The best ESG controversy and reputational risk data providers in 2026

Published by Polecat. Polecat is one of the providers compared here. Competitor details are drawn from each company's own published materials as at October 2026, and we say plainly where another provider is the better fit.

The short answer

The best ESG controversy data providers depend on the buyer. For investors and lenders screening portfolios, RepRisk, MSCI and Morningstar Sustainalytics are the established choices, with RepRisk notable for its history back to January 2007 and its non-listed coverage. For corporate risk and corporate affairs teams, Polecat suits a forward view weighted to one organisation's strategy. Datamaran suits regulatory and materiality work, and SIGWATCH suits NGO campaign tracking.

ESG controversy data providers at a glance

The table summarises the six providers covered below.

How we assessed them

We assessed each provider against the questions that decide whether controversy or reputational risk data is fit for purpose. Investors and corporates weigh these differently, so we note both views.

1. Who it is built for. Investor screening needs the same yardstick applied to thousands of companies. Corporate risk management needs one organisation's exposure measured in its own terms.
2. History. A long record lets you see how similar issues developed in the past and test whether a methodology holds up across cycles.
3. Comparability. Scores should mean the same thing across companies and over time, with a published or at least explainable method.
4. Update frequency. Daily ingestion matters for alerting; the cadence at which scores are recalculated matters for screening and reporting.
5. Forward view. Does the provider describe only what has happened, or does it publish a horizon, scenarios and probabilities?
6. Delivery. Investment data channels suit portfolio teams; briefings, board reports and an API into a GRC platform suit corporate risk desks.

Polecat

Polecat delivers Strategic External Intelligence for corporate risk leaders: it measures the whole outside world, not only adverse incidents, scores every event against 20 years of comparable history, weights it to one organisation's strategy and projects where each risk is heading.

Why it matters. ESG controversy data tells an investor whether a company has been linked to misconduct. A corporate risk committee needs something different: how exposed its own organisation is, compared with peers, and what is coming next. At Wendy's, 25% of documented risks are first surfaced by Polecat's horizon scanning, before they appear anywhere else on the register.

How it works. Polecat monitors more than 1.4 million premium sources across 195 countries and merges coverage into single material events, including developments that are not yet incidents, such as a regulatory consultation or an NGO campaign gathering support. Each event is scored on six factors (severity, velocity, sentiment, authority, reach and history), benchmarked against 20 years of comparable events and rolled into a Risk Index out of 100. The Customer Intelligence Model calibrates to each client's taxonomy, definitions and thresholds, so the same event can register as a risk for one company and an opportunity for another. Each risk is projected 3 to 6 months ahead with base, best and worst cases and a probability for each. Our page on how Polecat scores events sets out the method.

What you get. Daily Key Posting Alerts, Daily Risk Briefings and weekly Executive News Briefs, then monthly or quarterly dashboards and board reports, all on one engine. A horizon scan classifies each theme as chronic, recurring, emerging, dormant, contained or fizzled, peer benchmarking compares exposure like for like, and every score traces back to its source evidence.

Where it lives. Briefings and dashboards, an API into GRC and integrated risk management platforms, and MCP access from AI assistants such as Microsoft Copilot, Claude and ChatGPT. Polecat publishes its entry price: a £25K fixed-scope Risk Intelligence Audit.

What to consider. Polecat is built for the corporate risk desk, not for uniform screening across an investment universe. It does have an investment use: Impact Cubed is a named Polecat partner for controversy data for portfolio design. For broad portfolio screening and ESG ratings work, the investor datasets below are the better choice.

Best for: chief risk officers, enterprise risk and corporate affairs teams that need a measured, comparable, forward view of their own organisation's exposure.

RepRisk

RepRisk is a Swiss provider of business conduct and ESG risk data, built from reported incidents of corporate misconduct in public news, regulatory and stakeholder sources. It marked 20 years in June 2026, and its dataset runs back to January 2007.

Where it is strong. History and reach: a daily-updated record from January 2007 covering a very large universe of companies, most of them non-listed, along with projects, which suits due diligence on private companies and suppliers. RepRisk intentionally excludes company self-disclosures, and AI screening is followed by human analyst review before publication; as part of its published method, it records reported allegations rather than verifying them. Its metrics are publicly defined: the RepRisk Index (0 to 100, with current, two-year peak and 30-day trend values), the RepRisk Rating (AAA to D), the UNGC Violator Flag and, since November 2025, more than 200 thematic Due Diligence Scores mapped to frameworks such as SFDR and the German Supply Chain Act. Distribution is a strength too: FactSet named RepRisk its preferred partner for business conduct risk data in July 2026, and the data is also available through Bloomberg and Snowflake.

What to consider. For a corporate risk team, the focus is business conduct incidents rather than wider strategic developments, the metrics describe the present and recent past, and weighting to a client's own strategy is not described. Our Polecat vs RepRisk comparison and our list of RepRisk alternatives go further.

Best for: investors, lenders, insurers and compliance teams that need a long, consistent, outside-in record of business conduct incidents across listed and non-listed companies.

MSCI Controversies and Global Norms

MSCI's controversies research (MSCI Controversies and Global Norms) assesses companies' involvement in reported environmental, social and governance controversies and feeds those assessments into MSCI ESG Ratings and norms-based screening. It is produced by MSCI Sustainability and Climate, part of MSCI Inc.

Where it is strong. The methodology, updated in April 2026, is detailed and public: 28 themes, four severity levels from Minor to Very Severe, a direct or indirect role, and defined case statuses with conclusion periods of one to three years depending on severity. Companies receive a Controversy Score from 0 to 10 and a Red, Orange, Yellow or Green flag. For its ESG Ratings, MSCI states that new data is incorporated daily and scores are recalculated weekly, and ESG Ratings Model 5.0, live since March 2026, adjusted how controversies affect ratings. MSCI's ESG Ratings time series runs from 2007.

What to consider. It is built for investors. The company score is set by the lowest-scoring pillar, so it reflects the single most severe case rather than a weighted profile. MSCI states that controversies are allegations, not assertions of fact, and it does not publish a forward forecast or describe weighting to a client's strategy.

Best for: asset managers and asset owners that use MSCI ESG Ratings and indexes and want controversy assessments inside the same framework.

Morningstar Sustainalytics

Morningstar Sustainalytics, part of Morningstar, rates companies' involvement in ESG-related incidents through its Controversies Research product, on a scale from Category 1 to Category 5. Sustainalytics states that the product is sold mainly to institutional investors.

Where it is strong. Since September 2025, impact and financial risk are assessed separately, giving investors two views of each event. Evidence rules are published: at least two reliable sources, recency requirements, and additional analyst and committee review for Category 4 and 5 assessments. Companies are contacted before a potential Category 4 or 5 rating and can submit public evidence. The research team monitors sources daily, and data reaches users by feed and email and through Bloomberg, FactSet and Snowflake. A subset of events feeds directly into the ESG Risk Rating.

What to consider. Coverage is limited to Sustainalytics' research universe. For Category 3 to 5 events, a Category Change Scenario sets out conditions for an upgrade or downgrade rather than a quantified forecast, and weighting to a client's strategy is not described.

Best for: institutional investors that want controversy ratings with separate impact and financial risk views, linked to Morningstar's ESG Risk Ratings.

Datamaran

Datamaran is a London-founded software company that monitors regulation, corporate disclosures and news to help large companies prioritise external issues and track regulatory change. On 3 September 2026 it rebranded from ESG issue management to enterprise governance.

Where it is strong. Regulatory depth with a published cadence: 19,800+ regulations across 190+ countries, with priority jurisdictions researched on stated weekly, bi-weekly and monthly cycles. Its Core product supports CSRD double materiality analysis and benchmarks against audited CSRD peer reports.

What to consider. It is a governance and materiality workflow tool rather than a controversy dataset. It does not publish a quantified external risk score or a numeric forecast, and API availability is not documented publicly.

Best for: general counsel, risk and sustainability teams that need regulatory monitoring and audit-ready materiality assessment across many jurisdictions.

SIGWATCH

SIGWATCH is a London-based specialist that tracks campaigns by NGOs and other pressure groups targeting companies and issues, selling data, scoring and advisory reports mainly to corporate affairs, public affairs and impact teams.

Where it is strong. A dedicated campaign database spanning more than 14 years. In 2026 it launched the Pressure Score, a 0 to 100 measure built from four named components and designed to be compared and tracked over time. A Daily Pressure Monitor email sits alongside quarterly Pressure Pulse and Horizon Scanning reports.

What to consider. It covers pressure group and activist activity rather than the full range of controversies or external risk, and the Pressure Score's calculation and weightings are shared on request rather than published on its website. Our Polecat vs SIGWATCH comparison sets out the difference in scope.

Best for: corporate and public affairs teams that need a detailed view of NGO and activist pressure on their company and sector.

Which should you choose?

The first question is whose decision the data supports: an investor's view across many companies, or a corporate's view of itself.

For portfolio screening and ESG ratings work, RepRisk, MSCI and Sustainalytics are the better choice than Polecat. For a corporate managing its own exposure, the investor datasets answer a narrower question than the one the board is asking. Our guide to what Strategic External Intelligence is sets out ten questions to put to any provider.

Frequently asked questions

What is ESG controversy data?

ESG controversy data records reported incidents linking companies to environmental, social or governance harm or misconduct, drawn from news, NGOs, regulators and other public sources. Providers assess each case for severity and assign scores, ratings or flags. Investors use the data to screen portfolios and meet norms-based policies; corporates and lenders use it for due diligence on counterparties and suppliers.

Which ESG controversy data provider is best for investors?

RepRisk, MSCI and Morningstar Sustainalytics are the established choices. RepRisk offers a daily dataset back to January 2007 with deep coverage of non-listed companies and projects. MSCI integrates controversies with its ESG Ratings and norms screening. Sustainalytics assesses impact and financial risk separately and links events to its ESG Risk Ratings. The right choice often follows the ratings framework a firm already uses.

What is the difference between ESG controversy data and reputational risk data?

ESG controversy data records adverse incidents a company has been linked to, assessed the same way across many companies for screening. Reputational risk data, as corporate risk teams use it, measures how the wider outside world is moving in relation to one organisation, including developments that are not yet incidents, and weights them to that organisation's priorities. The first looks across a portfolio; the second looks out from one company.

Do ESG controversy providers forecast future controversies?

The investor datasets reviewed here describe the present and the recent past rather than publishing numeric forecasts. RepRisk reports a 30-day trend, MSCI applies case status and conclusion periods, and Sustainalytics sets out a Category Change Scenario for higher-category events. Polecat projects each risk 3 to 6 months ahead with base, best and worst case scenarios and a probability for each.

Can Polecat data be used for investment decisions?

Polecat is built mainly for the corporate risk desk, but it has an investment use. Impact Cubed is a named Polecat partner for controversy data for portfolio design. For broad portfolio screening and ESG ratings work, RepRisk, MSCI and Sustainalytics remain the more established choices, with delivery through the main financial data channels.

About Polecat

Polecat delivers Strategic External Intelligence: 20 years of measured, comparable evidence on the outside world, so risk leaders can see around corners.

The quickest way to judge it is to try the instant demo. Teams that want to see it on their own register can book the fixed-scope Risk Intelligence Audit, priced at £25K, which stands up both layers in three weeks and benchmarks the risks moving fastest against peers.

Related reading: Polecat vs RepRisk: two approaches to reputational risk data and RepRisk alternatives: reputational risk data compared.