The promise of proof

Sustainability standards are designed to reassure. They translate environmental and social ambition into measurable criteria. They produce certificates, benchmarks and case studies.

An article by ISEAL, How are sustainability standards driving real world change?, assembles evidence in their favour. It cites modest income increases for small producers within certification schemes. It points to export gains in lower-income countries. It highlights improved carbon management among certified cocoa farmers in Ghana and biodiversity gains under forest certification systems.

The conclusion is measured. Standards are not sufficient alone, but they should be strengthened.

Pooran sees the problem differently. For him, the core issue is not weak standards. It is the belief that standards can deliver transformation.

A systems founder shaped by science

Pooran is the founder of OnePlanet.com, a digital platform built to help governments and organisations map the interconnected effects of their decisions.

His career spans neuroscience, sustainable forestry, real estate development and the creation of the One Planet Living framework, which informed early proposals for the UN Sustainable Development Goals.

Pooran describes sustainability as grounded in a basic recognition: “everything is interconnected.” Silos, he argues, exist in organisations and in minds. “Those silos do not exist out there.”

Most institutions manage sustainability through conventional databases structured in rows and columns. OnePlanet.com instead uses graph database architecture, organising information by relationships rather than categories. Policies are broken into “outcomes, actions, indicators,” then linked across departments and sectors. Overlaps, conflicts and shared goals become visible.

The premise is operational rather than rhetorical. If sustainability is about interdependence, the underlying data structure must reflect it.

The certification encounter

Pooran’s scepticism toward standards is rooted in experience.

In the 1990s, he co-founded sustainable forestry enterprises in the UK. The model reintroduced traditional coppice woodland management, regenerating habitats while replacing unsustainable imports. The business developed a distributed production network, supplying local retailers.

When major customers required Forest Stewardship Council certification, the company complied. The process, he says, was “an absolute nightmare.”

Certification increased bureaucracy and cost. More critically, it displaced tacit knowledge. Graduate auditors assessed third- and fourth-generation woodland workers who “lived it, they breathed it, they smelt it.”

Of the auditors, Pooran says: “You’ve got nowhere near their knowledge and understanding.”

Authority shifted from practitioner to certifier. Box-ticking became proof of sustainability.

For Pooran, this inversion exposed a structural risk. Compliance frameworks can narrow attention to what is measured. What falls outside the checklist is discounted.

Evidence and its blind spots

The ISEAL article relies on evidence of measurable gains. Pooran does not dismiss those gains. He questions the framing.

“Evidence is only what you look for,” he says.

Evidence, by definition, reflects past measurement. It captures selected variables. In agriculture, yield increased under intensive methods. Soil degradation, biodiversity loss and nutrient decline were not initially part of the evidence base. They appeared later as “side effects.”

For Pooran, they are not side effects. They are effects that were excluded from focus.

He argues for policy that is “evidence informed” rather than evidence led. Evidence can guide. It cannot define the future. Driving forward by metrics alone risks managing spreadsheets rather than reality.

Standards as floor, not frontier

Pooran does not call for the abolition of standards. He assigns them a narrow role.

“Regs for the dregs,” he says, summarising his position with deliberate bluntness.

Standards should prevent the worst practices. They should set a minimum floor. They should not be treated as markers of leadership or innovation.

The danger arises when certification is equated with excellence. Once a badge signals responsibility, incentives shift toward maintaining compliance rather than pursuing structural change.

In his words, it becomes “a promotion of those people who have ticked those boxes as leaders.”

He extends this concern to ESG and corporate certification schemes more broadly. When legitimacy depends on meeting predefined metrics, the conversation narrows. Authenticity gives way to optimisation.

The question of corporate purpose

At root, Pooran sees the problem as one of governance rather than disclosure.

He traces a shift from nineteenth-century public benefit incorporation toward twentieth-century shareholder primacy. The latter, in his view, distorts incentives. Standards then attempt to correct outcomes without addressing underlying purpose.

If he could alter one feature of the commercial system, it would be this hierarchy of obligation.

Corporate primacy, he argues, should rest with “human and planetary health,” not solely shareholder return.

Standards might still exist in that world. But they would operate as guardrails, not proof of virtue.

Control and complexity

Sustainability standards offer clarity in a complex system. They translate ambition into rules and outcomes into metrics. They create comparability.

Pooran questions whether that clarity is illusory.

If sustainability requires an understanding of interconnectedness, then narrow certification may simplify what cannot be simplified. Systems resist reduction. Interdependence does not fit neatly into a checklist.

The tension remains unresolved. Markets seek certainty. Ecologies operate in relationships.

Standards can measure performance. They cannot, on their own, change the logic of the system being measured.

Confidence in the Face of Weekly Attacks

Cyber attacks are no longer exceptional events. They are operational realities. Ransomware halts systems. Data breaches expose customers. Supply chains stall.

Yet most boards remain confident.

Joseph Hubback, Advisory Partner and CISO at Elixirr, reviewed research across roughly 1,000 companies. Ninety-four percent of boards said they felt comfortable with their security posture.

The statistic sits uneasily alongside the frequency of disruption.

“When the attack happens, the CISO will do all they can,” Joseph says, “but it’s the CEO and the executives that will be in the limelight.”

Cyber security, in that moment, becomes executive.

The issue is not whether frameworks exist. It is whether leadership understands what is truly at risk.

From Industrial Engineering to Cyber Governance

Joseph did not begin in cyber.

He started as an engineer, building chemical factories at ICI Plc. He later moved into commercial and strategic roles before becoming a partner at McKinsey & Company.

Security entered his career through client work in the late 2000s. It remained.

Today, at Elixirr, he advises clients globally while also serving internally as CISO. The combination keeps him close to both governance questions and operational exposure.

The Conversation Has Not Moved On

Executives often repeat that cyber security is no longer just a technical issue. It is a people issue. A leadership issue.

Joseph questions the novelty of that claim.

“Fifteen years ago we were talking about it as a people issue as much as anything else.”

In his view, the language has evolved without changing behaviour. Compliance frameworks have expanded. Certifications are widely pursued. Audit outcomes provide reassurance.

But attackers do not target frameworks. They target value.

The repetition of the insight has not produced structural change.

From Compliance to Asset Protection

Joseph believes education efforts are often misdirected.

Organisations train employees to recognise phishing emails and suspicious links. Attack techniques evolve constantly. The training ages quickly.

He proposes a simpler foundation: define the assets.

In the physical world, people instinctively protect wallets and keys. In the digital world, identity, data, intellectual property and operational systems carry equivalent weight. Yet many leadership teams have not clearly defined what must be protected first.

“If you explain to people what it is that is now important for them to protect,” Joseph says, behaviour changes.

At board level, this means identifying the value streams that generate revenue. Which digital systems enable trading. Which processes, if interrupted, would damage trust or liquidity.

In one client example, business leaders and security teams mapped these value streams together. The dynamic shifted. Security ceased to be viewed as “the department that says no” and became aligned with protecting continuity.

The conversation moved from standards to survival.

Comfort and Exposure

The 94 percent confidence figure remains central.

Boards often equate completed controls with resilience. Certifications and dashboards provide comfort.

Yet when an attack occurs, decisions escalate immediately.

Do we shut systems down.
Who do we inform first.
How do we communicate with customers.
How do we coordinate employees across regions.

“It becomes a collective exercise,” Joseph says. “When an attack happens, you’ll all be involved.”

The exposure is visible. Accountability shifts to the executive team.

Confidence, in that moment, is tested.

From Collaboration to Commitment

Collaboration is frequently cited as the solution.

Industry forums convene. Information is shared. Best practice circulates.

Joseph supports information exchange. He questions whether it goes far enough.

He points to the response following the NotPetya attack on DLA Piper. Clients and competitors provided practical support. Capacity was shared. Documentation was restored. Recovery depended on those relationships.

That cooperation was operational.

Joseph argues that organisations should define such arrangements in advance. Who provides temporary infrastructure. Who safeguards data copies. How supply chains will respond if one party is incapacitated.

Without defined commitments, resilience relies on goodwill.

The distinction is subtle but material. Discussion is not the same as agreement.

Urgency After the Breach

Joseph has observed a pattern.

Following a significant attack, executive attention intensifies. Investment rises. Governance improves. The urgency lasts three to four years.

Then it fades.

Digital transformation, however, continues to expand exposure. Cloud infrastructure grows. Systems integrate further. Ecosystems interconnect.

Risk compounds faster than memory.

Cyber security, Joseph argues, is not primarily a technology problem. It is a governance question.

“When the attack happens,” he says, “it’s the CEO and the executives that will be in the limelight.”

Preparation is quiet. The breach is public.

The distance between those two moments is leadership.