Environmental, Social, Governance

For a long time the material for judging a company from outside was numbers. Revenue growth, whether it turned a profit, how much it owed. Then companies with perfectly healthy numbers kept seizing up anyway. An accident at a supplier's factory triggered a boycott. A structure where one founder held every decision produced a dispute that froze the business. A leak of customer data ended several contracts at once. None of those risks appeared anywhere on a financial statement.

So the people supplying capital and the people buying software started asking about what sat outside the numbers. The trouble was that everyone asked differently. One investor wanted carbon emissions, one enterprise buyer wanted supplier labor conditions, another wanted board records. The company answering built a fresh set of documents for each one.

Environmental, social, and governance criteria — ESG for short — organize those questions into three buckets. Environmental covers what the company takes from and leaves in the natural world, social covers how it treats people, and governance covers how decisions get made. Once the buckets existed, the side asking could compare companies on identical items, and the side answering could prepare once and send the same material everywhere.

Each bucket holds a list of items, and every item asks for evidence that then gets scored or graded. Roughly, the buckets break down like this.

1. Environmental looks at what the company consumes and emits: electricity use, carbon output, waste handling. For a software company with no factories this usually narrows to which data centers the servers sit in and how much people fly. Cloud providers publish the carbon profile of each region, so the answer to the first question is often a table copied from a vendor rather than anything measured in-house.
2. Social looks at how the company treats people. Safety and working conditions, diversity, equity, and inclusion (DEI) policy, labor practices at suppliers, and how customer data is handled. For software companies that last item is what comes up most.
3. Governance looks at how decisions get made. Whether board meetings actually happen and leave minutes behind, whether shareholder rights are respected, whether the accounts get outside verification, whether there's a channel for reporting problems internally. The underlying worry is concentration: a company where one person approves spending, hiring, and contracts without anyone recording it is fragile in a way revenue never shows.

The scoring is done by a rating agency or by the counterparty itself. They collect public filings and questionnaire answers, score item by item, and roll it up into a grade running from something like AAA down to C. What's worth knowing is that most items test whether evidence exists, not whether performance is good. The question isn't whether emissions fell but whether they're measured and disclosed; not whether the board is a good one but whether it met and left a record.

Which is why the same company gets different grades from different agencies. One weights environmental at half the total, another leans on governance. Treat it as several rulers measuring the same company, each with its own markings.

There are only a few places where a 45-person company runs into this for the first time.

1. Enterprise procurement review. Large companies run a vendor security assessment before adopting a new tool, and ESG questions now ride along in that questionnaire — how personal data is handled, whether a board exists, whether there's a supplier code of conduct.
2. Investment review. Institutional investors deploy money belonging to their limited partners (LPs), and more of those LPs now attach ESG requirements, so the questions turn up as due diligence items.
3. Disclosure obligations. Listed companies above a certain size are legally required to publish ESG information. A startup rarely falls under the rule directly, but when that listed company is a customer, the request for material comes down to its suppliers. A buyer reporting on its own supply chain needs numbers from everyone in it, which is how a rule written for large firms reaches a 45-person one.

The only answer available in any of these rooms is documents — minutes, written policies, records of checks performed. A report like SOC 2, where security controls have been verified by an outside auditor, can stand in for several social-bucket items at once.

"This customer's questionnaire has twenty ESG items. We need board minutes before anything else."

The team has started assembling documents to clear a pre-contract review.

"We're not at the stage of getting a rating. I just want to be able to answer when someone asks."

Choosing to handle questionnaires rather than pay an agency to score the company.

"That's a G question, so legal has to answer it."

Which bucket an item falls into decides who owns the answer.

Pagedeck first met the term right before signing its first enterprise customer. About half of the 60-item questionnaire the buyer's procurement team sent over asked about how the company was run rather than what it sold. Filling it in, Grace discovered that two years of board records existed only as memory. The meetings had happened; nobody had written them down.

Since then Pagedeck keeps three things current every quarter: board minutes, a record confirming that the privacy policy matches what the product actually does with data, and internal rules covering employee safety and hiring. The point is to pull them out of a drawer for the next questionnaire rather than write them again.

The most common reading is that this is about the environment. The first letter says so and the press coverage is mostly carbon and renewables, so the assumption is fair. But a software company renting servers almost always gets caught on the governance and social items instead — board records, personal data handling, employee safety. Prepare only the environmental side and you submit a questionnaire with most of it blank.

The other is filing it under things big companies deal with. It's true that no disclosure rule applies to a 45-person company, and nobody is coming to audit one. But the route this arrives by is a customer, not a regulator, and that questionnaire usually lands with a contract already in sight and a signature date attached. Some of what it asks for cannot be produced retroactively: minutes of a meeting that never convened can't be written later, and neither can a history of checks nobody performed. The cost of postponing shows up months afterward as a delayed contract.