The matrix is finished, every dot traced to its evidence, every stakeholder input accounted for, both lenses defended. And the assurer asks a question that has nothing to do with the data: "Who decided this was material, and on whose authority?" You realise the matrix has been emailed around a working group, edited by three people, and finalised by consensus, but nobody actually signed it. There is no record of who reviewed it, who approved the threshold, who had the authority to make the final call, or when. The numbers are perfect and the conclusion is unowned. In disclosure, an unowned conclusion is not a conclusion at all; it is a draft that happened to get published, and an assurer cannot give comfort on a judgment that no named human stands behind. This lesson is about the basis-of-preparation for the matrix: the governance that decides, reviews, and signs, and the audit trail that makes the materiality call defensible to an assurer.

The Basis-of-Preparation for the Matrix

Every assured disclosure rests on a basis-of-preparation: the documented foundation that explains how the disclosure was produced, on what assumptions, by what methods, and under whose authority. For financial statements this is routine; for sustainability disclosures under the Corporate Sustainability Reporting Directive (CSRD), it is now equally expected, because roughly 73% of large global companies obtain external assurance on at least some sustainability disclosures, and an assurer cannot test a conclusion whose basis is undocumented. For the double-materiality matrix specifically, the basis-of-preparation answers three questions: how was materiality assessed (the method, the threshold, the inputs), what was concluded and why (the rationale per topic), and who is accountable for it (the governance and sign-off). The first two are the subject of the other lessons in this chapter. This lesson is about the third, because a method and a rationale with no accountable owner are an orphan, and an orphan disclosure fails assurance no matter how good the analysis underneath it.

CSRD survived the 2025 to 2026 Omnibus simplification and still binds the largest undertakings (more than 1,000 employees and more than EUR 450M turnover), where a materiality misjudgment is a board-level event. That scale is exactly why governance matters: the bigger the filer, the more the materiality call needs a clear line of human accountability, because "the AI clustered it and the working group sort of agreed" is not a basis a regulator or an assurer will accept. The cardinal rule of the whole program applies with full force here: disclosure accountability stays human, and "the model recommended it" is never a defence. AI can accelerate the materiality workflow at every stage, but the decision to call a topic material, the approval of the threshold, and the sign-off on the matrix are governance acts that a named person performs and owns. The governance structure is what converts a pile of good analysis into an owned, defensible conclusion.

Who Decides, Who Reviews, Who Signs

Defensible materiality governance separates three roles, and the separation is the point. The first is who decides: the people who make the materiality judgments, typically a materiality working group of sustainability, finance, and relevant function leads who score topics, apply the threshold, and form the conclusion. The second is who reviews: an independent check, often a more senior or cross-functional reviewer who tests the conclusion for completeness, consistency, and obvious gaps before it is finalised, the four-eyes principle that catches the error the preparer is too close to see. The third is who signs: the accountable officer, frequently the chief sustainability officer or a board-level owner, who formally approves the matrix and takes ownership of the conclusion on the record. These can be different people, and keeping them distinct is what gives the governance integrity, because a conclusion that is prepared, reviewed, and signed by the same person has no independent check, and an assurer reads that as a control weakness.

The reason to name these roles explicitly, in advance, is that an assurer will ask not just "who signed" but "who was supposed to sign, and did the right person." A materiality governance charter, even a short one, that states who sits on the working group, who reviews, who has sign-off authority, and what the threshold approval process is, turns these from improvised acts into a defined control. When the assurer asks "who decided this was material," you do not describe a fuzzy consensus; you point to the charter and the record showing the working group decided, the reviewer checked, and the named officer signed on a given date. The governance is strongest when it was designed before the assessment, not reconstructed after, because a control described after the fact invites the question of whether it really operated.

The distinction between a designed control and a reconstructed one is not a technicality; it is the heart of how assurance works. An assurer is testing whether a control existed and operated at the time the decisions were made, not whether you can produce a plausible description of one afterward. A charter written before the assessment, with dated artefacts created as the work proceeded, is direct evidence that the control was live: the threshold really was approved before scoring, the reviewer really did raise issues that changed the conclusion, the officer really did sign a specific version. A governance story assembled the week before the assurer visits, however accurate, cannot demonstrate that, because every artefact shares a suspicious recent date and none of them shows the control shaping decisions in real time. This is why mature reporting functions stand the governance up first, even in a hurry: the charter is cheap to write, and writing it before the assessment is what makes everything downstream provable. Governance is not paperwork you produce for the assurer; it is the structure that made the conclusion trustworthy in the first place, and the file simply records that it was there.

The numbers can be perfect and the conclusion still fail, because an assurer cannot give comfort on a judgment no named human stands behind. An unowned matrix is a draft that happened to get published.

Where AI Fits, and Where It Does Not

Governance is the part of the materiality workflow where AI's role shrinks to almost nothing, and that is by design. AI can prepare the materials the governance reviews: it can assemble the topic list, draft the rationales, summarise the evidence, and produce the matrix for the working group to consider. What AI cannot do is decide, review, or sign, because those are acts of human accountability, and the whole point of governance is to put a person on the record behind the call. A useful way to hold this: AI populates the file; humans own the file. The working group's decision is theirs, informed by AI-prepared materials but not delegated to the model. The reviewer's check is human judgment applied to whether the conclusion holds. The sign-off is a person putting their name to it. If any of these is quietly outsourced to the model, the governance is hollow, and the assurer's first probing question, "show me who decided," exposes the hollowness immediately.

The Audit Trail That Makes the Call Defensible

Governance that is not recorded is governance that did not happen, as far as an assurer is concerned, so the audit trail is the governance made visible. The audit trail for a materiality assessment captures, at minimum, the documented rationale per topic (why it was concluded material or not, against the threshold), the decisions and who made them, the review and its outcome, any override of an AI suggestion or a contested call with its reasoning, and the dated sign-off. Each of these is an answer to a question the assurer will ask, and the trail is strongest when it was captured as the work happened rather than assembled afterward, because a contemporaneous record is more credible than a reconstruction and far less likely to have gaps.

The rationale per topic deserves emphasis because it is the spine of the trail. For every material topic, the trail holds the documented reason it crossed the threshold, on impact, on finance, or on both, traced to the evidence and the threshold applied. For every topic assessed and excluded, the trail holds the documented reason it fell short, because an assurer tests not only what you included but what you left out, and an exclusion with no recorded rationale is exactly the kind of gap that becomes a finding. The override record matters for a parallel reason: wherever a human disagreed with an AI suggestion, raised a financial magnitude, rejected a cluster, escalated a buried input, the override and its reasoning are captured, because the override is often where the real judgment lives and the assurer most wants to see a human thinking, not a model deciding.

The final and non-negotiable element is the dated sign-off. The trail records who signed, in what role, on what date, approving what version of the matrix. This is what closes the loop from "good analysis" to "owned conclusion." Without it, every other element of the trail describes work that nobody formally stands behind. With it, the assurer can see the full chain: the topic was assessed against a threshold, the rationale was documented, a reviewer checked it, any contested call was reasoned and recorded, and a named officer with authority signed the conclusion on a date. That chain is the defensible materiality call. It is also what protects the individuals involved, because when the call is later questioned, the record shows it was made deliberately, by the right people, with reasons, rather than drifting into the report by consensus that nobody can quite reconstruct.

The sign-off must bind a specific version, and that detail matters more than it first appears. A materiality matrix is rarely frozen the moment it is approved; a topic gets added, a threshold note is clarified, a rationale is tightened. If the sign-off references only "the matrix" in the abstract, you cannot later prove which version the named officer actually stood behind, and a change slipped in after approval rides into the report carrying an authority it never received. So the sign-off names the dated version it approves, and any subsequent change triggers a fresh review and a fresh sign-off on the new version. This is the same versioning discipline that governs financial statements, applied to the materiality conclusion, and it closes a gap that ungoverned processes leave wide open: the published matrix is always a version someone signed, not a version that drifted past the last approval. When the assurer asks "is this the matrix that was signed," the answer is yes, with the version and date to prove it.

One further point ties this lesson back to the rest of the chapter. The governance trail is not a separate file living apart from the data and provenance work; it is the top layer of a single connected chain. The sign-off sits above the rationale per topic, which sits above the scoring packets, which sit above the registered inputs and the stakeholder log. An assurer who starts at the signature can walk all the way down to a raw stakeholder input, and an assurer who starts at a raw input can walk all the way up to the person who signed. That vertical connection is what makes the whole materiality assessment defensible as one artefact rather than four loosely related ones. Governance without the data trail beneath it is an empty signature; a data trail without governance above it is unowned analysis. Joined, they are a materiality conclusion that is both evidenced and accountable, which is exactly what an assurance engagement is built to test.

A Worked Example: Two Matrices, One Assurer

The company is the mid-cap manufacturer from the rest of this chapter. The assurer is conducting a limited-assurance engagement and turns to the materiality assessment.

The ungoverned matrix. The analysis is genuinely good: the data is traced, the stakeholders accounted for, both lenses defended. But the governance is informal. The matrix was built in a shared file, edited by several people, and "agreed" in a meeting with no minutes. The assurer asks who approved the threshold; the team remembers discussing it but has no record of an approval. She asks who reviewed the conclusion independently; the same people who prepared it also finalised it, so there was no four-eyes check. She asks who signed; the matrix went into the report without a recorded sign-off. The assurer's conclusion is uncomfortable: the underlying work may be sound, but the materiality assessment lacks the governance and documentation to support the disclosure, and that is a control finding on the foundation of the entire sustainability statement. Good analysis, undone by no ownership.

The governed matrix. Before the assessment began, a short materiality governance charter named the working group, the independent reviewer, and the chief sustainability officer as the sign-off authority, and set the threshold approval process. The assurer asks who approved the threshold; the record shows it was set and approved by the working group on 20 January, before scoring. She asks who reviewed; the record shows the independent reviewer checked the conclusion on 18 February, raised two topics for reconsideration, and one was added as a result, with the reasoning noted. She asks about a contested call; the record shows the AI clustered community water into a general theme, the analyst overrode it and escalated it as material, and the reasoning is captured. She asks who signed; the record shows the chief sustainability officer signed the final matrix on 21 February. The assurer reconstructs the entire governance in minutes: decided here, reviewed here, contested call reasoned here, signed here. The materiality assessment holds, not only because the analysis was good but because a named human owns it and the trail proves the control operated.

The two matrices may carry identical dots in identical positions. What separates them is entirely the governance and the trail. The ungoverned one is a conclusion nobody owns, and an assurer cannot give comfort on it. The governed one is a conclusion a named officer stands behind, reviewed independently, with every contested call reasoned and recorded. In disclosure, that difference is not a formality. It is the difference between a materiality assessment that supports the report and one that becomes the report's biggest weakness.

Building Defensible Materiality Governance

A few rules make a materiality call defensible. Write a short governance charter before the assessment, naming who decides (the working group), who reviews (an independent check), and who signs (the accountable officer), and defining the threshold approval process, so the controls are designed, not improvised. Keep the three roles distinct, because a conclusion prepared, reviewed, and signed by the same person has no independent check and reads as a control weakness. Let AI populate the file but never decide, review, or sign, because accountability is human and "the model recommended it" is no defence. Document the rationale per topic for every topic included and every topic excluded, because the assurer tests both, and an unexplained exclusion is a finding. Capture every override of an AI suggestion or contested call with its reasoning, because that is where your real judgment shows. And record a dated sign-off by the named authority approving a specific version of the matrix, because that is what turns good analysis into an owned conclusion. Capture all of this as the work happens, not afterward, because a contemporaneous trail is credible and a reconstructed one invites doubt.

Do that, and the assurer's governance questions stop being a threat. "Who decided this was material" is answered by the charter and the working-group record. "Who reviewed it" is answered by the independent check and its outcome. "Who signed" is answered by the dated sign-off. "Why this topic and not that one" is answered by the rationale per topic, included and excluded. The analysis underneath was accelerated by AI; the governance on top was owned by humans; the trail proves both. That is the basis-of-preparation that makes the most consequential judgment in your report defensible, not because the picture is pretty, but because a named person stands behind it and the record shows exactly how they got there.

Key Takeaways

• The basis-of-preparation for the matrix answers three questions: how materiality was assessed, what was concluded and why, and who is accountable; this lesson is about the third, because good analysis with no accountable owner is an orphan that fails assurance.
• Defensible governance separates three roles: who decides (the materiality working group), who reviews (an independent four-eyes check), and who signs (the accountable officer), and keeping them distinct is what gives the governance integrity.
• Name the roles in advance in a short governance charter, because an assurer asks not only who signed but who was supposed to, and a control designed before the assessment is far more credible than one reconstructed after.
• AI populates the file but humans own it: AI can assemble topics, draft rationales, and produce the matrix, but it cannot decide, review, or sign, because "the model recommended it" is never a defence.
• The audit trail captures the documented rationale per topic (included and excluded), the decisions and who made them, the independent review and its outcome, every override with its reasoning, and the dated sign-off.
• Document the rationale for excluded topics too, because the assurer tests what you left out as well as what you included, and an exclusion with no recorded reason is exactly the kind of gap that becomes a finding.
• The dated sign-off by a named authority is the non-negotiable element that turns good analysis into an owned conclusion, and it protects the individuals by showing the call was made deliberately, by the right people, with reasons.
• Capture the trail as the work happens, not afterward, because a contemporaneous record is credible and a reconstruction invites the question of whether the control really operated.