ESG Ratings Explained: MSCI, Sustainalytics, CDP and EcoVadis

This guide is written from the side of the company being rated. For each of the four ratings it sets out the scale, how the score is built, what the company can do about it and when, read from each provider’s own published methodology. What an ESG rating is in general, why ratings from different providers disagree and how the new EU and UK rules regulate the providers are covered in our ESG rating glossary entry.

The four ratings at a glance

The first two are investor products: the company does not apply and does not fill in a questionnaire. The last two are questionnaire-based: the company does the work, and the score depends on what it submits. That split decides what a company can do about each one.

MSCI ESG rating: AAA to CCC

MSCI describes its ESG Ratings as “an opinion of companies’ management of financially relevant ESG risks and opportunities”. They are industry-relative: a company is rated against its industry peers, not against all companies. A steelmaker with an AA is a leader among steelmakers, which says nothing about whether its emissions are low.

How the rating is built

1. Key issues are chosen for the industry. Each company is scored on two to seven environmental and social key issues out of MSCI’s 33, picked for the risks its industry and markets face. Every company is also scored on governance, made up of six key issues covering ownership and control, board, pay, accounting, business ethics and tax transparency.
2. Each key issue gets a score from 0 to 10, combining how exposed the company is to the risk and how well it manages it. Governance is scored differently: it starts at 10 and points are deducted for gaps against best practice.
3. The scores are weighted and averaged. The weights depend on how much each issue matters to the industry; MSCI reviews key issues and weights every year, with a 30-day client consultation, typically in the fourth quarter.
4. The average is set against the industry. The weighted average is normalised against the range of scores in the company’s peer group, giving the industry-adjusted score from 0 to 10. That range is split into seven equal parts, one for each letter, as in the table above.

Management is judged from a company’s governance structures, policies and targets, quantitative performance figures and controversies. MSCI’s methodology says ratings “rely primarily on publicly disclosed information” and that MSCI “does not independently audit company disclosures”. A rating also reflects only what was available at the last rating action, so a new sustainability report may not show up straight away.

What is a good MSCI ESG rating?

MSCI labels AAA and AA as leaders, A, BBB and BB as average, and B and CCC as laggards. Because the scale is industry-relative, the useful question is where a company sits among its peers, not whether its letter is high in absolute terms.

Finding a company’s MSCI rating

MSCI makes its ratings and the data behind them available to its clients through its MSCI ONE platform. If a company publishes its own MSCI rating, for example in its sustainability report, use that and check the date. A rated company that wants to know why it got its rating should look first at what it publishes: MSCI works from public information, so a missing policy, target or emissions figure counts as missing.

Sustainalytics ESG Risk Rating: lower is better

Morningstar Sustainalytics measures risk, not performance: how much of a company’s enterprise value is at risk from ESG issues it has not managed. The score is the reverse of most ratings. A lower number is better, and zero means no unmanaged risk.

How the score is built

For each material ESG issue, Sustainalytics scores the company’s exposure, then how much of that exposure it manages. What is left over is unmanaged risk:

• Unmanaged risk for an issue = exposure − managed risk. How much of each risk can be managed at all is set for each subindustry.
• The ESG Risk Rating = the sum of unmanaged risk across all the company’s material issues. The scale starts at zero and has no upper limit, but for 95% of companies the score is below 50.

The categories are absolute: Sustainalytics says a bank “can be directly compared with an oil company”. That is the opposite of MSCI’s approach, and the main reason the two can rank the same company differently.

What a company can do

Sustainalytics updates its research on management indicators every year, and its controversy research as events happen. Its corporate FAQ says it contacts companies during the annual update and gives them a draft report to check, with two weeks to send feedback; its 2024 methodology abstract says factual feedback on possible errors can be sent to its Issuer Relations team. A company can improve its rating by getting missing or wrong data corrected, and by publishing the policies, programmes and performance figures that show a risk is managed.

CDP score: A to D-

CDP runs an annual environmental disclosure questionnaire. Investors and large customers ask companies to answer it, and CDP scores the answers. CDP says the score “reflects disclosure quality and maturity, rather than absolute environmental performance”, and it is based solely on the company’s response: external links and attachments are not scored unless the methodology says so.

The four levels

A response is scored at Disclosure first, and a company has to pass a minimum threshold at one level before it can earn anything at the next. It must also meet the Essential Criteria for each level, absolute requirements that can cap a score even when the points are there. CDP sets the thresholds provisionally and can adjust them before scores are released.

2026 dates and what is scored

• Scoring deadline: 16 September 2026. Responses can still be edited after that but are not scored; late responses are marked “not scored”.
• Score release: to disclosers in the week of 30 November 2026, and on CDP’s website later the same week for public scores.
• Scored themes: climate change, forests and water security on the full questionnaire. Plastics, biodiversity and the new ocean questions are not scored in 2026. The SME questionnaire is scored for climate change only.
• No response: under the 2026 scoring rules, a company asked to disclose that does not respond is shown as “Did not disclose”. CDP’s 2024 rules gave it an F.

Companies with a public score are listed on CDP’s public scores page. To check what your own climate answers are likely to earn before you submit, use our CDP climate questionnaire calculator; our CDP glossary entry explains what the organisation does.

EcoVadis rating: 0 to 100 and medals

EcoVadis rates a company’s sustainability management system, and buyers use its ratings to assess their suppliers. It is evidence-based: the company answers a questionnaire and uploads documents such as policies, certificates and reports, which EcoVadis analysts score. EcoVadis also takes in information from NGOs, trade unions, governments and other third parties.

The score

The company gets a score from 0 to 100 for each of four themes (Environment, Labor & Human Rights, Ethics and Sustainable Procurement) and an overall score, which is a weighted average of the four. Each theme is weighted from 1 to 4 depending on how material it is for the company’s industry, size and risk profile.

Each theme score comes from seven management indicators: policy, endorsement, measures (actions taken), certifications, coverage (large companies only), reporting, and “360° Watch”, which brings in findings from outside sources. Reporting counts only if it covers at least 80% of the company’s scope, and greenhouse gas emissions and energy use must cover 95% to be credited.

Medals and badges

Medals go by percentile rank against every company EcoVadis rated in the 12 months before the scorecard was published, across all industries.

• Every theme must score at least 30 for a medal. Weak 360° Watch results can also rule a company out, and some industries are excluded: tobacco, weapons and ammunition, coal or lignite mining, and companies above 20% coal revenue, coal power or unconventional oil and gas production.
• Badges are for companies without a medal: “Committed” for a score of 45 or more, and “Fast Mover” for a score of 34 to 44 that has risen at least 6 points since the previous assessment within 18 months.
• Validity: a scorecard, and any medal or badge on it, is valid for 12 months from publication.
• Not a certification: EcoVadis says a medal is a relative, point-in-time result, not a certification of the company or its products.

Because medals are a percentile rank, the score needed for one moves with everyone else’s results. Bronze means beating 65% of all companies EcoVadis rated in the past year, not a fixed number of points. Plans and prices are on EcoVadis’s plans page; sharing a medal publicly needs a Premium, Select or Corporate subscription.

If you have been asked for a rating

If a customer, investor or lender has asked about one of these ratings, what to do depends on which one:

Three of the four score a company’s own emissions figures: CDP from its response, EcoVadis from reporting that covers 95% of its scope, and MSCI from published emissions data. A complete inventory with its methods stated helps with all three. Our scope 1, 2 and 3 inventory calculator builds one with every emission factor sourced, and the scopes guide explains what goes in each. For a small company asked by a customer for sustainability data, the VSME calculator produces the EU’s voluntary SME report.

Why your ratings disagree, and the new rules

A company can hold an MSCI AA, a high Sustainalytics risk score, a CDP B and an EcoVadis silver at the same time without any of them being wrong: they measure different things against different benchmarks. A widely cited study, by Berg, Kölbel and Rigobon (Review of Finance, 2022), found that the ESG ratings of six providers for the same companies correlated at between 0.38 and 0.71, and that most of the gap came from measuring the same topics in different ways. There is no valid way to convert one provider’s rating into another’s. Our glossary entry goes through the study in detail.

The providers themselves are now regulated in the EU. Regulation (EU) 2024/3005 applies from 2 July 2026: ESG rating providers operating in the EU must be authorised by ESMA, and existing providers must apply by 2 November 2026 to keep operating while their application is decided. The rules regulate the providers, not the companies they rate; no law requires a company to obtain an ESG rating. The UK, India and Japan rules are in the glossary entry.

Sources

GreenCalculus is not paid by any rating provider and this page has no affiliate links. Providers change their methods: CDP each year, MSCI after its annual consultation, EcoVadis as it publishes new versions. We re-read each methodology before every CDP cycle and after each provider update.

Frequently asked questions