ESG Rating
Ask two rating agencies to grade the same company on environmental, social and governance matters and you can get two different answers. In the best-known study of the problem, ratings from six major providers agreed with each other only partly, with correlations between 0.38 and 0.71.
That does not make ESG ratings useless. It means each one answers its own question, and you need to know which question before you use the grade.
An ESG rating (or ESG score) is a third party’s grade of how a company handles environmental, social and governance issues, such as MSCI’s AAA to CCC or Sustainalytics’ risk score. Methods differ widely. EU rules for rating providers apply from 2 July 2026.
What an ESG rating is
An ESG rating is an assessment, by an outside provider, of a company’s exposure to environmental, social and governance issues and how well it manages them. It is usually expressed as a letter grade or a number, and sold to investors, lenders and index providers who use it to compare companies.
The three letters group the topics. Environmental covers greenhouse gas emissions, energy, water, waste and biodiversity. Social covers labour practices, health and safety, product safety and community relations. Governance covers board structure, executive pay, ownership and business ethics. A provider scores each area from company reports, regulatory filings, news and its own questionnaires, then weights them into an overall grade.
“ESG rating” and “ESG score” are used interchangeably in everyday use. The EU’s regulation draws a line between them: a score comes from data and a statistical or algorithmic model alone, while an opinion also involves a human rating analyst. Both are ESG ratings under the law. A rating is not the same thing as ESG reporting: the company publishes the report, and the rating is someone else’s judgement of it.
Definition at a glance
| What it is | A third party’s grade of a company’s environmental, social and governance risks, impacts or management |
|---|---|
| Also called | ESG score; sustainability rating; ESG risk rating |
| Who produces it | Specialist providers such as MSCI, Morningstar Sustainalytics, S&P Global, LSEG, ISS and CDP |
| Who pays | Mostly investors, who subscribe; in some markets, the company being rated |
| Typical scale | Letters (AAA to CCC, A to D-) or numbers (0–100, or a risk score where lower is better) |
| Built from | Company disclosures, filings, questionnaires, news and controversies |
| Regulated? | In the EU from 2 July 2026; India since 2023; UK from 29 June 2028; a voluntary code in Japan |
How the law defines it
EU Regulation (EU) 2024/3005, Article 3(1): “‘ESG rating’ means an opinion or a score, or a combination of both, regarding a rated item’s profile or characteristics with regard to environmental, social and human rights, or governance factors, or regarding a rated item’s exposure to risks or impact on environmental, social and human rights, or governance factors, that is based on both an established methodology and a defined ranking system of rating categories, irrespective of whether such ESG rating is labelled as ‘ESG rating’, ‘ESG opinion’ or ‘ESG score’.”
UK ESG Ratings Order 2025 (SI 2025/1349): an ESG rating is “an assessment regarding one or more ESG factors”, produced “in the form of an opinion, a score or a combination of both”.
Two phrases in the EU definition matter more than they look. “Exposure to risks or impact” means a rating can measure either how ESG issues could hurt the company or how the company affects the world, two different questions that the double materiality concept keeps apart. And “irrespective of whether such ESG rating is labelled” closes the obvious loophole: calling a product a score rather than a rating does not take it outside the law.
The main ratings, compared
The best-known ratings use different scales and measure different things. The two largest show the split most clearly. MSCI describes its letter grades as “industry-relative”: a company is graded against its peers. Sustainalytics says its risk categories “are absolute”, so that “a bank, for example, can be directly compared with an oil company”.
| Rating | Scale | Measures | Compared against |
|---|---|---|---|
| MSCI ESG Ratings | AAA (leader) to CCC (laggard) | Resilience to financially relevant, industry-specific ESG risks and opportunities | Industry peers |
| Morningstar Sustainalytics ESG Risk Rating | Unmanaged risk score from 0; five bands from negligible (under 10) to severe (40 and above). Lower is better | How much of the company’s enterprise value is at risk from ESG factors it has not managed | All companies on one absolute scale |
| CDP score | A to D-; F if a company asked to disclose does not | Disclosure and action on climate change, forests and water | Four levels: disclosure, awareness, management, leadership |
CDP is different in kind from the other two: companies fill in its questionnaire themselves, and the score rewards transparency and environmental management rather than predicting financial risk. A company can hold a CDP A and a middling MSCI grade at the same time without anything being wrong. Our guide to what a CDP score measures goes further.
| Sustainalytics band | Unmanaged risk score |
|---|---|
| Negligible | 0 to 9.99 |
| Low | 10 to 19.99 |
| Medium | 20 to 29.99 |
| High | 30 to 39.99 |
| Severe | 40 and above |
Why ESG ratings disagree
Berg, Kölbel and Rigobon took ratings of the same companies from six providers (KLD, Sustainalytics, Moody’s ESG, S&P Global, Refinitiv and MSCI) and split the disagreement into three sources:
Most of the disagreement is not about values or priorities. It is about measuring the same thing in different ways.
Two providers can both assess “climate” and still diverge because one counts a company’s emissions while another counts its policies and targets, or because one uses reported data and another its own estimate. The study also found a “rater effect”: a provider’s overall view of a company tends to colour how it scores each individual category.
Underneath sits a more basic difference: what the rating is for. A rating built on financial materiality asks how ESG issues could affect the company’s value. One built on impact materiality asks how the company affects people and the planet. An oil producer managing its risks well can score well on the first and badly on the second. The EU regulation expects providers to disclose when they assess only one of the two.
What an ESG rating is not
| ESG rating | Credit rating | ESG report | |
|---|---|---|---|
| Question | How does the company handle ESG risks or impacts? | Will the borrower repay its debt? | What does the company say about its own ESG performance? |
| Produced by | A rating provider | A credit rating agency | The company itself |
| Rules | EU from 2026; UK from 2028; India since 2023 | Long-established regulation | CSRD, ISSB-based rules and others; see ESG regulations |
How ESG ratings are regulated
| Jurisdiction | Rule | Status |
|---|---|---|
| European Union | Regulation (EU) 2024/3005: providers must be authorised by ESMA; non-EU providers need equivalence, endorsement or recognition | Applies from 2 July 2026. Existing providers had to notify ESMA by 2 August 2026 and apply within four months of 2 July; small providers by 2 November 2026 |
| United Kingdom | ESG Ratings Order 2025 (SI 2025/1349) makes providing ESG ratings a regulated activity under the FCA | Made 15 December 2025; authorisation required from 29 June 2028 |
| India | SEBI regulates ESG rating providers under its credit rating agency regulations, in two categories | In force since 4 July 2023 |
| Japan | FSA Code of Conduct for ESG Evaluation and Data Providers, comply or explain | Voluntary; 30 providers had endorsed it by 30 June 2026 |
| International | IOSCO recommendations on ESG ratings and data products providers | Published November 2021 |
The EU rules go furthest. Separate E, S and G ratings “should be provided rather than a single ESG rating”, and a provider that still publishes one combined grade must disclose the weight given to each. Providers must manage conflicts of interest, including by separating some other activities, disclose their methods, and can be fined up to 10% of annual net turnover. The rules have already changed the market: LSEG now says it no longer distributes its ESG scores and ratings to users in India.
Worked micro-example
A cement producer has a strong emissions-reduction programme, good disclosure and few controversies, but cement making is carbon-intensive by nature.
- Industry-relative view: against other cement makers it is a leader, so it could hold a high letter grade.
- Absolute-risk view: even after its programme, much of its enterprise value is exposed to carbon pricing. Suppose its unmanaged risk score is 32: that falls in the high band (30 to 39.99).
Both grades are correct. One says “best in its industry”; the other says “exposed in absolute terms”. An investor screening for leaders reads the first; one limiting portfolio carbon risk reads the second. The numbers here are illustrative, not any company’s actual ratings.
What a rated company can do
Companies are rated whether or not they ask to be. Providers work largely from public information, so the quality of what the company publishes drives the result:
- Publish the data providers look for. An emissions inventory covering scopes 1, 2 and 3, with methods and sources, removes the need for a provider to estimate.
- Respond when asked. A company that ignores a CDP request scores F rather than nothing.
- Check what the provider used. A rating built on wrong or missing data is the cheapest one to fix: find out which figures the provider relied on, and correct them at the source, in your own published disclosures.
- Know which scale you are on. Improving against industry peers moves an industry-relative grade; reducing absolute exposure moves a risk score.
Common mistakes
- Reading a high ESG rating as “low emissions”. An industry-relative grade can be high for a heavy emitter that leads its sector.
- Comparing grades across providers. AAA from one provider and a negligible-risk score from another do not measure the same thing.
- Reading a Sustainalytics score the wrong way up. It is a risk score: lower is better.
- Treating the overall grade as the whole story. The E, S and G components can point in different directions; the EU rules now push providers to show them separately.
- Treating a rating as a disclosure obligation. No law requires a company to obtain an ESG rating. The rules regulate the providers, not the companies they rate.
- Marketing a rating as proof of sustainability. A rating is one provider’s opinion. Presenting it as more can be greenwashing.
Most of what an ESG rating measures on the environmental side starts with an emissions inventory. Build yours with every factor sourced, then see which reporting rules apply.
Frequently asked questions
An ESG rating is an outside provider’s grade of how a company handles environmental, social and governance issues, expressed as a letter or a number. Investors use it to compare companies. Well-known examples are MSCI’s AAA to CCC scale and Morningstar Sustainalytics’ ESG Risk Rating. In the EU, a rating that combines an established method with defined rating categories is regulated from 2 July 2026.
Specialist providers, mostly paid by investors who subscribe to their data. The largest include MSCI, Morningstar Sustainalytics, S&P Global, LSEG and ISS. CDP also scores companies, but on their environmental disclosure through its own questionnaire. In the EU these providers must be authorised by ESMA, and in India they must be registered with SEBI.
Mainly because providers measure the same topics in different ways. A 2022 study of six providers found correlations between 0.38 and 0.71, and traced 56% of the disagreement to measurement, 38% to which topics are included and 6% to how they are weighted. Providers also differ on whether they assess risk to the company or the company’s impact on the world.
Increasingly. The EU’s Regulation (EU) 2024/3005 applies from 2 July 2026 and requires providers to be authorised by ESMA, publish their methods and avoid conflicts of interest. The UK will require FCA authorisation from 29 June 2028. India has regulated ESG rating providers since July 2023, and Japan has a voluntary code of conduct.
An ESG score is a number grading a company on environmental, social and governance matters, such as 0 to 100, or a risk score where lower is better. In everyday use it means the same as an ESG rating. EU law uses “score” for a grade produced purely by a data model and “opinion” for one involving an analyst, and regulates both as ESG ratings.
Need someone who does this? 6 carbon accounting & inventory providers in our directory →