How ESG Ratings Work: MSCI, Sustainalytics, S&P Explained

ESG ratings are scores that assess a company's exposure to Environmental, Social, and Governance risks, issued by specialist agencies like MSCI, Sustainalytics, S&P Global, and ISS ESG. Each agency collects data from company disclosures, regulatory filings, news monitoring, and NGO reports, then runs it through a proprietary weighting model. The output is a letter grade (AAA to CCC at MSCI) or a numeric score (0 to 100 at Sustainalytics) used by institutional investors, index providers, and lenders.

That definition is the easy part. The actual mechanics are messier than the marketing suggests, and the four major agencies routinely reach opposite conclusions about the same company using overlapping data.

Key Findings

• MSCI rates over 17,000 issuers and 999,000 securities on a AAA-to-CCC scale, with scores standardized by Global Industry Classification Standard sector, region, and size (MSCI ESG Ratings methodology).
• Sustainalytics rates 16,000+ companies on a 0-to-100 ESG Risk Rating, where lower is better, grouped into five severity bands from Negligible to Severe (Sustainalytics methodology).
• Morningstar acquired the remaining 60% of Sustainalytics on April 21, 2020, becoming sole owner (Wikipedia: Sustainalytics).
• MSCI built its current ESG ratings business by acquiring RiskMetrics Group in 2010, GMI Ratings in August 2014, and climate-analytics firm Carbon Delta in October 2019 (Wikipedia: MSCI).
• ISS ESG operates under Deutsche Börse, which acquired a majority stake in ISS in November 2020 for approximately €1.5 billion (Wikipedia: ISS).
• The average pairwise correlation between major ESG rating providers is 0.61, ranging from 0.38 to 0.71 across pairs. Credit ratings from Moody's and S&P correlate at 0.92 (Berg, Kölbel, Rigobon, Review of Finance, 2022).

What are ESG ratings?

ESG stands for Environmental, Social, and Governance. An ESG rating is a single composite score that aggregates how a company performs against dozens of indicators across those three pillars. Environmental covers carbon emissions, water use, waste, and resource intensity. Social covers labor practices, product safety, supply chain, and community impact. Governance covers board composition, executive pay, accounting practices, and shareholder rights.

The score is meant to be a shorthand for non-financial risk. An investor who doesn't have time to read a 200-page sustainability report can look at the rating and get a rough signal. That's the pitch. Whether the signal is accurate, comparable, or useful is a separate question.

ESG ratings are not regulatory. No government issues them. They're commercial products sold by private firms to institutional investors, index providers, banks, and corporate buyers. The companies being rated are usually not the paying customers.

Who provides ESG ratings?

Four firms dominate the global market, with several smaller competitors.

| Provider | Owner | Scale | Founded / Origin | Coverage | |---|---|---|---|---| | MSCI ESG Ratings | MSCI Inc. (public, NYSE) | AAA to CCC | Built from KLD, Innovest, IRRC, GMI Ratings, RiskMetrics | 17,000+ issuers | | Sustainalytics | Morningstar (acquired April 2020) | 0-100 ESG Risk Rating (lower = better) | Founded 1992 by Michael Jantzi; merged Jantzi Research + European arm | 16,000+ companies | | S&P Global ESG Scores | S&P Global (public, NYSE) | 0-100 (higher = better) | Built from Corporate Sustainability Assessment (CSA), Trucost, RobecoSAM | Thousands of issuers across S&P indices | | ISS ESG | Deutsche Börse (majority since Nov 2020) | Letter and numeric scores | Built from Ethix SRI, IW Financial, oekom research (2018), CAER | Several thousand companies and 25,000+ fund holdings |

MSCI's ratings business is a roll-up. The current methodology inherited research traditions from KLD Research & Analytics (a US SRI pioneer), Innovest Strategic Value Advisors, IRRC, and GMI Ratings, all eventually consolidated under MSCI's brand after the 2010 RiskMetrics acquisition and the August 2014 GMI deal.

Sustainalytics started in Toronto in 1992 and was acquired in stages by Morningstar, with the final 60% purchase closing on April 21, 2020. ISS ESG is the Deutsche Börse-owned arm of Institutional Shareholder Services, the largest proxy advisor in the world; it built its ESG product by acquiring oekom research in March 2018 and several smaller specialists. S&P Global runs its ESG scores through the Corporate Sustainability Assessment, the questionnaire-based methodology it inherited when it acquired RobecoSAM in 2019, paired with Trucost environmental data.

Bloomberg, Refinitiv (now part of LSEG), Moody's ESG, and FTSE Russell also publish ratings, though none has the institutional weight of the four above.

How is the data collected?

The data pipeline is roughly the same across providers, with differences in emphasis. Four channels feed the score.

Company disclosures. Annual reports, sustainability reports, proxy statements, 10-Ks, 20-Fs, and voluntary frameworks like SASB, GRI, and TCFD. This is the largest input. Bigger companies publish more, which is one reason large-cap firms tend to score better than small-caps with identical underlying practices.

Regulatory and government filings. SEC enforcement actions, EPA violations, OSHA records, EU emissions trading data, court filings, and country-specific disclosures. Public-record material that the agency's analysts ingest and code.

Media and controversy monitoring. Wire services, news databases, NGO reports, social media monitoring. Sustainalytics specifically uses AI-assisted news monitoring alongside human analysts to flag controversies. A spike in negative coverage about a labor dispute, an environmental incident, or a governance failure can push a rating down before any official enforcement action.

Company engagement. Most providers allow rated companies to review draft ratings, submit additional information, and dispute findings. Ratings agencies frame this as data quality. It also lets companies with dedicated ESG teams improve their scores by improving their documentation without changing underlying practices. S&P Global goes further with the CSA: companies actively submit responses to a structured questionnaire that feeds the scoring model.

The data is then mapped to a fixed taxonomy of material issues. MSCI uses 35 key issues grouped under the three pillars. Sustainalytics tracks 20+ industry-specific material risks, 200+ indicators, and 1,800+ data points. The taxonomies don't match across providers. That single design choice is responsible for a substantial chunk of why agencies disagree.

How is it scored?

Every major provider uses some version of the same five-step model.

1. Identify which issues are material for the company's industry. An oil major and a software firm don't get judged on the same things.
2. Measure the company's exposure to each material issue.
3. Measure how well the company manages that exposure through policies, programs, and disclosed practices.
4. Subtract managed risk from total exposure to get unmanaged risk.
5. Aggregate the unmanaged-risk scores across all material issues into a single composite, then bucket the composite into a letter grade or a numeric band.

The differences sit in steps 1, 2, and 3. Which issues count as material? How much weight does each get? What counts as adequate management? Each agency answers those questions differently, and each refuses to fully publish the answers because the methodology is its commercial product.

MSCI's approach is industry-relative. Every company is scored against peers in its Global Industry Classification Standard sub-industry, then standardized by region and size. The score is a quintile position within the GICS industry, mapped to a letter. An oil company rated AA is well-managed compared to other oil companies. It is not rated favorably in absolute environmental terms. This distinction is consistently lost in retail coverage.

Sustainalytics' approach is closer to absolute. Its ESG Risk Rating tries to express "unmanaged risk" in a way that allows cross-industry comparison: a high-risk oil company and a high-risk software company can both be flagged as "Severe Risk" because the underlying construct is unmanaged exposure, not relative ranking. The methodology explicitly recognizes that some risks are "unmanageable" for an industry (carbon emissions for oil producers) and carves those out before scoring management quality.

S&P Global's CSA is the most questionnaire-driven of the four. Companies receive a structured assessment, respond to it, and the responses feed a sector-specific scoring model. The score is on a 0-to-100 scale where higher is better. ISS ESG uses both letter grades (the legacy oekom Corporate Rating) and numeric performance scores depending on the product line.

What do MSCI grades mean?

MSCI uses a seven-letter scale modeled on credit ratings.

| Grade | Bucket | Meaning | |---|---|---| | AAA, AA | Leader | Industry leader in managing material ESG risks and opportunities | | A, BBB, BB | Average | Mixed or average track record relative to industry peers | | B, CCC | Laggard | High exposure and failure to manage significant ESG risks |

The grades are explicitly industry-relative. A AAA in oil and gas is not equivalent to a AAA in software. It means the oil company is at the top of its peer set on managing oil-and-gas material issues. This is why Exxon has at times scored above Tesla on MSCI's ESG rating: Exxon is well-managed relative to other oil majors on issues MSCI considers material to fossil fuel producers, while Tesla has weaker governance and labor scores relative to other automakers.

MSCI publishes ratings monthly and re-evaluates on a continuous cycle. Companies can dispute draft ratings before publication. The full historical record on developed markets stretches to 2007, when the firm's analytics first standardized.

What do Sustainalytics scores mean?

Sustainalytics uses a 0-to-100 numeric scale where lower is better, and a five-band severity classification.

| Score Range | Risk Band | Interpretation | |---|---|---| | 0 to 9.99 | Negligible | Trivial ESG risk exposure | | 10 to 19.99 | Low | Minor unmanaged ESG risk | | 20 to 29.99 | Medium | Moderate unmanaged ESG risk | | 30 to 39.99 | High | Significant unmanaged ESG risk | | 40+ | Severe | Severe unmanaged ESG risk |

The intent is absolute, not relative. A 25 at a bank and a 25 at a mining company are supposed to express comparable levels of unmanaged ESG risk, even though the underlying material issues differ. The aggregation weighting at the issue level is industry-specific; the final score is meant to be cross-industry comparable.

Sustainalytics splits Environmental, Social, and Governance roughly 43%, 34%, and 23% in its issue weights, though the exact split varies by sub-industry. The firm publishes a Risk Rating plus several adjacent products: Controversy Rating (1 to 5, with 5 being most severe), Carbon Risk Rating, and product involvement screens.

Why do agencies disagree?

The Berg, Kölbel, and Rigobon 2022 paper in the Review of Finance is the definitive academic treatment. The authors built a common taxonomy across six major providers (KLD, Sustainalytics, Moody's ESG, S&P Global, Refinitiv, and MSCI) and ran the same company data through each. The pairwise correlations ranged from 0.38 to 0.71, averaging 0.61. Moody's and S&P credit ratings correlate at 0.92 on the same kind of comparison.

The paper decomposed the divergence into three causes:

• Measurement (56% of divergence): the agencies measure the same activity differently. One scores "employee health and safety" using injury rates and lost time; another uses fatality counts and policy completeness. Same underlying topic, different operationalization.
• Scope (38%): the agencies disagree on which activities count as material. One includes lobbying transparency; another doesn't. One tracks tax practices; another excludes them.
• Weight (6%): even when scope and measurement align, the agencies weight categories differently in the final composite.

The smallest source is weighting. The biggest is measurement. That means you cannot fix the divergence problem by harmonizing weights; you'd need to harmonize the underlying definitions of what each indicator is and how it's scored, which is the part each agency considers its commercial moat.

The paper also identified a "rater effect": an agency's overall view of a company influences how it scores individual categories. A firm the rater considers ESG-bad ends up with worse scores on individual sub-categories than the underlying evidence justifies, and vice versa. Halo and reverse-halo effects in supposedly mechanical scoring.

What do ESG ratings actually drive?

The marketing implies that ESG ratings change corporate behavior by changing cost of capital. The actual transmission channels are narrower.

Index inclusion and passive flows. This is the largest direct effect. MSCI ESG Leaders indices select the top-rated 50% of constituents in each MSCI parent index by ESG score. Funds tracking those indices automatically buy and sell based on inclusion decisions. When a company is dropped from the S&P 500 ESG Index, as Tesla was in May 2022, passive vehicles tracking that index are required to sell. When a company is added, they're required to buy.

Active manager screens. Some active managers use ESG ratings as a screening input. Below-threshold scores exclude the company from the investment universe. The screen rarely binds in a portfolio-changing way because the thresholds are usually loose enough to admit most large-cap companies.

Sustainability-linked loans and bonds. A growing slice of corporate debt is priced with ESG-rating triggers. A company's borrowing cost may step up or step down based on its rating from a named provider. This is a small but real channel that gives ratings direct financial consequences for the rated company.

Reputational and procurement signals. Some institutional buyers (large pension funds, sovereign wealth funds) publicize their ESG screens. A downgrade from MSCI can produce headlines and pressure even when the financial flows are modest. Corporate procurement increasingly uses ESG ratings to screen suppliers.

Proxy advisor recommendations. ISS and Glass Lewis incorporate ESG signals into voting recommendations on shareholder proposals and director elections. Since ISS ESG is the same family as the dominant proxy advisor, the connection is direct.

What ratings do not reliably do, despite frequent claims: change corporate cost of capital at scale, redirect significant capital away from high-emitting industries, or produce measurable changes in emissions, labor practices, or governance outcomes. The mechanism that would link ESG fund holdings to underlying corporate behavior is weaker than the marketing materials of either the rating agencies or the asset managers suggest. The companion analysis The ESG Industrial Complex walks through the performance and impact data.

The rating itself remains a real product with real consequences for index inclusion and a real fee stream for the issuing agency. The leap from "this company has a high ESG score" to "this company is operating sustainably" is the part the agencies do not promise, but the marketing built around the scores routinely implies.

The WokeCorp assessment

The commitment. The article documents corporate participation in ESG rating processes including filling out questionnaires (S&P Global's CSA), engaging with analysts, reviewing draft ratings, and submitting additional information to dispute findings.

The outcomes. The Berg, Kölbel, Rigobon 2022 paper found average pairwise correlation of 0.61 among major raters (range 0.38-0.71) vs. 0.92 for credit ratings.

The core question. The mechanics described here explain why ESG ratings have weak predictive validity for environmental or social outcomes. A system that measures inputs, processes, and disclosures rather than outputs and impacts will tend to reward disclosure sophistication over actual performance.

Compare with ESG Rating Agencies Disagree About Half the Time.

Related reading

• ESG Rating Agencies Disagree About Half the Time
• The ESG Industrial Complex: $35T in Monetized Virtue
• BlackRock's Exit From Net Zero Asset Managers
• BlackRock's Proxy Voting Record on ESG Resolutions
• NZBA and the Wall Street Exodus from Climate Coalitions
• What Is Greenwashing? A Plain Definition

Sources

Verified May 2026.

• MSCI ESG Ratings methodology overview, msci.com/our-solutions/esg-investing/esg-ratings
• Morningstar Sustainalytics ESG Risk Ratings methodology, sustainalytics.com/esg-ratings
• Florian Berg, Julian F. Kölbel, Roberto Rigobon, "Aggregate Confusion: The Divergence of ESG Ratings," Review of Finance, Vol. 26, Issue 6 (2022), pp. 1315-1344
• MSCI corporate history including RiskMetrics (2010), GMI Ratings (2014), Carbon Delta (2019) acquisitions, Wikipedia
• Sustainalytics corporate history including 2017 partial and April 2020 full acquisition by Morningstar, Wikipedia
• Institutional Shareholder Services, Deutsche Börse acquisition (November 2020) and ISS ESG acquisition history (Ethix SRI, oekom research), Wikipedia
• Global Industry Classification Standard (GICS), jointly developed by MSCI and S&P Dow Jones Indices, used as the industry framework underpinning MSCI's industry-relative scoring