What counts as evidence
A determination is a decision actually made by a named regulator — a judgment, a consent order, an uncontested final order. Never an allegation, never a filed charge. Positive evidence follows the same test: a validated target on a commitment registry, reported emissions in a filing, a disclosure on the record. Everything is dated and links to the record it came from.
Severity, and the stage it comes from
Each determination carries a severity from 0–100. It is a property of the determination, not of the company: it is not a company score, and it never mixes in disclosure. The band a determination lands in is set by how far the matter went, and nothing else.
| Stage | Severity |
|---|---|
| Admitted | 90–100 — a guilty plea or admission. Strictly worse than a contested loss. |
| Judgment, litigated | 70–89 — fought and lost. |
| Judgment, consent | 40–69 — settled, with a court or regulator concluding the matter. |
| Final, uncontested | 30–55 — a final order that went unchallenged. |
| Filed | 10–39 — carried on the record, below the bands that fire an adverse state. |
The scale does not refit. Because severity is anchored to the source and the stage rather than to a distribution, a company told it is Critical does not become non-Critical when other companies change. Every threshold below sits on this scale for that reason.
Where a source sits inside a band
The stage decides the band. The source decides where in that band a determination falls, as a fraction from 0 to 1 — never which band it reaches. A prosecution under a foreign-bribery statute sits near the top of its band, an administrative environmental docket near the bottom, and neither can move to a different band by virtue of who issued it.
So the question “which regulator” never promotes a filing into a judgment. It only says how serious an instance of that stage this is.
Effective severity
Nothing is tested against raw severity. Two multipliers apply first:
- Source tier. Sources are tiered from 1 to 5 and weighted 1.00, 0.70, 0.40, 0.20 and 0.00. A tier-5 source contributes nothing at all — it is excluded entirely rather than quietly down-weighted.
- Decay. Exponential on a 48-month half-life, floored at 0.10: a determination halves in weight every four years and never falls to nothing.
effective severity = severity × tier weight × 0.5(months / 48), floor 0.10
Every threshold on this page is measured against effective severity, not the raw figure. This 48-month half-life is the scoring decay, and it is the only decay applied to a severity. The sixty-month window described next is a separate mechanism that decides which determinations are in scope for a band; it never re-weights a severity, and the two are not the same clock. An old admission scored in the nineties can decay below the exclusion bar and correctly leave the exclusion list — the determination has not been forgotten, it has aged. Reading the raw severity column instead will produce a list of “missing exclusions” that are not missing.
The active window
Sixty months from the regulator’s decision date — never the article date. Full weight to 24 months, then a linear taper to a floor of 0.10 at 60 months. This shape orders findings and defines what counts as recent; it does not move a company between bands, and it does not touch the scoring decay above. Membership of the window is what matters for a band — a determination is either inside the sixty months or outside them.
Five years is a decision, not an inheritance. No standard sets a lookback: the UN Global Compact, the OECD Guidelines and SFDR PAI 10 describe conduct rather than shelf life, ratings screens conventionally lapse a controversy after about three years, and Norges Bank works on ongoing risk instead of age. Five rather than three because the basis here is adjudicated determinations, not allegations; and not open-ended, because a band is a statement about a member’s money today.
Three overrides sit on top of the clock:
- A live obligation holds full weight at any age. While a consent decree, probation, monitorship or undertaking is in force, the finding does not age — the company is in a current legal state, not a historical one. An instrument must be named and its term or end date stated before it counts as in force; anything else is recorded as unknown, and unknown is never read as in force.
- Recurrence resets the clock. A later determination against the same company on the same UNGC principle restarts the window for the earlier one, and marks both recurrent.
- Exclusions never decay. The bar is absolute. An exclusion lifts on evidence of resolution, never by the passage of time.
How a band is assigned
Bands are assigned by a lookup on published rules. Each is fired by one stated fact, and never by a weighted average.
| Band | Rule |
|---|---|
| Excluded | A determination clearing the exclusion bar for its pillar on effective severity — 70 governance, 80 environment, no bar on social. Absolute: an exclusion lifts on evidence of resolution, never on age. |
| Critical | A determination at one of the three courtroom stages — admitted, litigated or consent — at or above 69.0, inside the window. |
| Elevated | An adjudicated determination on file inside the window, below the critical floor. |
| Leader | A validated emissions target, reported emissions falling, and no determination in the window. All three must hold. |
| Reported | Disclosure on file and no determination in the window. The filing is recorded, not scored. |
| Watch | A high-observation sector where this company is unobserved: covered peers carry adjudicated harm and this one carries none. |
Why the critical floor is 69.0. It is the top of the consent-judgment band, and it was chosen by measuring what each candidate admits. At 40 — the bottom of that band — 1,107 companies qualify, 29.9% of the companies scored, because mine-safety penalty dockets sit between 42.5 and 68.3 and every routine inspection becomes Critical. At 60, 419 companies, most still reached by one sector regulator. At 69, 194 companies, 5.24% of the companies scored, and not one of them reached by a routine penalty docket. The routine mass disappears exactly where the consent band ends.
The floor is not set at the exclusion bar of 70, because that would drop the eight companies whose worst finding is a consent judgment at exactly 69.0 — the case the rule exists to catch.
The Watch band is deliberate rather than flattering. Where a sector is densely covered and a company shows nothing, that is as likely to be an absence of observation as an absence of harm, and the band says so instead of reading it as a clean record.
The exclusion bar, by pillar
| Pillar | Bar |
|---|---|
| Governance | Effective severity 70 — the adjudicated severity band. |
| Environment | Effective severity 80, sector-relative: the worst decile of the sector, and rising. |
| Social | No bar. By design, and stated rather than pending. |
Why social has no exclusion bar. Four candidate sources were assessed and each fails a test that matters more than having a number to publish. Workplace-injury reporting covers one country only. A forced-labour entity list runs to 187 entities, almost all private suppliers rather than listed issuers. National contact points under the OECD Guidelines have no enforcement power, and a statement is not a finding. A human-rights resource centre is breadth-capped at 2,110 companies with no usable terms.
An exclusion bar built on any of them would exclude companies for being American, or for being named by a body that cannot determine anything. This is a stated methodology position, not a gap awaiting a fix.
What this methodology does not produce
Stated here rather than discovered later.
| Not produced | Why |
|---|---|
| A published ESG score or rating | A composite is computed internally and never leaves the record. Its cut points are quantiles fitted on one population at one moment, so a company’s band could move while nothing about the company moved. Every threshold here sits on the source-anchored severity scale instead. |
| A controversy score inside the bands | A controversy is an allegation. Nothing a journalist wrote fires a band — the record must exist in a register, with a stage and a date. Allegations are monitored in a separate tier, described below, and that tier never reaches a band. |
| A forward-looking signal | Every figure describes what has already been determined. No transition-risk model, no implied temperature rise, no projection. |
Pillars
E, S and G are assigned by the subject of the finding, not by sector priors: an EPA case is environmental, a mine-safety case is social, a competition case is governance. A company inherits pillars from what was determined against it.
The pipeline
- Source ingestion. Event streams, commitment registries and issuer identity databases. No single source is treated as authoritative.
- Entity resolution. Names, tickers, ISINs and LEIs reconciled into one issuer graph, with duplicates collapsed. Matching is deterministic against that graph, which also ties subsidiaries to the parent that owns them. There is no fuzzy name matching.
- Event normalisation. Findings classified by severity and pillar, deduplicated across sources, and aligned in time.
- Cross-source validation. Claims tested across sources, commitments cross-referenced against the determination record, contradictions flagged rather than resolved silently.
- Band assignment. Each company is placed in one band by a lookup on the published rules above, each fired by one stated fact. Direction of travel is reported separately, as dated events rather than as a trend line. Nothing is blended into a single figure.
This platform does not overlay third-party ESG datasets. It runs the pipeline above and constructs nothing until the evidence has been resolved, normalised and validated.
Grouping and separation
One case counts once. A single cartel judgment naming ten defendants is one judgment, not ten findings — counting each defendant separately would overstate the evidence several times over.
Competition-law determinations are disclosed separately from breaches of a fund’s own published policy. They are real determinations and they are shown, but folding them into a policy-breach figure would answer a question the scheme did not ask.
Attribution and coverage
Attribution is point-in-time. Where holdings are involved, presence is recorded at stated observation dates and continuity between those dates is not claimed.
Coverage is reported as its own figure rather than blended into a result. A thinly covered sector, country or fund is marked as thin rather than coloured with confidence, and the unseen share is stated. A low adverse figure on a low-coverage population can mean opacity rather than virtue.
Recurrence, and the floor on it
A pattern of violation is not the same as a company operating many sites. Run unfloored, “same company, same principle, two or more determinations” reaches roughly a fifth to a third of a large fund’s holdings, because environmental and mine-safety penalties are issued per inspection.
So a determination counts toward recurrence only when its stage is one of the courtroom stages and its severity is at or above 65.0 — both conditions, not either. Read as either, the stage clause readmits the entire routine mass at any floor: capture stays flat at 286 companies whether the floor is 50 or 69.
Read as both, the routine mass collapses from 28 companies to 1 between 60 and 65, and what survives is regulator-diverse rather than one high-volume docket family. Determinations below the floor are not deleted: they are carried on the row as routine penalties, disclosed, and never the headline.
Coverage and jurisdiction
Every adverse regulator ingested is US, UK or EU — the SEC, DOJ, EPA, MSHA and OSHA; the FCA, SFO, CMA and Modern Slavery Registry; DG COMP and eight national data-protection authorities. A company domiciled outside those three blocs cannot generate an adverse finding here no matter how it behaves, so “no finding” carries no information about it, and the report says so rather than reading silence as a clean record.
US banking regulators (the OCC, Federal Reserve, FDIC, CFPB and FinCEN), the Department of Labor’s Wage and Hour Division, the CPSC, OFSI and the ICO are being added. Each is fetched into staging and counts toward nothing until a hand-checked sample of its matches resolves at 95% precision or better; the list above changes only when one is adopted, and the adoption is dated. Sanctions designations, when adopted, are shown as a separate flag and never enter a band. The Data page lists each one.
Two floors follow from the same principle. A fund seen at under 50% is never marked consistent and never shown green: its adverse figure rests on less than half the pot. And a heatmap cell built on fewer than 20 companies is drawn uncoloured with its count shown, and never sorts above a cell that clears the floor — thin data is the easiest thing to make look confident.
The composite, and why you never see it
A composite risk figure is computed internally and stored on the scored record. It is never published, and it never bands a company. Saying we do not produce one would be untrue the moment anyone opened the file; the honest claim is the stronger one, because the separation is architectural rather than an omission.
Bands are not the composite in disguise. The band ladder ignores it entirely, and the engine asserts structurally that no band can be an arithmetic blend. If a band ever became a function of the composite, the run fails rather than publishes.
The reason it stays internal is worth stating plainly. Its cut points are quantiles — fitted on a population of 2,939 companies at one moment in time. They are a distributional artefact of that population and would move if the population moved, which means a company’s composite band could change while nothing about the company changed. Every threshold on this page is on the source-anchored severity scale instead, precisely so that cannot happen.
Filed proceedings are carried, never counted
Enforcement proceedings that have been brought and remain unresolved are allegations: no finding has been made. They are recorded, and they carry a severity of 10–39 for internal ordering, but a filed row is excluded from every adverse band computation — from the bands, the heatmap, momentum, Watch and the exclusion path alike. It cannot reach a determination count, and it cannot fire a band.
The same discipline governs the language of the output: a fixed set of phrases is banned from anything a report renders, and the check runs over the rendered text at publication time. The separation between an allegation and a finding is asserted by the engine at runtime, not left to a reviewer to notice.
Monitored controversies
Press and civil-society allegations sit in a monitored tier, separate from the adjudicated determinations above. They are collected, attributed against the same issuer graph, and displayed with their sources — and they never on their own move a company into a band or into Exclusions.
Each is scored on severity and confidence as two separate bands, shown side by side and never collapsed into one figure, and it fades on a published curve unless corroborated.
When a proceeding is filed or a notice issued, the record escalates into the adjudicated tier and the controversy closes against it, so one matter is never counted twice.
Read the controversies methodology →What this methodology does not produce
No published rating, no estimate of what a company has not reported, and no allegation that fires a band. Controversies are monitored, scored and shown in their own tier; they never enter a band computation. Nothing is inferred to fill a gap: an unseen company is reported as unseen.
It also never treats an absence of new findings as improvement. A company with no new determination in the window has no new evidence — a different statement from a company that has improved.
A consumer-facing composite ESG rating would sit inside the FCA’s ESG ratings regime. Staying outside it is a deliberate choice, and the architecture above is what makes the choice real rather than declared.
What can and cannot be tested
Where a scheme’s own commitments are tested, the engine states what it was able to test rather than marking a fund consistent on the strength of a promise nobody checked.
| Commitment | Status |
|---|---|
| UNGC / OECD violations | Tested — an adjudicated finding mapped to a UNGC principle inside the window. |
| The scheme’s own exclusion list | Tested — joined by name to the list the scheme published. |
| Controversial weapons | Partial, and marked list-based. No activity-revenue data, so a revenue threshold inside the standard is not tested. |
| Tobacco, thermal coal, oil & gas | Not tested. Each carries a revenue threshold and the activity-revenue dataset is not in place. |
| Targets and aspirations | Recorded, never tested. |
UNGC principles are mapped by regulator, because the regulator’s remit is what makes the mapping defensible: the EPA does not bring labour cases and the mine-safety administration does not bring bribery cases.
Publication and versioning
- Public reports run on a quarter-delayed cut. Everything published openly is dated to the end of the last quarter.
- Client data is current, with higher-frequency updates on request, across the complete universe rather than the published sample.
- Every run is stamped with the register revision and scoring version it was produced under, so any figure can be reproduced against the rules in force when it was published.
- Rules are published before results. When a rule changes, the change and its date are recorded rather than applied silently to history.
Limitations
Registers publish on their own schedules, and a determination appears here when it appears there. Coverage varies by region and by company size, and it is reported rather than smoothed. Evidence is what has been adjudicated or filed: a company that is clean on this record is clean on the evidence, which is not the same as clean in the world.
All published output is research. Sustain ESG Lab is not authorised or regulated by the Financial Conduct Authority, and nothing here is investment advice or a personal recommendation.