins. Made-up values, the form we deliver.
Every site answers the group with invoices, meter readings, waste reports and purchase lines, for energy, water, waste and Scope 1 to 3. We read them where they arrive, map them to a factor from one register, check them before anyone signs, and sum them to the group with the trail kept down to the line. The rows hold up to CSRD and the auditor, and they are what the group steers on.
Built on emission factors, reading source documents, the migration to the revised ESRS and approvals and the trail.
Peab
A factor for every account in the ledger since 2024, delivered as factor tables into the group's own Microsoft environment, with a note on every version change.
[Industrial group, awaiting approval]
Scope 3 from purchase orders across a few hundred reporting units, read from the central spend source. A factor is chosen in a fixed order, supplier-specific, then weight-based, then spend-based, and every row carries a grade that says which it got and what would lift it. A specialist corrects a row at the unit or as a fix in the source and approves the unit's period by role, with every approval logged by name, and the sum goes to the group's sustainability system by unit, region and year. Specialists approve rows instead of retyping them, and the group can walk from a figure in the consolidation down to the purchase order line.
[Industrial group, pre-study, awaiting approval]
A group that grew by acquisition, with reporting companies on several continents, asked what it would take to reduce the manual effort in the environmental reporting its sites deliver every quarter, and what it would be worth. In a few weeks: one working session on Teams, one day on site, and interviews with a handful of units, where we read their own calculation files and followed a quarter from the first invoice to the figure sent up. A unit spent on the order of thirty hours a quarter on its indicators. Four of the five layers a solution needs were already built, by the units, in their own spreadsheets, and the group could receive none of it: what came up was one total per code. The basis for a decision went to group management within the quarter, with the units that carry the result, a first version in the group's own environment, what it takes from the group, its IT and us, and the business case in hours. The material is the group's.
[Municipalities, awaiting approval]
A municipal group where every company counted its climate account its own way, and the requirement was one method with as little manual handling as possible. Open supplier ledgers from eight municipalities are mapped to factors, and the report itself is written in The Cards. Two things learned there are now in the method: the waste contractor's fraction names are agreed before the data is read, and the invoice coding decides how much a model can do. For municipalities, in Swedish.
[The Cards customers, awaiting approval]
Companies and municipalities writing their report under VSME or ESRS in The Cards.
Between companies, your Scope 3 is your supplier's Scope 1 and 2. That is MASSIV+, the standard for climate data in value chains, whose technical development we lead.
The report needs one figure per code. Steering needs the rows under it.
When the rows arrive read, mapped and checked, with a reason on each, the same data answers the questions the report cannot.
Where to act first
In Peab's ledger, the five largest accounts, three percent of them, carried 24 percent of the emissions. The ranking is known before anyone spends an hour on detail.
What to ask a supplier
Every row says which grade its factor has and what would lift it: a weight on the line, a named supplier, the supplier's own factor. Ranked by spend, so the question goes where the answer changes the result.
Which target holds
A deviation against last quarter says whether the number is right. A deviation against the target says whether the plan is. Both run on the same rows while the quarter is still open.
What moved, and why
When the factor database changed version, factors fell by about a fifth while emissions had not changed. The note on the cause went to the auditor before anyone asked.
HR and Group Affairs.
- Training completions from the learning platformdata
- Attestation from an entity outside itform
- A case, registered when it happenscase
- Reference from the whistleblowing channelref
- period
- 2026 Q3
- trained
- 212 of 230 staff
- cases
- 2, conflict of interest
- case detail
- stays in country B
- evidence
- attendance kept at the entity
- approved
- HR manager, four eyes
One entity, one quarter: the counts go up, the detail of a case stays in the country. Made-up values.
The group asks every unit that staff are trained in the code of conduct, that cases of misconduct are registered and followed up, that a policy is in force, and that it can show the audit committee, and state in the annual report, that this is so. Today the answer usually comes once a quarter, in a spreadsheet per country, assembled by hand.
What differs here is where the detail may go. The detail of a case stays in the country, with the roles whose job it is, and the group sees counts, categories and trends. A unit outside the learning platform reports its training figures as an attestation, with the attendance records kept at the unit. The evidence exists and reaches the one whose role allows it; nobody else walks down to it.
Built on approvals and the trail, with the requirements per area in the requirement catalogue. The companies in the group's HR and learning systems come in through their data. The acquired companies and the brands kept apart come in through a named person, an open period and the same definitions.
Who sees a case:
| Role | Sees |
|---|---|
| HR manager in the country | The cases of their own country, in full |
| Group security and compliance | Counts by category, division, country and outcome by default. The content of the categories you decide, such as serious cases |
| The auditor | Approved figures and the trail, read-only |
| Administrator | Periods, roles and settings. Case content [to confirm per assignment] |
| Icons Of | [Access in production to confirm per assignment] |
| AI and agents | No case text goes to an external model. An agent reaches only what its scope allows, and cases can be left out entirely |
The whistleblowing channel stays as it is and keeps its own follow-up. A case from the channel can be registered with its reference, so that the group's counts are complete without the content leaving the channel. Retention per category is set with your privacy owner, and access is removed when a role ends.
[Industrial group, awaiting approval]
A global industrial group that already reports Scope 3 this way asked for its second requirement on the same register, periods and approvals. Cases of misconduct and security incidents registered as they happen across every country, with a category that decides who may see them. Code of conduct training from the entities outside the learning platform, submitted per entity as a quarterly attestation with a name, a date and four eyes on the entity's side, and the group sees which entities have not reported. In its own Azure, on the platform it already uses for Scope 3. The first quarter in the tool is planned for early 2027.
Finance.
- The ledger, every accountSIE
- Voucher behind the entrypdf
- The chart of accountscsv
- Periods and their close datesdate
- period
- 2025-09 to 2026-08
- spend
- 0.9 % of the group
- factor
- 427 t CO2e per MEUR
- reason
- four sectors, weighted
- change
- a new entry, never overwritten
- approved
- controller, not the submitter
One account from the ledger, given the discipline finance already has. Made-up values; account 5460 is followed all the way in emission factors.
Finance is the one function where the book already exists: a voucher behind every entry, a chart of accounts everyone posts against, periods that close, corrections as new entries. We read the ledger where it is, without replacing it, and apply its discipline to the figures the group asks for that the ledger does not hold.
Built on emission factors, which maps every account to its impact, as it has on Peab's ledger since 2024, and approvals and the trail, which gives the emissions, the follow-ups and the training records the controls finance has always had: a period with dates, a submission with a name, an approver who is not the submitter, a figure frozen on approval, a change as a new entry.
The close itself is the next step: the figures from every company, read from each ledger and matched before anyone consolidates. [No reference yet]
Security.
- The repository and its pipelinegit
- The deployed environmentAzure
- An exported low-code solutionzip
- Your control requirementspolicy
- claim
- CSP header not set, 3 URLs
- verified
- by hand, live response
- decision
- fix
- reason
- written by a person
- maps to
- your A.8.26
- proven
- rerun passes
One control from claim to proof, and the review it is part of. Followed all the way in the security review.
For the CISO, the CIO and internal audit: the evidence your own security review asks for before go-live, with each finding mapped to your control requirements.
Built on the security review of code, delivery and platform and approvals and the trail, the part of every delivery your auditor will ask about.
Many groups run their reporting on a low-code solution built a few years ago that is now larger than the platform was meant to carry.
[Industrial group, platform review, awaiting approval]
A group's site reporting had grown over several years into apps, flows, a shared data layer, connectors and a reporting layer, with no consolidated documentation and a bug list longer than anyone had read in one piece. Two model families read the exported solution against the vendor's own guidance, two hundred and forty-two rules from Microsoft's documentation, and a person approved every finding and wrote the reason. The result is a plan in waves, bundled by root cause, and the system documentation that did not exist before. The plan names the parts to rebuild as code in the group's own Azure.
Start with a pre-study.
In any of the four functions the first step is one requirement and a few units that volunteer, and in security one review.
Start with a pre-study