Five agencies dominate ESG ratings, and they are not grading the same thing. MSCI asks how exposed a company is to financially material ESG risk compared with its industry. Sustainalytics asks how much of that risk is left unmanaged, in absolute terms. ISS ESG asks a double question — financial risk and outward impact. CDP grades environmental disclosure and action through its own questionnaires, and EcoVadis scores the management system a supplier actually runs. A company can be a leader in one of these frames and a laggard in another, and both grades can be honestly earned. With ESG ratings now feeding index construction, credit analysis, supply-chain qualification and — since the EU brought rating providers under authorization — regulatory scrutiny of the raters themselves, issuers need to know which question each agency is asking before they try to improve the answer.
The five at a glance
| Provider | The question it answers | Scale | What you get | Who uses it most |
|---|---|---|---|---|
| MSCI ESG Ratings | How well do you manage financially material ESG risk vs. your industry? | AAA to CCC, industry-relative | Letter grade + 0–10 weighted key-issue score | Asset managers, index construction |
| Morningstar Sustainalytics | How much material ESG risk is left unmanaged? | 0 to 100+ risk score (lower is better) | Score + five bands: Negligible to Severe | Portfolio and credit risk teams |
| ISS ESG | How do you perform on financial risk and outward impact? | A+ to D−, decile-ranked by sector | Grade + Prime status + Governance QualityScore | Stewardship and proxy teams, ESG funds |
| CDP | How completely do you disclose and act on climate, water and forests? | D− to A, by theme | Thematic grades (A List at the top) | Procurement, supply chains, climate specialists |
| EcoVadis | Does your CSR management system actually work? | 0 to 100 | Scorecard + medals (Platinum, Gold, Silver, Bronze) | Enterprise buyers qualifying suppliers |
How each one actually scores
MSCI: industry-relative, controversy-deducted
MSCI selects a set of Key Issues for each GICS sub-industry and scores every company 0–10 on each, then weights them into one score that maps to the AAA–CCC letter band. Governance — corporate governance and corporate behaviour — is assessed for every company under a deduction model: each company starts at 10 and loses points for gaps against best practice. Environmental and social weights swing hard by sector, heavy for mining and utilities, lighter for services. Controversies enter as arithmetic, not adjectives: MSCI’s methodology deducts from 0 to −5.0 points from the affected Key Issue’s management score depending on the controversy’s severity, status and the company’s role in it, and a case scored 0 on MSCI’s separate controversies scale is a Very Severe red flag. There is no separate letter cap — the deduction is the mechanism, and a bad enough one moves the grade by itself.
Sustainalytics: one subtraction
The ESG Risk Rating is a single subtraction: unmanaged risk = exposure − managed risk. Exposure starts at industry level and adjusts for the company’s actual activities; managed risk scores the policies, programmes and metrics the company runs against that exposure. The result lands in one of five bands — Negligible (under 10), Low (10–20), Medium (20–30), High (30–40) and Severe (40 and above). Controversies are tracked as events in five categories, from Category 1 (low impact) to Category 5 (severe, systemic). A Category 5 event feeds straight into the management assessment, which is why a company with beautiful written policies can still watch its score worsen after an incident: the model prices what happened, not what was promised.
ISS ESG: two materialities, one grade
ISS ESG rates on a double-materiality model — the company’s exposure to ESG risk and its impact on the environment and society around it. Grades run A+ to D− and are decile-ranked within sector, so the grade is always a position among peers. Companies clearing their sector’s Prime threshold (the bar differs by industry) earn Prime status, which many institutional ESG funds use as an inclusion filter. Governance gets its own instrument, the Governance QualityScore — a decile score across board structure, shareholder rights, compensation and audit — and ISS layers norm-based research on top, checking conduct against the UN Global Compact, the OECD Guidelines and the UN Guiding Principles on Business and Human Rights.
CDP: a ladder you climb in public
CDP does not model you from the outside; it scores what you hand it. Its questionnaires — Climate Change, Water Security, Forests — grade companies through four levels: Disclosure (D−/D), for completeness of what’s reported; Awareness (C−/C), for understanding impacts and risks; Management (B−/B), for policies, targets and governance actually in place; and Leadership (A−/A), where verified emissions, a transition strategy and science-based targets live. You cannot skip a rung: the thresholds at each level gate the next. That makes CDP the most gameable-looking and the least gameable in practice — the grade is a function of evidence submitted, and the A List is published.
EcoVadis: the management system, audited
EcoVadis scores the system, not the story: 21 criteria across four themes — Environment, Labor & Human Rights, Ethics, and Sustainable Procurement — each assessed through a Policy → Actions → Results chain. Evidence is documentary: certifications such as ISO 14001 or 45001, audit reports, published policies with dates and owners, tracked KPIs. The output is a 0–100 scorecard and, at the top bands, the medals procurement teams use as a qualification gate. Of the five, EcoVadis is the one most companies meet first — not through an investor, but through a customer’s supplier portal.
Why the same company gets five different grades
The divergence is structural, and it has a name: aggregate confusion. In the study that named it — Berg, Koelbel and Rigobon’s Aggregate Confusion: The Divergence of ESG Ratings — correlations between major providers’ ratings of the same companies run roughly 0.38 to 0.54, where credit ratings from S&P, Moody’s and Fitch correlate above 0.95. The study decomposes the gap into three causes, and each one is visible in the five methodologies above:
| Source of divergence | What it means | Where you can see it |
|---|---|---|
| Scope | Providers measure different attribute sets | CDP stops at environmental themes; EcoVadis scores supplier management systems; MSCI prices financial risk exposure |
| Measurement | The same attribute is measured with different indicators | Safety read as injury rates (TRIR) by one rater, written policy by another, dispute history by a third |
| Weight | The same indicators count for different amounts | Carbon carrying a heavy weight for a chemical maker at one provider, water or product governance outweighing it at another |
The practical consequence: there is no single “ESG score” to optimize, and chasing one rater’s methodology can leave another’s untouched. What transfers across all five is the underlying evidence — measured emissions, dated policies, audit results, incident records — which is why the working strategy below is an evidence strategy, not a ratings strategy.
The raters are being regulated now, and consolidating
The EU’s ESG Ratings Regulation brings rating providers under ESMA authorization, with methodology and conflicts disclosure attached. Providers operating in the EU must show how their ratings are built, separate ESG rating activity from credit rating and consulting conflicts, and state whether a rating measures financial risk, impact, or both — the single/double materiality distinction that runs through the table above is becoming a disclosure the rater owes, not a preference it holds. Consolidation is moving in parallel: in September 2026 Glass Lewis and Clarity AI combined — proxy voting and stewardship on one side, AI-driven sustainability data on the other — into a single platform of more than 900 professionals, with the combined firm seeking authorization under the same regulation. Ratings are becoming regulated infrastructure, and the providers are reorganizing to be regulated at scale.
Working all five at once: an evidence architecture
Step one is a single source of truth: one audit-ready repository of sustainability data, mapped once to the frameworks that demand it. The same emissions inventory feeds CSRD/ESRS reporting, ISSB S1/S2 disclosure, California’s SB 253 filing (our compliance playbook covers that regime) and every rater’s questionnaire. Our compliance frameworks map shows how those frameworks overlap; the operational point is that a KPI defined five ways in five spreadsheets will eventually contradict itself in front of a rater, an auditor, or both.
Step two is to publish like the reader is a machine, because it is. Rating platforms ingest data with scrapers and automated research tools. Numbers buried in image-based PDFs, undated policy documents and narrative-only disclosures are systematically under-read. Structured tables next to the narrative, dated and versioned documents, and explicit metadata on reporting pages are unglamorous and decisive — the same disclosure, formatted for extraction, scores better than the identical disclosure formatted for a brochure.
Step three is to treat the review windows as deadlines, because they are the only appeal you get. MSCI issuers review their data profiles through the issuer portal during the comment window before scores lock. Sustainalytics runs an issuer review of the draft profile before the risk score finalizes. EcoVadis renewals reward current, signed, third-party-verified documentation. In each case the correction channel closes; a calendar that tracks all three windows — and the CDP submission cycle — is the cheapest ratings programme there is.
Step four is controversy conduct, decided in advance. When an incident lands, both MSCI’s deduction model and Sustainalytics’ event categories move on what the company demonstrably does next: a published remediation plan, independent audit findings, changed oversight. Companies that respond in public, with documents, exit controversy deductions measurably faster than companies that respond with statements. Decide who publishes what, where, before you need to.
Frequently asked questions
Why do two agencies rate the same company so differently?
Because they measure different things with different instruments at different weights — scope, measurement and weight divergence. Correlations across ESG raters run about 0.38–0.54, against 0.95+ for credit ratings. Divergence is the expected output of the methodologies, not evidence that one rater made an error.
Which rating should a company prioritize?
The one its own stakeholders actually use. Index inclusion and most passive flows run through MSCI; credit and portfolio risk teams read Sustainalytics; stewardship teams sit inside ISS; a key customer’s procurement gate is usually EcoVadis or a CDP supply-chain request. The priority order is a fact about your investor base and customer list, not about the raters.
Does a severe controversy permanently cap our MSCI rating?
No — and there is no letter cap in MSCI’s methodology. Controversies deduct 0 to −5.0 points from the affected Key Issue’s management score, scaled by severity and the company’s role, and deductions age and resolve as cases conclude and remediation is verified. The damage is real but it is arithmetic, not a life sentence.
Is CDP a rating agency in the same sense as MSCI?
Not quite. MSCI, Sustainalytics and ISS model companies from outside data whether or not the company cooperates. CDP scores a questionnaire the company submits — disclosure is the input, so a company that does not respond is scored on that absence. EcoVadis sits between the two: questionnaire-based, but evidence-audited.
What does the EU’s ESG Ratings Regulation change for a rated company?
Indirectly, clarity. Providers authorized under the regulation must disclose their methodologies, data sources and whether they measure financial risk, impact, or both. For an issuer, that means the rules of each grade become readable in a way they historically were not — appeals and preparation get easier to aim.
Sources: MSCI ESG Ratings Methodology (incl. controversy deduction table) and MSCI ESG Controversies & Global Norms Methodology; Morningstar Sustainalytics ESG Risk Ratings methodology; ISS ESG Corporate Rating and Governance QualityScore; CDP scoring methodology (Climate Change, Water Security, Forests); EcoVadis assessment methodology (21 criteria, four themes); Berg, Koelbel & Rigobon, “Aggregate Confusion: The Divergence of ESG Ratings,” Review of Finance (2022); Regulation (EU) 2024/3005 on the transparency and integrity of ESG rating activities; Glass Lewis and Clarity AI combination announcement, September 24, 2026. Provider methodologies change on their own cycles; scales and thresholds above are as published at the time of writing.