Beyond the Heatmap: What Makes a Sustainability Gap Analysis Meaningful?

A gap analysis is a sensible early step, particularly when an organisation adopts a new framework. It gives a structured read of how current disclosures compare with a standard or a rating methodology. It can be produced quickly, including by automated tools. The output is often a familiar red, amber and green heatmap.

That heatmap is useful. It is also easy to over-read. A report-based assessment identifies what appears to be missing from the material it reviewed. It does not, on its own, establish whether the information exists inside the organisation, whether anyone asked for it, whether an analysis was ever performed or why management chose not to disclose it.

A gap in published disclosure is not necessarily a gap in operational performance. The distinction matters, because the whole point of the exercise is to decide what to do next.

What does a gap analysis actually establish?

Picture a company commissioning an assessment of its existing disclosures against IFRS S1 and S2 or against an ESG rating provider’s criteria. These assessments can require substantial work and investment, whether performed by advisers or by software that maps a report against a framework. Before reading the results, it is worth asking what decision the company hopes to make with them.

Is it establishing a baseline before a first reporting cycle? Planning a multi-year reporting programme? Trying to improve a particular rating? Or identifying the barriers that remain after a reporting cycle has already been completed? The same heatmap serves these aims very differently. The fourth is a different exercise from the first.

A report-based assessment answers one question well: what appears to be missing from the material reviewed. It does not automatically answer the questions that determine the response, such as whether the information exists, whether it was requested and why it was not disclosed. Those questions are the subject of the rest of this article. They are also where evidence and traceability start to matter more than the colour of a cell.

Applicability comes before scoring

Consider a hypothetical port terminal operator. It handles cargo but does not own or operate a commercial shipping fleet. An industry template oriented towards marine transportation may include metrics such as vessel counts, fleet fuel consumption and ballast water management. Scored literally, the operator looks full of gaps.

Most of those are not gaps at all. This is where the design of IFRS S1 and S2 matters. IFRS S1 requires an entity to refer to and consider the applicability of the disclosure topics in the SASB Standards when identifying its sustainability-related risks and opportunities. It must also refer to and consider the applicability of the associated metrics when deciding what to disclose. IFRS S2 uses the same formulation for its own industry-based guidance on climate-related risks and opportunities. The obligation is to consider applicability, which the standards express as a requirement. It is not an obligation to apply the guidance in full.

That distinction is the one a literal heatmap tends to miss. The IFRS Foundation is explicit that this industry-based guidance is neither a floor nor a ceiling for disclosure and that reporting with the SASB Standards is not an all-or-nothing proposition. Some topics may not apply to a particular business. Other relevant matters may fall outside the industry standard entirely. A diversified business model whose operations span several industries may warrant considering more than one. Material information required by the standards must still be disclosed; the flexibility is in applicability, not in a blanket exemption.

It also helps to separate two kinds of applicability. A fleet-specific activity metric may simply not apply to an operator with no fleet. The environmental risks from vessels visiting the terminal may still be relevant. A concise, documented rationale for why a metric does not apply is usually more useful than populating an irrelevant line to complete an index. Where an assessment methodology prescribes a particular treatment for non-applicable items, that methodology governs.

Literal versus substantive disclosure

A second way a heatmap can mislead is by scoring presentation rather than information. Take a hypothetical employer that reports 600 male and 400 female employees, a total of 1,000. A criterion asking for the gender split as percentages may be marked as a gap because the percentages do not literally appear. The figures of 60 per cent and 40 per cent are derivable from what is reported, assuming the definitions, boundaries and dates all match.

An assessment that requires explicit percentages is not wrong to flag this. A substantive reading recognises that the underlying information already exists and that the gap is one of presentation. The two readings call for different effort. It is worth being careful, though: derivability does not automatically satisfy a mandatory requirement or earn a rating credit if the criterion genuinely requires the figure to be stated.

The same pattern appears in narrative disclosures. An anti-corruption or legal compliance criterion may be scored as missing because a report uses different terminology from the criterion. It may also be scored as missing because the report addresses the subject at length without covering one specific element the criterion asks for. The task is to distinguish genuinely equivalent wording from a genuinely missing element. Analysts and criteria are often precise for good reason. Precision there is not pedantry.

The problem with partial scores

Heatmaps are good summaries and poor diagnostics. The amber cell is the clearest example. Amber usually means “partial”. That single label can hide positions that are not remotely comparable.

Scope 3 emissions make the point. A company might report none of the fifteen categories, one, eight, fourteen or all fifteen. A simplistic assessment marks the middle three as partial and moves on. Yet a retailer that reports a single category while excluding purchased goods and services, often its largest source, may have a far wider gap than a company that reports fewer categories but covers everything relevant to it. Counting categories is not a proxy for emissions coverage, data quality or compliance. The point applies equally to how each category is calculated.

Materiality and the rationale for exclusions

“Not material” is one of the most common reasons given for an absent disclosure. It is also one of the hardest to assess from a document alone. It helps to keep two ideas apart. The GHG Protocol frames Scope 3 categories in terms of relevance to the inventory and its boundary. IFRS materiality is about whether information could reasonably be expected to influence the decisions of the primary users of general purpose financial reports. A category can be relevant for inventory purposes and the related information still assessed for materiality under the standards.

An assertion that a category or topic is immaterial is not the same as evidence that supports the conclusion. A preliminary screening, the business model and value chain context or other suitable evidence may be needed to stand behind it. Two retailers do not necessarily have the same emissions profile, so the same exclusion can be reasonable for one and not for another.

It is worth separating the reasons a disclosure might be absent: genuine immateriality, inapplicability, an assessment that was never carried out, information that is unavailable, a phased implementation under transitional reliefs and a deliberate management decision not to disclose. These look identical on a heatmap and call for very different responses.

Commercial sensitivity deserves particular care. Confidentiality does not automatically remove a mandatory requirement. IFRS S1 contains a narrow exemption that can apply to qualifying information about a sustainability-related opportunity, subject to conditions. It still requires the entity to disclose that it has used the exemption. It does not extend to risks or to GHG emissions. Treating it as a general escape hatch is a common and avoidable error.

Diagnose why the gap exists

This is where a gap analysis earns its value. Identifying that a cell is red is identification. Working out why it is red is diagnosis. The two can point to completely different work. The same apparent gap can rest on a disclosure issue, a missing analysis, an unmade decision, a data limitation or a process that never requested the information.

It also helps to separate disclosure and presentation gaps from gaps in information, analysis, process and actual performance. A missing training-hours disclosure does not establish that training is poor. It may mean the records exist but were not reported. It may mean the data was never collected. Not every process gap is a performance failure. Treating one as the other leads to the wrong fix.

Where an ESG rating provider already supplies indicator-level feedback, a separate assessment can duplicate the identification work that has already been done. The additional value then lies in diagnosing why a particular credit was not awarded and what can reasonably be changed, rather than re-listing the same gaps. It is worth remembering that a rating score is not a measure of IFRS compliance. No responsible assessment should promise a specific score improvement.

AI and the limits of document-only analysis

Automated and AI-assisted tools are genuinely good at parts of this. They can locate disclosures across a long report, map text to framework requirements, extract metrics, calculate derived figures such as the percentages above and sometimes recognise that two differently worded passages mean the same thing. For a first pass over a large document, that is valuable work.

Their ability to judge nuanced partial coverage, materiality, applicability and the sufficiency of evidence depends on the inputs they are given, the methodology behind them and the validation applied to their output. This is not a claim that AI can never do these things. A human analyst restricted to the same documents faces the same information limit. Neither a person nor a model can reliably infer an undisclosed management decision or confirm whether information exists internally without evidence from inside the organisation.

That is the real boundary. It is about information rather than intelligence. Our view of AI reading ESG reports is that it widens what a document review can cover, while the step from identification to diagnosis still depends on management engagement and professional judgement.

Initial versus residual gap analysis

A first, document-based assessment is well suited to planning, prioritising and budgeting. It can be proportionate, especially where an existing assessment or a rater’s feedback already provides a baseline. Its limitation is structural: at that stage no one yet knows which apparent gaps are presentation, which are missing analysis and which are genuine data problems.

A second assessment, carried out after reasonable efforts to close the gaps, tends to be far more actionable. By then the team knows what was requested, what exists, what was attempted and what was deferred, together with the reason in each case. None of this means delaying the identification of mandatory gaps until publication. Interim checks during the cycle remain essential, as does resolving material issues before release where required. The point is about where the diagnosis becomes reliable, not about postponing it.

A worked example shows the difference. A purely identifying assessment records “Scope 3 Category 1 not reported” and colours it red. A diagnostic one records that the category’s relevance was assessed, that procurement information was requested, that the available information was not yet sufficient for a reliable calculation and that improvements are planned for the next cycle. The second version is honest about the status without implying that the explanation alone satisfies a mandatory requirement. It also points towards the applicable estimation methods and any reliefs that may apply in the meantime.

What makes the resulting roadmap meaningful?

A roadmap earns its name when each item carries more than a colour. Useful entries describe the status, the extent of the gap, its significance, the underlying cause, the supporting evidence and the route to resolution. With that in place, it becomes possible to sort the work by type: what can be addressed through a disclosure change, what needs new analysis, what requires better systems and data and what rests on a management decision.

Ownership and timing belong on the roadmap too, at a high level, so that each item has a home and a sequence. The aim is a plan the organisation can act on and defend, informed where relevant by what assurance will later examine and by what the standards actually require. A number on its own, whether a count of gaps or an overall score, is not that plan.

Ace CSR supports Malaysian companies with gap analysis and benchmarking, IFRS S1 and S2 advisory and sustainability reporting, focusing on the diagnosis and the roadmap rather than the heatmap alone.