How to Write an RFP for a Sustainability Report

GRI’s foundation standard lists nine requirements a report must meet before it can claim to be prepared in accordance with the GRI Standards, and the last of them is an email to GRI. Report RFPs often leave out which claim they want, and that omission alone can explain much of the spread between bids.

A sustainability report is a public, usually annual account of an organization’s most significant impacts on the economy, environment and people, and how it manages them. You need one when investors, customers, regulators, funders or residents ask for comparable information. The RFP succeeds when it fixes the claim, the data owners and the assurance scope before design starts.

What this work should deliver

The outcome is an accurate, balanced and comparable report plus a data process your staff can run again next year. GRI 1: Foundation 2021 makes balance a requirement: the organization shall give "a fair representation" of its negative and positive impacts. A report that reads like a brochure fails that test, however good it looks.

Draw the scope boundaries in the RFP. Say whether the consultant produces the greenhouse gas inventory or receives one, whether a materiality assessment is included, and whether design, web and translation are in or out. Keep assurance in a separate contract with a separate firm.

Who this is for: corporate sustainability teams, port authorities, transit and utility agencies, universities and nonprofits publishing an annual sustainability, ESG or impact report. PortsToronto, for example, combined its annual and ESG reports in 2024.

It is the wrong guide for a standalone greenhouse gas inventory; local governments buying one should see our community GHG inventory RFP guide. A port that needs a plan instead of a report should see our port sustainability plan RFP guide. For the basic steps, start with our how-to on writing a sustainability report.

Rules and standards to cite

GRI claim. Under GRI 1, reporting in accordance with the GRI Standards means meeting all nine requirements, from applying the reporting principles to publishing a content index, providing a statement of use and notifying GRI. An organization that misses any of them can at most claim to report with reference to GRI, which carries three requirements. Our GRI Standards guide explains the structure.

Material topics. GRI 3: Material Topics 2021 says the organization should review its material topics each reporting period and that its highest governance body should review and approve them. Put that approval step in the schedule. See our materiality assessment entry for method.

New topic standards. GRI 101: Biodiversity 2024 replaced GRI 304 and, per GRI’s FAQ, is required for biodiversity reporting published on or after January 1, 2026. GRI 102: Climate Change 2025 and GRI 103: Energy 2025 revise the older emissions and energy disclosures, according to GRI’s project page, and apply to reports published on or after January 1, 2027. An FY2026 report published in 2027 that claims GRI accordance and treats climate or energy as material therefore needs them.

No sector standard for ports or agencies. GRI’s Sector Program has published oil and gas, coal, agriculture and mining standards and is developing financial services and textiles. Ports, transit operators and public agencies work from the universal and topic standards.

Greenhouse gas data. The GHG Protocol Corporate Standard, updated in 2015 with its Scope 2 Guidance, remains the base method. For companies with more than $1 billion in revenue doing business in California, the Air Resources Board is deferring the first Scope 1 and 2 reports from August 10 to November 10, 2026, and its March 2026 workshop put limited assurance from 2027. Our SB 253 guide has the detail, and our corporate GHG inventory RFP guide covers buying the inventory separately.

At the federal level, the SEC proposed rescinding its climate disclosure rules in June 2026. Companies with EU obligations should scope against our CSRD page instead.

Assurance. The IAASB’s ISSA 5000 applies to periods beginning on or after December 15, 2026 and is written for accountants and other assurance practitioners. CARB’s March 2026 materials also list AA1000AS v3, ISO 14064-3:2019 and AICPA attestation standards. Our assurance guide compares them.

Accessibility for public bodies. 28 CFR 35.200 requires WCAG 2.1 AA for web content, including posted PDFs, from April 26, 2027 or April 26, 2028 depending on population and entity type. Under 35.201, documents posted before the compliance date are exempt unless people use them to access services, so every new report falls under the rule.

Scoping decisions that change the price

Claim level. Full accordance costs more than a report with reference to GRI, because every material topic needs its disclosures or a stated reason for omission.

Data readiness. Attach last year’s report, the data inventory and a list of data owners to the RFP. Bidders who cannot see the data price in the risk.

Entities and languages. Growthfund priced each portfolio company separately and required Greek originals with English translations, which shows how quickly scope multiplies.

Assurance timing. Bring the assurance provider in before data freeze, so findings arrive while there is still time to fix them.

Sample scope of work

Task 1. Boundary, claim and plan. Settle the rules first.

The Consultant shall confirm the reporting period, organizational boundary, GRI claim (in accordance with or with reference to), related frameworks and the assurance scope, and shall deliver a reporting plan with data owners, deadlines and review steps within 15 business days of notice to proceed.

Task 2. Material topics. Refresh, approve, record.

The Consultant shall review the prior period’s material topics against changes in operations, business relationships and stakeholder concerns, document the process as required by GRI 3, and present the list for approval by [the highest governance body].

Task 3. Data collection and quality control. Most of the work lives here.

The Consultant shall provide reusable data collection templates, collect data from named owners, check each figure against source records and prior years, and document calculation methods and restatements in a data book delivered in an editable format.

Task 4. Drafting. Write for balance.

The Consultant shall draft the report in plain language, presenting negative and positive impacts with year-on-year trends in keeping with the GRI reporting principles, and shall flag any disclosure that cannot be supported by source data.

Task 5. Content index and statement of use. Close the GRI requirements.

The Consultant shall prepare the GRI content index, the statement of use and reasons for omission where applicable, and shall prepare the notification to GRI for the Organization to send.

Task 6. Design and accessible publication. Make it usable by everyone.

The Consultant shall design the report and a web version, and all digital files shall conform to WCAG 2.1 Level AA. The Consultant shall deliver editable source files and a summary for [board, investor or public] audiences.

Task 7. Assurance support and debrief. Hand off cleanly.

The Consultant shall respond to requests from the independent assurance provider, track and resolve findings, and deliver a lessons-learned memo listing data gaps to close before the next cycle.

Deliverables to require

• Reporting plan with boundary, claim, data owners and calendar.
• Material topics memo, with the approval record.
• Reusable data collection templates.
• Data book in an editable format, with methods, sources and restatements.
• Draft and final report text.
• GRI content index, statement of use and prepared notification to GRI.
• Designed report and web version, with an accessibility conformance check.
• Assurance findings log.
• Lessons-learned memo with the next year’s data gaps.

In our iMPAct Reports work for the Maryland Port Administration and Maryland Environmental Service, the job was turning existing but scattered data points into visual narratives covering five jurisdictions, each built so its parts could be reused in presentations and outreach. Ask for that kind of reuse in the deliverables.

How to evaluate proposals

For a published comparison, Growthfund’s 2024 RFP combined a 60% technical score with a 40% price score, and split the technical score between project team and methodology at 30% each.

Read the sample reports bidders send against the balance principle. If none of them discusses a negative impact, you know what you will get. Public agencies using federal funds must follow 2 CFR 200.320, which requires stated evaluation factors and price as a factor.

Timeline

The phase split is ours; the six-month total comes from the Growthfund RFP. Outside dates can override it: CARB’s November 10, 2026 deadline for Scope 1 and 2 data, and GRI 102 and 103 for anything published from January 1, 2027. Leave room for the governance approval of material topics that GRI 3 recommends.

Budget and cost drivers

Growthfund’s 2024 framework agreement set €5,000 to €9,000 per small company and €12,000 to €16,000 per large company for GRI-referenced reports, the latter including SASB, and €40,000 to €50,000 for Growthfund’s own report with a portfolio roll-up and TCFD content. All lots included English translation of Greek originals.

For large companies, CARB’s March 2026 workshop estimated average annual costs of about $82,000 for Scope 1 and 2 reporting, $8,600 to $25,900 more for Scope 3, and about $44,000 for limited assurance of Scope 1 and 2. Those figures cover emissions reporting only, so a full report sits on top of them.

What moves cost:

• Claim level. Full GRI accordance means covering every material topic.
• Data maturity. Missing owners, spreadsheets with no audit trail and first-time metrics add weeks.
• Materiality. A full reassessment with stakeholder interviews costs far more than a documented review.
• Entities and sites. Growthfund priced each portfolio company separately.
• Frameworks. Each added crosswalk (SASB, TCFD, ISSB, CDP) adds mapping and review.
• Languages and formats. Translation, a web version, a data book and accessible PDFs.
• Assurance. Scope, level and provider fees, bought under a separate contract.

Red flags in proposals

• Design samples up front and no word on data collection or who checks figures.
• "GRI-compliant" with no statement of which claim, and no content index in the scope.
• An offer to write the report and assure it.
• Sample reports with no negative impacts or restatements.
• A materiality list copied from a template, with no governance approval step.
• A fixed fee that assumes clean data and has no allowance for gaps.
• Accessibility left to the agency’s web team after design is done.

For practical communication advice, see our guide to communicating ESG progress credibly and our ESG reporting hub.

How we'd approach it

We would start with the data and the audiences, then write. In our work with the Maryland Port Administration, the audiences for the port’s sustainability story ranged from residents and elected officials to regulators and private-sector partners, and one document could not serve them all. A report built on checked data can be cut into the pieces each audience needs; one built on adjectives cannot.