Every company that reports under the ESRS has to explain how it ran its double materiality assessment (DMA). That explanation is ESRS 2 IRO-1, and it is one of the few texts in the sustainability statement that auditors, analysts and ESG raters read closely, because it tells them whether the rest of the report rests on a sound process.
In short: ESRS 2 IRO-1 is the description of your DMA process. Under the revised ESRS (Regulation (EU) 2026/1563) it has five elements in paragraph 35: (a) process steps, value chain coverage, methods, inputs and thresholds; (b) how impacts are assessed and prioritised, including how mitigation and heightened-risk areas are considered; (c) the link to due diligence and how stakeholders and experts inform the assessment; (d) significant changes since the prior period; (e) the date of the last update. Our review of 15 real FY2025 sustainability statements shows the texts run from about 700 to 2,450 words (median about 1,350). Only 6 of 15 disclose numerical thresholds, 7 of 15 say nothing about gross vs. net in the DMA section, and many rely on internal experts as proxies for stakeholders. A copy-ready sample text is below.
This article shows what IRO-1 requires under the revised ESRS, what we learned from reading the DMA sections of 15 European groups (Siemens, SAP, BASF, Danone, L'Oréal, Ørsted, MOL, OTP Bank and others), which weaknesses readers and auditors spot, and gives you a sample text for a fictional mid-sized group. If you are still running the assessment itself, start with our CSRD double materiality assessment guide or the general materiality assessment overview.
What is ESRS 2 IRO-1?
IRO stands for impacts, risks and opportunities, the unit of analysis in every DMA (what IROs are). ESRS 2 contains three disclosure requirements that together report the DMA:
| Disclosure | What it covers |
|---|---|
| IRO-1 | The process: how you identified and assessed IROs, with which criteria, thresholds and inputs, and when |
| IRO-2 | The result: your material IROs and how they affect people, the environment and the company, plus the list of disclosure requirements you report |
| SBM-3 | The interaction of material IROs with strategy and business model, and their current and anticipated financial effects |
IRO-1 is a narrative disclosure. No table or matrix is prescribed, and a materiality matrix is not required under either the 2023 or the revised ESRS.
What IRO-1 requires under the revised ESRS
The revised ESRS were adopted on 3 July 2026 as Delegated Regulation (EU) 2026/1563 and are mandatory for financial years starting on or after 1 January 2027 (for FY2026 companies can choose). The table below lists the IRO-1 datapoints from EFRAG's 2026 draft datapoint list, as contained in our free ESRS Datapoint Explorer. Use it as your checklist.
| # | Para. | Required element | What to write | Check |
|---|---|---|---|---|
| 1 | 35(a), AR 22–24 | Process and decision-making steps to identify IROs and assess their materiality | The steps in order, who did what, top-down (§27) or bottom-up (§28) per topic | ☐ |
| 2 | 35(a) | Approach to cover own operations and upstream and downstream value chain | Which value chain stages, which data (supplier data, sector or regional data, §33) | ☐ |
| 3 | 35(a) | Key methodologies, inputs and assumptions | Sources for the long list, scales, scoring formula, time horizons | ☐ |
| 4 | 35(a) | Qualitative considerations or quantitative thresholds | Scale and cut-off per dimension, override rules, aggregation from IRO to topic | ☐ |
| 5 | 35(b), AR 24–26 | How impacts are assessed and prioritised | Severity (scale, scope, irremediable character) and likelihood; human-rights rule | ☐ |
| 6 | 35(b) | How actions to prevent, mitigate or remediate are considered | Gross vs. net logic in line with ESRS 1 §43 | ☐ |
| 7 | 35(b) | How areas of heightened risk (activities, business relationships, geographies) are considered | Which countries, sectors or supplier groups got extra attention, and why | ☐ |
| 8 | 35(c), AR 24 | Assessment is informed by the sustainability due diligence process | Which due diligence outputs fed in (e.g. supply chain risk analysis) | ☐ |
| 9 | 35(c) | How consultations with affected stakeholders and external experts inform the assessment | Who, how, when, how many, and what changed because of it | ☐ |
| 10 | 35(d) | Significant changes to the process and material information vs. the prior period | Method, threshold or scope changes, or "no significant changes" | ☐ |
| 11 | 35(e) | Date of the last update of the materiality assessment | A date, not just a year | ☐ |
What moved out of IRO-1. Compared with the 2023 version, the revised IRO-1 is shorter. The separate datapoints on the process for financial risks and opportunities, the prioritisation of sustainability risks against other risks and the integration into overall risk management no longer appear in EFRAG's 2026 draft list, and neither do the topical IRO-1 requirements of E1 to E5. The description of your material IROs now sits in IRO-2 (§37(a)), including the basis for concluding that climate change is not material (§37(b)), while SBM-3 covers their interaction with strategy and their financial effects. All changes to the DMA rules are explained in our article on the DMA under the revised ESRS.
Two rules that shape the text. First, the revised ESRS ask for a concise, company-specific description and warn against boilerplate. Second, revised ESRS 1 §34 requires you to update the DMA only when significant changes occur, which is exactly why IRO-1 now asks for the date of the last update. More on update cycles in our article on updating the DMA.
What we learned from 15 real sustainability statements
We read the DMA sections of 15 sustainability statements for financial year 2025, published between November 2025 and April 2026: eight German groups (including two mid-caps), three French, one Danish, one Dutch and two Hungarian. All were prepared under the 2023 ESRS (several with the 2025 "quick fix" reliefs), because the revised ESRS were only adopted in July 2026. They are therefore a snapshot of current practice, not of the new rules. Word counts are approximate and cover the process description only, without results tables.
| Company (report) | Sector | Scale | Numerical thresholds disclosed | Stakeholder input described for FY2025 | Gross / net stated | Length (words) |
|---|---|---|---|---|---|---|
| Siemens (FY to Sep 2025) | Industrial tech | 1–5 | Partly (range 3–4) | Existing channels, focus groups, expert interviews | Gross | ~1,780 |
| SAP | Software | 1–5 per criterion, € bands | Yes | Internal experts | Gross | ~1,140 |
| Henkel | Consumer goods | 0–5 | Yes (no €) | Internal representatives per group | Gross (impacts) | ~1,400 |
| BASF | Chemicals | 5-point | No | Advisory councils, civil society forum, perception studies | Not stated | ~700 |
| Deutsche Telekom | Telecom | 5-point / 4-level | No | Desk research, interviews, workshops | Not stated | ~1,460 |
| PUMA | Sporting goods | 0–15 / 0–5 | Yes | 40 + 20 local organisations in sourcing countries | Gross | ~1,540 |
| Krones (mid-cap) | Machinery | 0–15 / 0–5 | Yes | Internal proxies | Not stated | ~1,260 |
| Jenoptik (mid-cap) | Photonics | 1–5 | Yes | 2023 survey, confirmed internally | Not stated | ~2,130 |
| Danone | Food | Not disclosed | No (qualitative) | 2024 consultation, method not described | Gross | ~730 |
| Schneider Electric | Electrical equipment | 4 levels | No | None new in 2025 (2024 validation) | Gross | ~2,450 |
| L'Oréal | Cosmetics | Not disclosed | No | Interviews with 45+ external stakeholders | Gross | ~1,050 |
| Ørsted | Renewable energy | Not disclosed | No | Internal experts as proxy | Hybrid | ~1,350 |
| Philips | Health tech | Not disclosed | No | AI-based analysis of public data, internal workshops | Not stated | ~900 |
| MOL | Oil and gas | Verbal levels | No (graphical) | Internal experts, external survey 2025 | Not stated | ~1,080 |
| OTP Bank | Banking | 0–15 / 0–5 | Yes (score bands) | Internal proxies (survey in 2024) | Not stated | ~1,800 |
1. Length varies by a factor of three, and longer is not better
The process descriptions range from about 700 words (BASF) to about 2,450 words (Schneider Electric), with a median of about 1,350 words, roughly two to three pages. BASF's short text still contains something many longer ones lack: a table of the impacts and risks that were dropped or newly identified in 2025. The useful length is the one that covers all eleven checklist items once, without repeating generic DMA theory.
2. Fewer than half disclose numerical thresholds
Six of 15 reports state their thresholds in numbers. SAP goes furthest: it publishes the scoring logic with likelihood factors, euro bands for financial magnitude (from below €25 million to above €500 million) and a worked example, and sets materiality at an impact score of 8 and a financial score of 3. PUMA writes plainly: "Impacts scoring 8 and above were deemed material." Henkel discloses a severity-likelihood rule that also captures high-severity, low-likelihood impacts. Krones even explains that it raised its thresholds in 2025 (from 8 to 10 on a 0–15 scale for impacts) "in order to apply an integrated approach to risk assessment". Jenoptik says who set its threshold of 4 on a 1–5 scale: a management workshop with the Executive Board. OTP Bank discloses score bands: severity of 8 to 15 combined with likelihood for impacts, 3 to 5 for financial effects.
The other nine describe a threshold without giving it. BASF classified IROs as material "whenever they exceeded a defined threshold", Deutsche Telekom "prioritized these on the basis of a threshold", Philips writes that its thresholds "have primarily a qualitative nature", and Siemens names a range: "a value between three and four on a five-point scale". How to set and justify thresholds is covered in our article on materiality thresholds.
3. Gross vs. net: half say it, half do not
Seven reports explicitly assess on a gross basis. Schneider Electric is the clearest: the assessment "is performed on a gross basis, prior to the consideration of any mitigation actions". Ørsted uses a stated hybrid that accounts for actions "fully integrated into our governance, management, and daily operations". Seven reports do not address the question in the DMA section at all. SAP states a gross approach, but its scoring graphic defines financial likelihood as the probability "after countermeasures have been taken", which shows how easily the two get mixed up. Under revised ESRS 1 §43 this question is now regulated: potential negative impacts may only be reduced by actions that are already implemented and effective. Your IRO-1 text should say which logic you applied.
4. Stakeholder input often comes from internal proxies
For FY2025 most companies updated a 2024 assessment, and many did so without new external input. Henkel names internal representatives for each stakeholder group; Krones writes that IROs "were assessed by proxy by the company's direct contact persons for each stakeholder group"; OTP Bank states that "the opinion of external stakeholders was represented by internal experts"; Ørsted uses "in-house subject-matter experts as a valid proxy". This is not wrong in itself: revised ESRS 1 §42 accepts engagement carried out through due diligence. What makes the difference is transparency. SAP and Schneider Electric explain why no new engagement was needed (no significant changes). The strongest examples are sized: PUMA collected input from 40 local organisations on human-rights IROs and 20 on environmental IROs in its main sourcing countries, and L'Oréal tested its preliminary findings with "more than 45 external stakeholders". See our guide to stakeholder analysis in the DMA.
5. The link to risk management is standard, euro amounts are rare
Almost every report connects financial materiality to enterprise risk management (ERM). The quality varies: SAP uses the same euro bands in the DMA and in ERM; Krones publishes its ERM bands (low €1–10 million, medium up to €50 million, high above); Deutsche Telekom publishes ERM bands from €200 million to €1 billion, but does not say which level counts as material in the DMA; Henkel and L'Oréal say their thresholds are "aligned" with risk management without numbers. OTP Bank is candid that integration into overall risk management is still to come.
6. Only 3 of 15 state the human-rights rule
ESRS 1 requires that for potential negative human-rights impacts, severity takes precedence over likelihood. Only Siemens, Danone and Ørsted state it in their DMA description. Danone's sentence is a good model: "Regarding potential negative impacts on human rights, the severity criteria takes precedence over the probability criteria." It costs one line.
7. Changes are reported well, dates rarely
The good news: several companies show what changed. BASF has a change table, Deutsche Telekom lists IROs added and removed, Krones explains its new thresholds, and OTP Bank and MOL describe a re-performed assessment with a new scoring method. Less helpful is Danone's note that the assessment was "updated … to align with market practices" without saying what changed. A precise date of the last update is rare: most reports name only the year. Danone (validation in September 2025) and Jenoptik (Audit and ESG Committee in August 2025, Supervisory Board in December 2025) give months. Under the revised ESRS a date becomes a datapoint of its own (§35(e)).
8. Governance ranges from "informed" to "approved"
At BASF, the boards and works councils "were informed about the process and the outcome". At PUMA, the final list of IROs "is formally approved by PUMA's Management Board and Supervisory Board", and Krones' Executive Board approved the results "by resolution". Philips stands out because IRO-1 falls under reasonable assurance in its report. Two reports contradict themselves: OTP Bank names the ESG Committee as final approver in one section and the Board of Directors in another, and Ørsted writes on one page that it refined its method and on the next that the process "has not changed compared to 2024". Five of the 15 show a chart-style matrix (SAP, Schneider Electric, Ørsted, Philips, MOL); the others present results as tables.
Common weaknesses auditors and readers spot
From our sample and from the questions auditors typically ask (see our DMA audit checklist), these are the patterns to avoid:
- "A defined threshold" without the threshold. If you scored, give the scale and the cut-off. Otherwise readers cannot judge why a topic is in or out.
- Silence on gross vs. net, or a statement that contradicts the scoring definitions.
- Stakeholder engagement claimed but not described. Say who, how, when and how many, and what changed as a result. If you used internal proxies, say so and why.
- Generic DMA theory that would fit any company ("we followed a robust, multi-step process in line with EFRAG guidance") instead of your own steps, data and decisions.
- Inconsistencies between sections, such as different approval bodies in governance and IRO-1, or "no changes" next to a description of a new method.
- Key information only in graphics. Scales and thresholds embedded in images are hard to read for screen readers and data users. Repeat them in text or a table.
- Terms that deviate from the ESRS. Use scale, scope, irremediable character and likelihood, not your own synonyms.
- No date and no change log. "Updated in 2025" is not a date of last update.
How long should your IRO-1 disclosure be?
Our recommendation, based on the sample: 800 to 1,500 words plus one table with scales and thresholds. That is enough to cover all eleven checklist items for a mid-sized group. Put the results (material IROs) in IRO-2, not in IRO-1, and refer to topic-specific details instead of repeating them. If your assessment is genuinely complex (many segments, many sites), add structure, not adjectives.
Sample text: IRO-1 disclosure for a mid-sized group
The following model text is written for a fictional industrial group with around 2,500 employees under the revised ESRS. It follows the checklist above. Replace everything in [square brackets], delete what you did not do, and make sure every sentence matches your documentation, because the auditor will compare the two. The scales and thresholds match our worked DMA example.
ESRS 2 IRO-1: Description of the process to identify and assess material impacts, risks and opportunities
Process and approach. [Company] Group performed its double materiality assessment in accordance with ESRS 1 chapter 3. The assessment was coordinated by [Sustainability function] and carried out in [four] steps between [month] and [month year]: (1) analysis of our business model, sites and value chain, (2) identification of impacts, risks and opportunities (IROs), (3) assessment against defined criteria and thresholds, (4) validation and approval. For topics whose materiality or non-materiality was evident from our business model, sectors and geographies, we concluded at topic level without a detailed IRO assessment (top-down); this applied to [E.g. biodiversity and ecosystems, affected communities]. All other topics were assessed IRO by IRO (bottom-up).
Value chain and inputs. The assessment covers our own operations at [number] sites in [number] countries, our upstream value chain ([main purchased materials, e.g. steel, electronic components]) and our downstream value chain ([use phase and end of life of our products]). Inputs included our risk register, the results of our supply chain due diligence, energy and emissions data, customer and investor enquiries, sector studies [name sources] and the list of sustainability matters in ESRS 1 Appendix A. Where data from value chain partners was not available, we used sector and regional data.
Assessment of impacts. Negative impacts were rated on scale, scope and irremediable character (each 1 to 5), potential impacts additionally on likelihood (1 to 5). Positive impacts were rated on scale, scope and, if potential, likelihood, without netting against negative impacts. For potential negative human-rights impacts, severity takes precedence over likelihood. Actual impacts were assessed as they occurred; potential negative impacts were reduced only by prevention and mitigation measures already implemented and effective at the reporting date, not by planned measures. We gave particular attention to [activities, supplier countries or business relationships with heightened risk, e.g. raw material sourcing in country X], identified through our [supplier risk analysis].
Assessment of risks and opportunities. Risks and opportunities were rated on the potential magnitude of their financial effect (1 to 5, based on the EBIT bands of our enterprise risk management: [€ amounts]) and likelihood (1 to 5) over the short (up to 1 year), medium (1 to 5 years) and long term (more than 5 years). Material sustainability risks are transferred to our risk register and reviewed in the [quarterly] risk reporting.
Thresholds. An IRO is material if its score reaches [3.0] or more on the 1 to 5 scale in the respective dimension. In addition, any potential negative human-rights impact rated 4 or 5 on scale is material regardless of likelihood. A topic is material if at least one of its IROs is material. Borderline results ([2.5 to 2.9]) were discussed in a calibration workshop on [date] and documented.
Stakeholders and due diligence. The assessment is informed by our due diligence process [e.g. under our supplier code of conduct and risk analysis]. Views of affected stakeholders were included through [e.g. interviews with the European Works Council and two supplier representatives, the results of our employee survey with N responses and a workshop with [NGO name]]. [Number] external experts on [topics] reviewed the draft IRO list. Stakeholder input led to [e.g. the addition of two IROs on working conditions in the supply chain].
Governance. The methodology, scales and thresholds were approved by [the Executive Board] on [date] before scoring began. The results were validated by [the Sustainability Committee] and approved by [the Executive Board] on [date] and presented to [the Audit Committee of the Supervisory Board] on [date]. Every rating, justification and change is documented with date and author.
Changes compared with the prior period. [There were no significant changes to the process.] / [Compared with [year], we changed [the threshold from X to Y / the scope by adding the acquired company Z], because [reason]. As a result, [topic] is now [material / no longer material].]
Date of the last update. The materiality assessment was last updated on [day month year]. In line with ESRS 1 §34, we review at each reporting date whether significant changes in our business, value chain or methodology require an update.
Every number in your IRO-1 text, documented once
Materiality Master records your scales, thresholds, stakeholder links and every rating with its justification, keeps an audit trail of who changed what and when, and lets the AI assistant draft IRO descriptions and rating justifications for you to review.
How to adapt the sample text
- Delete before you add. If you did not hold a calibration workshop, remove the sentence. A shorter, true text beats a complete-sounding one.
- Use your own numbers. Scales, thresholds, dates and participant numbers are what make the text company-specific.
- Keep results out. Material IROs belong in IRO-2; financial effects in SBM-3.
- Check consistency with GOV-1/GOV-2 (who approved), SBM-2 (stakeholders) and your risk report (euro bands, time horizons).
- Keep a change log so next year's paragraphs on changes and the date of the last update take minutes, not days.
Where software helps
An IRO-1 text is only as good as the documentation behind it. Most of the weaknesses in our sample come from information that existed somewhere but was not at hand when the text was written: the exact threshold, who approved it, which stakeholder input changed which IRO.
Materiality Master keeps that information in one place. You rate each IRO on scale, scope, irremediability and likelihood, set your own thresholds for all IROs or per IRO type, link stakeholders to the IROs they informed in the stakeholder assessment, attach evidence such as approval minutes as documents, and the audit trail logs who changed what and when. The AI assistant drafts IRO descriptions and justifications for your ratings, which you review and adjust. When you write IRO-1, you describe what is already documented.
Key takeaways
- ESRS 2 IRO-1 describes the process of your DMA; results go to IRO-2, strategy links and financial effects to SBM-3.
- The revised ESRS ask for five elements in §35: process and thresholds, prioritisation and mitigation, due diligence and stakeholders, changes, and the date of the last update.
- In 15 FY2025 reports, the description ran from 700 to 2,450 words; only 6 of 15 gave numerical thresholds and only 3 of 15 stated the human-rights severity rule.
- The best texts are specific and honest: numbers, named bodies, sized engagement, a change log and a reason when something was not done.
- Use the sample text as a structure, not as a substitute for your own documentation.
Want to see how much easier the next IRO-1 text gets when scales, thresholds, stakeholder input and approvals are documented as you go? Compare the plans on our pricing page or start with the free trial.
