ESG Controller

Smartsuite; Newport Beach (CA); On-site; USD 120,000 - 190,000; Full time

Job summary

Capitolis is seeking an ESG Controller to design and operate robust ESG data controls within SmartSuite. You will own the internal control over sustainability reporting, reconcile ESG metrics to source systems, and coordinate with finance on integrated reporting.

You will document methodologies, estimates and judgments, prepare ESG data for assurance engagements and support limited and reasonable assurance processes.

Responsibilities

• Design and operate controls over ESG data collection and calculation

Skills

ESG data controls

Data reconciliation

Internal controls

Assurance readiness

Documentation of methodologies

Cross-functional coordination

Tools

SmartSuite

COSO framework

ISAE 3000 / ISSA 5000

SOX Compliance

Job description

Governance, risk and compliance

SmartSuite for the ESG Controller

The ESG Controller applies financial-control discipline to sustainability data: controls over data collection and calculation, reconciliation to source systems, assurance readiness and the internal control over sustainability reporting that CSRD and ISSB-aligned regimes expect.

What you own

The ESG Controller applies financial-control discipline to sustainability data: controls over data collection and calculation, reconciliation to source systems and financial data, assurance readiness and the internal control over sustainability reporting.

• Design and operate controls over ESG data collection and calculation
• Reconcile ESG metrics to source systems and financial data
• Own the internal control over sustainability reporting
• Prepare ESG data for limited and reasonable assurance
• Document methodologies, estimates and judgments
• Coordinate with finance on integrated and connected reporting

At a glance

The GRC processes this role owns, touches and depends on.

Owns

Accountable for the process

Touches

Contributes or approves

Depends on

Consumes its output

How the GRC processes connect

Three lines of defence set the frame; the chain shows where each process hands off to the next. Colours follow the ESG Controller: navy is owned, blue is touched, grey is depended on.

1. First line

   The business and its control owners. Run the processes, own the controls, fix the issues.

2. Second line

   Risk, compliance and the domain programmes. Set the frameworks, assess, monitor and advise.

3. Third line

   Internal audit. Independent assurance to the board and audit committee.

Reporting lines

Who this role reports to, who reports to them, and the peers they work with most.

Reports to

Controller

Direct reports

None

Works closely with

ESG Reporting Manager

ESG Program Director

Internal Controls Manager

External Auditor

How SmartSuite supports the ESG Controller

The ESG Controller puts financial-control discipline behind sustainability data and answers to the Controller and the Chief Financial Officer for numbers that reconcile and controls that operate. SmartSuite holds ESG metrics with their sources and controls, tested in the same cycle as financial controls, so assurance readiness is a state you can show.

Operate the controls over ESG data

Reconciliation status on every metric. Each ESG metric in ESG & Sustainability Management carries its source and validation record, and you add the figure it reconciles to in finance or an operational system and the reconciliation status, so an unreconciled number is visible before it reaches a disclosure.

Methodologies, estimates and judgments documented

Calculation methods, estimates and the judgments behind them are recorded against the metric with version history, so when a method changes the prior basis is still visible and the change is explained.

Every ESG control with an owner and frequency

ESG reporting controls sit in SOX Compliance with a named owner, a frequency and evidence requirements, so the control environment over sustainability data looks the way COSO expects the financial one to.

Work with finance, internal controls and the auditors

ESG controls tested in the SOX cycle. ESG controls are scheduled into the same recurring test cycles as business controls, so the Internal Controls Manager's testers cover them with the same procedures, templates and scoring.

Deficiencies tracked to retest. A failed ESG control becomes a deficiency with its remediation, owner and retest decision recorded, so the Controller sees sustainability deficiencies on the same list as financial ones.

External auditor access without email. The External Auditor reviews ESG control testing and evidence through controlled access, so ISAE 3000 or ISSA 5000 fieldwork draws on the system of record rather than on packs you assemble.

Report readiness to the Controller and the CFO

Readiness by disclosure, not by feeling. Dashboards show, for each disclosure cycle, which metrics are reconciled, which controls are tested and which deficiencies are open, so readiness reported to the Chief Financial Officer is measured.

Connected reporting with the finance close. Sustainability figures and their controls are visible to the finance team alongside the close, so the connected information ISSB IFRS S1 expects is produced from one set of records rather than two reconciled afterwards.

Deficiency narratives drafted for you. The AI Assistant in a SmartDoc field drafts deficiency narratives and auditor responses from the testing record, so the write-up for the audit committee or the assurance provider starts from the evidence.

Key capabilities and responsibilities

ESG. Holds ESG metrics with source links, calculation records and reconciliation status so every number has a control behind it.

Compliance management. Manages ESG reporting controls in the same control library as financial controls, with testing and evidence.

Internal audit. Prepares assurance-ready evidence packs for internal and external auditors.

Reporting. Reports control status and data readiness for each disclosure cycle.

Products this role uses most

ESG & Sustainability Management

Track and report ESG performance with structured workflows, regulatory alignment, and real-time visibility into sustainability metrics and initiatives.

SOX Compliance

Manage SOX compliance with structured control testing, evidence tracking, and real-time visibility into financial reporting controls and audit readiness.

Control Framework & Regulatory Libraries

Keep controls in one library and map them across frameworks to reduce duplication and enable a test‑once, comply‑many approach.

Compliance Assessments & Testing

Manage assessment campaigns and testing schedules with a reusable question library, automated workflows, and one place for evidence collection.

Industry reference

COSO’s Achieving Effective Internal Control over Sustainability Reporting (2023) applies the 2013 framework to ESG data, which is the controller’s core reference. CSRD requires limited assurance of ESRS disclosures, ISSB IFRS S1 requires connected financial and sustainability information, and California’s SB 253 requires assurance of emissions data, so ISAE 3000 and ISSA 5000 define what evidence auditors will need.

Financial institutions carry additional Pillar 3 ESG and SFDR data obligations; listed companies in all sectors face the prospect of ESG controls being evaluated alongside SOX‑style internal control; public bodies and healthcare systems apply the same discipline where they report against GRI.

Related roles

Controller

DEEPEN YOUR KNOWLEDGE

Guides and definitions from the GRC Knowledge Center and the What‑is glossary, chosen for this role.

Frequently asked questions

The ESG Controller applies financial-control discipline to sustainability data: designing and operating controls over ESG data collection and calculation, reconciling ESG metrics to source systems and financial data, owning the internal control over sustainability reporting, preparing data for limited and reasonable assurance, documenting methodologies, estimates and judgments and coordinating with finance on connected reporting. COSO’s 2023 guidance on internal control over sustainability reporting is the core reference, and CSRD, ISSB IFRS S1 and California SB 253 make assurance a requirement.

ESG & Sustainability Management holds each ESG metric with its sources and validation record, and the reconciliation you record against it to source systems or financial data, so every disclosed number shows where it came from and whether it has been reconciled. The ESG Controller can see which metrics are reconciled to source systems or financial data and which are still estimates awaiting support. That is the structure an ISAE 3000 or ISSA 5000 assurance engagement will test, and it is maintained as the data is collected rather than reconstructed afterwards.

SOX Compliance manages ESG reporting controls in the same control library as the financial controls, with testing and evidence, so the ESG Controller does not run a parallel control program with its own standards. Control Framework & Regulatory Libraries holds the framework mappings, Compliance Assessments & Testing runs the tests and the Internal Controls Manager sees ESG controls in the same program as the SOX controls. For a listed company facing SOX‑style evaluation of ESG controls, this is the structure examiners will expect.

SmartSuite assembles the evidence for internal and external auditors from the metric records, their sources, reconciliations and control tests, with audit‑ready reports generated from the same records, so the ESG Controller responds to the External Auditor’s requests from the system rather than assembling binders. Each requested figure can be traced to its evidence, and the auditor’s follow‑up questions are answered from the same records. The ESG Reporting Manager uses the same records when a disclosure line item is challenged, so reporting and assurance draw on one source.

SmartSuite reports control status and data readiness for each disclosure cycle, so the ESG Controller can tell the Controller and the Chief Financial Officer which metrics are reconciled and controlled, which are outstanding and whether the cycle is ready for assurance. Because ISSB IFRS S1 expects sustainability information to connect with the financial statements, the readiness view is shared with finance rather than kept in the sustainability team. The ESG Program Director sees the same status for program planning.

Start from the existing SOX control library and add the ESG reporting controls to it, then load the metrics in the current disclosure with their sources and calculation methods. The first cycle run in SmartSuite establishes reconciliation status for each metric and gives the ESG Controller the list of estimates and judgments to document. Testing follows the SOX calendar where frequencies align, and the Internal Controls Manager and External Auditor work in the records they already know, which shortens the first assurance engagement.