ESG Ratings: How They Are Made and Why They Reach Suppliers

Why ESG ratings reach small suppliers

An industrial customer's tender contains a new item: suppliers are to present a recognized sustainability rating, otherwise points are deducted. A little later, the bank asks for information on energy consumption and emissions at the annual meeting. Many owners then wonder what such a rating actually measures, who awards it, and whether the effort pays off.

The question this article sets out to answer: How is an ESG rating created, why does it reach small suppliers too, and how should they handle it sensibly? To answer it, we first clarify the terms and the path from data to grade, then present a thinking model that explains why ratings differ so much, and identify the channels through which the pressure comes. Then we weigh two perspectives and derive a preparation for your own business.

An ESG rating is not a measurement of reality but a provider's judgment on the data it received.

What is an ESG rating?

ESG stands for environmental, social, and governance. An ESG rating is an assessment of how a company performs in these areas or how exposed it is to related risks, expressed as a grade, score, or ranking. It should be distinguished from pure ESG data, such as emission figures, and from supplier assessment, in which a customer rates its suppliers itself or via a platform using questionnaires and evidence.

For suppliers, the second and third kinds matter most. According to large providers, supplier platforms now rate well over 100,000 companies worldwide, many of them small and medium-sized businesses. Capital market ratings usually affect a small business only indirectly, because its customer is rated on them and passes the pressure on.

How is a rating created? From data to grade

Providers' procedures differ but follow a similar sequence.

1. Select topics

   The provider determines which topics count for an industry: for a metalworking business, for example, energy, occupational safety, and the supply chain; for a software company, rather data protection and governance.

2. Collect data

   From public sources, a questionnaire, uploaded documents such as policies, certificates, and reports, sometimes from media reports on incidents.

3. Build indicators

   The data is turned into indicators: is there an environmental policy, are there targets, is consumption measured, are there results?

4. Weight and aggregate

   The indicators are weighted and condensed into a grade, often compared with companies of the same industry and size.

5. Update

   Ratings usually apply for a certain period and must be renewed, often annually and for a fee.

One point is particularly important for small businesses. Many procedures assess not only whether something is good, but whether it is documented. A policy that does not exist in writing does not count, even if it is practiced every day. A small business with good practice and little paperwork therefore often scores worse than a large one with many documents.

The thinking model: scope, measurement, and weight

Why do two providers arrive at different grades for the same company? Berg, Kölbel, and Rigobon (2022) examined this using ratings from six major providers. They sorted 709 individual indicators into 64 common categories. The correlations between the overall ratings ranged from 0.38 to 0.71, so the ratings agreed only moderately. Their contribution is a model with three sources of divergence.

• Scope: The providers assess different topics. One includes lobbying, the other does not.
• Measurement: The same topic is measured with different indicators. Working conditions, for example, via staff turnover or via the number of labor court cases.
• Weight: The providers consider the same topics differently important.

Measurement thus explains the largest part. In addition, there is a finding the authors call the rater effect: if a provider has a good overall impression of a company, it also rates it better in individual categories. This effect explained 15 percent of the variation in category scores. The analysis is based mainly on data from 2014; a replication for 2017 yielded a similar picture.

An analogy makes this tangible. Two restaurant critics visit the same place. One rates food, service, and wine list; the other also the location, but not the wine list. For service, one counts the waiting time, the other the friendliness. And whoever is delighted by the first course sees the rest more kindly. Both judgments are justified, and yet they end up with different stars.

Through which channels do ratings reach the supplier?

Small businesses are rarely obliged to be rated themselves. The pressure comes from outside, through three channels.

• Customers: Large companies must know and report risks in their supply chain. They ask suppliers or require a rating via a platform. The sociologists DiMaggio and Powell called this mechanism coercive isomorphism, as Supply chain act and EU directive describes.
• Banks: Banks must assess the sustainability risks of their borrowers. According to a special KfW analysis, they discussed sustainability with 15 percent of German SMEs in loan talks in 2024, and with 37 percent of businesses with 50 or more employees. Baicu (2025) describes how banks additionally rate suppliers against sustainability standards in supply chain finance programs.
• Tenders: Public and private clients include sustainability criteria in their evaluation, sometimes with fixed points for evidence.

The rules moved in two directions in 2026. The EU significantly cut back reporting obligations with the omnibus package. According to a Commission draft of July 2026, the voluntary standard for smaller companies (VSME) is also to limit which information large companies may demand from suppliers with up to 1,000 employees. Sustainability as a selling point discusses this. At the same time, the EU Regulation on ESG rating activities (EU) 2024/3005 has applied since July 2, 2026. ESG rating providers in the EU now need authorization from the European securities regulator ESMA and must disclose their methods and avoid conflicts of interest. Existing providers could apply until early November 2026. Whether a particular supplier platform falls under the regulation depends on its offering and cannot be said across the board.

Burden or ticket of entry? Two perspectives

The burden perspective is supported not only by the model of Berg and colleagues. In a literature review, Tropotel (2025) concludes that common tools such as social audits, self-assessment questionnaires, and passing obligations on to suppliers often provide only limited and unreliable insight into actual practice.

The ticket-of-entry perspective is supported by the logic of purchasing. A buyer with hundreds of suppliers cannot visit each one. A standardized proof is a substitute for his own checking, even if it is imperfect.

I consider both perspectives accurate and draw a practical conclusion: a rating is a sales decision, not an obligation. It pays off where important customers require it or where it counts in tenders. More important than any single grade is a clean data set from which every rating and every questionnaire can be served quickly.

The core data set: how to prepare

The thinking model shows where a small business can start. It has no influence on the provider's scope and weighting. It does have influence on measurement, namely on the data and evidence it supplies. I therefore call the preparation the core data set.

1. Collect requests

   Gather all questionnaires and rating requests of the last two years and note which topics keep recurring.

2. Define indicators

   Record a handful of figures annually: electricity, heat, and fuel consumption, waste, workplace accidents, training hours, share of important suppliers with their own declaration. Use the VSME standard as a guide so the data fits future requests.

3. Put policies in writing

   Record what already applies in the business: code of conduct, approach to occupational safety, purchasing principles, data protection. A rule that is practiced but not written down counts in no rating.

4. File evidence

   Keep invoices, certificates, minutes, and training records in one place, with dates. This is the part where ratings most often fail.

5. Choose a rating

   Only then decide whether and which rating is worthwhile: the one your two or three most important customers require. Ask the customer which grade he expects.

In this worked example with freely chosen figures, an effort of a few thousand euros stands against a contribution margin of 150,000 euros that would be at risk without the rating. The calculation tips if the rating is required only by a small customer. Key account management for SMEs describes how to develop such customers in a targeted way.

Transferability and limits

ESG ratings are an example of how control in supply chains is outsourced to third parties. This has the same weakness as any third-party confirmation: it is only as good as the data and the independence of whoever issues it. The new EU regulation addresses exactly this, the providers' methods and conflicts of interest. For suppliers, conversely, the same applies as for any business partner: check to whom you give your data, how it is used, and who sees the grade. Business partner due diligence shows how to do this in general.

The limits of this analysis are clear. The study by Berg and colleagues concerns capital market ratings of large companies, not supplier platforms. Whether their assessments diverge similarly has been little studied. The costs in the worked example are assumptions and vary greatly by provider and business size. And how ESMA applies the new regulation in practice was only beginning in November 2026.

Conclusion: what ESG ratings mean for suppliers

To the guiding question: an ESG rating results from three decisions by the provider: what it measures, how it measures, and how it weights. Because these decisions differ and a rater effect is added, ratings from different providers often agree only moderately. Suppliers are reached by the topic through customers, banks, and tenders, not through obligations of their own. The EU now limits what large customers may ask and has supervised the providers themselves since July 2026.

For a small business, the most sensible response is therefore not the best possible rating but the best data set. If you have your figures and evidence together, you can answer any request and only have to decide which grade you can sell.

• Gather all sustainability questionnaires and rating requests of the last two years.
• Define a core data set with a few indicators and record it annually.
• Put practiced rules in writing and file them with a date.
• Clarify with your three most important customers which rating and grade they expect.
• Roughly compare the costs of a rating with the contribution margin at risk.
• Check how your website and quotations present existing ratings.