ESG tracking software, for an asset manager, follows every holding's environmental, social and governance incidents and the decisions taken on them, fund by fund, over time. Most firms already pay for part of this: one or more vendor controversy feeds that grade companies and flag norms breaches. Replacing those feeds is rarely the point. The point is the work they leave: reading the first source, often local, merging duplicate reports, testing each event against each fund's own clause, and changing the restriction list under control. Botminds' ESG Risk Monitoring is an agentic solution that does that work beside the feeds you keep, and compares their categories with its own scores without copying either into the other.
The design question for IT and the ESG data lead is therefore one of plumbing and permissions: which systems feed the tool, which ones it may write to, and who approves each write. The flow below answers it.
ESG tracking software beside vendor feeds: what comes in, who acts, what goes out
Agent
Watcher agentReads news, NGO, court and regulator sources and filings in the issuer’s language; matches each to issuers and subsidiaries through ISIN, CUSIP and LEI in the security master
Never: Keeps licensed news beyond an excerpt and a link
Agent
Merge, Severity and Second Opinion agentsFold reports into one incident; score it twice, the second blind; set the vendor’s category beside the result
Never: Copy a vendor category into the score
Agent
Mapping agentReads positions from portfolio accounting and each fund’s coded clause; gives the step and the deadline per fund
Never: Changes a fund’s policy
A person decides
ESG analyst and committeeDecide watchlist and engagement; approve letters; two votes for any divestment
A person decides
Investment complianceCodes the restriction in the order management system within one business day of approval
Agent
Evidence agentKeeps the file, drafts PAI 10 and 11 data and committee papers, verifies the audit chain daily
Never: Signs a report: a person signs every one
What is ESG tracking software?
It is the system of record for ESG events in a portfolio: which incidents touched which holdings, how severe each was, what each fund's policy required, what was decided, by whom, and what happened next. Search engines group it with ESG management and reporting software, but those serve companies measuring their own footprint. For a fund manager, tracking is about other companies' conduct and the fund's promises about it.
Good tracking software answers three questions at any moment: which screened funds hold a flagged issuer, which of those have a decision due and when, and whether any decision was missed. In the solution's sample firm, Quillfield Capital, the answer the morning this page follows was 64 screened funds, 0 breaches and two decision windows closing in the next ten business days. Quillfield and its funds are fictional sample data.
What do vendor controversy feeds do well, and what do they leave?
Vendor feeds do breadth and consistency well. They cover thousands of issuers with one methodology, keep long histories, and give a portfolio team a common vocabulary. What they cannot do is know your funds. A feed reports that a company is in a severe controversy; it does not know that one of your funds must put it on a watchlist within five business days while another must engage bondholders, or that a third holds it through a finance subsidiary's notes.
They also cannot be checked on trust. In the SEC's case against WisdomTree, a second vendor's data had limitations that left fossil-fuel companies in funds that excluded them, and the order notes that "Information concerning the Vendor B data (including the limitations of that data) was publicly available on Vendor B’s website" (SEC Release IA-6753, 2024). The limits of a feed are the buyer's to read. The EU's ESG ratings regulation, applying from 2 July 2026, regulates graded ratings but leaves "data on ESG controversies" outside its scope (Regulation (EU) 2024/3005, recital 25), so a raw incident feed comes with no regulatory quality standard.
What the feed gives you, and what the tracking layer adds
A vendor controversy feed: The vendor’s researched sources, often weighted to English-language media
Tracking software beside it: Court registries, regulators, NGO sites and filings in the issuer’s language, plus licensed news
A vendor controversy feed: Updated on the vendor’s schedule
Tracking software beside it: Read as published; in the sample, a ruling read 11 minutes after it appeared
A vendor controversy feed: A company and its category
Tracking software beside it: One incident per event, merged across reports and languages
A vendor controversy feed: The vendor’s
Tracking software beside it: Your firm’s, scored twice, with the vendor’s category shown beside it
A vendor controversy feed: None: the same signal for every client
Tracking software beside it: Each fund’s coded clause, with the step and the deadline
A vendor controversy feed: Outside the feed, in email and spreadsheets
Tracking software beside it: Reason codes, approvals and evidence on a read-only audit trail
Build, extend or add: three ways to close the gap
There are three ways to add a tracking layer, and each fails in a predictable place. The first is to extend what you have: buy a second vendor feed, or the vendor's premium alerting. That widens coverage and keeps one methodology, but every feed still knows nothing about your funds' clauses, and two feeds that disagree add a reconciliation job.
The second is to build: a news API, machine translation, a keyword list per issuer and a spreadsheet of fund rules. Teams that build usually get the reading working and stall on matching. Court judgments name local operating companies, not listed parents; news names brands, not legal entities; and a keyword list that catches the parent's name misses the subsidiary that the court actually ruled against. The rules spreadsheet then drifts from the prospectus it was copied from, and nobody can say which version applied on which day.
The third is an agentic layer that reads, matches, merges, scores and maps, with people deciding. Its failure mode is different: it is only as good as the fund rules it is given and the controls around what it may change. That is why the go-live work below is mostly about coding each fund's clauses and fixing the permissions, and why the first month should be run beside the vendor feed rather than instead of it.
Which systems does ESG tracking software connect to?
Six, in the design of ESG Risk Monitoring, and only one of them is written to. Each connection has a direction, and each write has an owner. Getting those right before go-live matters more than any feature.
Six connections, and which way each one runs
| System | What flows | Direction | Who owns the write |
|---|---|---|---|
| News, NGO, court and regulator sources | Licensed news and wires, 1,480 NGO sites, 212 court registries in 46 jurisdictions, 138 regulators, 61 exchanges | In | — |
| Portfolio accounting and the fund administrator | Positions for every fund three times a day; holdings and NAV reconciled daily; custodian positions and securities on loan | In | — |
| Security master | Issuers, subsidiaries and local names by ISIN, CUSIP and LEI | In | — |
| Fund documents | Prospectus wording, SFDR annexes and client agreements, coded as rules | In | Compliance approves each coded rule |
| ESG data vendors and the engagement log | Vendor categories, flags and norms status; letters, meetings and milestones from the CRM | In | — |
| Order management system | Restrictions and pre-trade rules | Two-way | Compliance codes; agents never do |
What ESG Risk Monitoring read in 24 hours, and from where
Where a tracking layer's documents come from: one sample day
The restriction list: written only on compliance's approval
The one system the tracking layer touches in both directions is the order management system, and that is where control must be tightest. In ESG Risk Monitoring the agents can read restrictions and propose them; they cannot code one. A divestment needs two committee votes, never the proposer's; compliance then codes the restriction within one business day, a locked rule; portfolio managers sell. In the sample, a palm-oil grower at severity 5 since March 2025 is one vote from that step, with a restriction and a sale to zero across four funds waiting on it.
Read access matters too. A tracking layer that cannot see the restriction list cannot tell an analyst that an issuer is already restricted in one fund and only watchlisted in another, or catch a fund that holds an issuer the committee decided to sell.
The write-back waits for two votes, then compliance
What you bring to go live
The tool is only as precise as the rules and data it is given. Most of the go-live effort is not technical integration but writing down, in a form a system can apply, what each fund promised. Each screen is coded from the fund's own documents and approved by compliance before the mapping means anything.
Eight things to bring to an ESG tracking software go-live
- Every screened fund’s documents
Prospectus wording, SFDR annexes, client agreements and side letters that mention controversies, norms or exclusions.
- Your severity scale
Levels, factors and the evidence standard for the top grade; if there is none, write one first.
- Your escalation policy
Who decides at each grade, the clock for each step, who approves, how many votes a divestment needs.
- A positions feed and the security master
With issuer hierarchies, so a finance subsidiary’s notes map to the parent.
- Your vendor feeds
Kept, for comparison; the first month measures where each layer is ahead.
- The engagement log
So an incident in a company already under engagement updates that engagement, not a new one.
- Read access to restrictions
And the agreed path by which compliance codes new ones.
- A recent month of incidents
The ones your team handled, with their dates and decisions, to back-test against.
How to run the first month beside the vendor feed
Run both layers on the same holdings for a month and count. For each incident of severity 3 or more, note when the vendor flagged it, when the tracking layer did, and whether either missed it. Note how many vendor alerts were duplicates of one event. Note the incidents where the two disagreed on severity, and who was right on the evidence. Then compare the time from first publication to decision, by fund.
In the solution's sample month, the agents flagged 9 incidents of severity 3 or more before the data vendors, on average 11.4 days earlier, and missed none the vendors flagged. On the morning traced here, the vendor still showed a miner found liable by a court the previous evening at its earlier category, last updated twelve days before. Those are sample figures, not a guarantee; the month on your own holdings is the measurement that counts.
What will your IT and risk teams ask?
They will ask where data goes, what is kept, and how a change is controlled. In ESG Risk Monitoring's design, data stays in its region; licensed news is kept as an excerpt and a link; agents and prompts are versioned and evaluated against past incidents labelled by the committee before release; every human override is recorded with its reason code; and the audit trail is hash-chained, read-only and verified daily. Changes to thresholds are saved as a new version that compliance approves.
Retention follows the strictest rule in scope. Advisers must keep required books and records for not less than five years (17 CFR 275.204-2); the sample configuration keeps decisions seven years and evidence files ten. EU managers, who must keep enough people and know-how to integrate sustainability risks (Delegated Regulation (EU) 2021/1255), will want the same file to show who held that expertise on each decision.
Every fund's screen in one place: the ESG Risk Monitoring funds view
What the tracking layer produces for SFDR
Because it holds every decision with its date, the tracking layer can draft the data behind principal adverse impact indicators 10 and 11, quarter by quarter, with each figure tied to holdings and determinations. That matters because supervisors have found managers filling gaps with zeros: for indicators 10 and 11 among others, managers commonly entered zero for any company they had no data on (ESAs report on PAI disclosures, September 2025). In ESG Risk Monitoring the Evidence agent drafts the data, an analyst reviews it and compliance signs it; the full path from one incident to the statement is in PAI 10 under SFDR. The technical standards also require managers to describe the "best efforts" made where data is missing (Delegated Regulation (EU) 2022/1288, Article 7(2)), which a dated decision trail documents.
How the minutes of one incident run through these connections is traced in a court ruling in 49 minutes; the full set of agents is on the ESG Risk Monitoring page.
Questions people ask
Can ESG tracking software replace our ESG data vendor?
It can reduce reliance on one, but replacing it is rarely wise. Vendor feeds give breadth, history and a common methodology; a tracking layer adds first sources, your scale and your funds' rules. Running both and comparing them shows where each is ahead.
How does ESG tracking software connect to the order management system?
It should read restrictions and pre-trade rules and propose changes, but only compliance should code one. In ESG Risk Monitoring's design that is a locked rule: after two committee votes on a divestment, compliance codes the restriction within one business day, and the agents never do.
What is ESG controversy data?
Records of incidents involving companies, such as pollution, labour abuses or corruption, usually with a severity grade and a link to the norm involved. Under the EU's ESG ratings regulation, applying from 2 July 2026, raw data on ESG controversies is outside scope, while graded ratings built on a methodology are inside.
How long does it take to set up ESG tracking software?
The integration is usually the quicker part; coding each fund's screen from its documents and getting compliance to approve it takes longer. A sensible go-live runs a recent month of your own holdings and incidents beside the vendor feed and compares the two before anyone relies on the new layer.
What ESG data feeds does an asset manager need for controversy monitoring?
A positions feed, a security master with issuer hierarchies, each fund's coded rules, an engagement log, and the sources themselves: news, NGO sites, court registries, regulators and filings, in the issuers' languages. Vendor controversy feeds are a useful comparison layer on top.