Deciding on the right environmental, social and governance approach for your company isn’t easy. Investors expect directors and executive teams at publicly traded companies to understand environmental and social risks and opportunities, according to Martyn Chapman, head of strategy for Nasdaq governance solutions, in a recent video.

Becoming an expert is a challenge and every organization’s answer to ESG risk is going to be different, according to the consulting firm Protiviti. But the maturity levels of ESG development are somewhat uniform. More mature companies make ESG a responsibility of the executive team and see those efforts as an opportunity and competitive advantage, not a defensive play, the firm said. Less mature companies will manage crises as they arise and view ESG as a cost, not an opportunity.

Corporate leaders also tie compensation to ESG performance. Aluminum manufacturer Alcoa Corp., for example, ties 30% of its executive incentive compensation to non-financial measures such as environmental protection and safety, according to its 2019 proxy statement.

Microsoft Corp. is one of a handful of companies on the Nasdaq that uses the United Nations’ Sustainable Development Goals (SDGs). The SDGs are an ambitious set of 17 goals aimed at alleviating many of the world’s most pressing problems, including environmental destruction, climate change and gender inequality.

But how does a company like Microsoft oversee such efforts? Steve Lippman, ESG engagement director at Microsoft, said ESG reporting is housed in the company’s legal department, according to a June 2018 Corporate Secretary article. That makes ESG the responsibility of the team charged with looking at all the global risks for the company as well as emerging issues. Lippman also is in charge of communicating with shareholders on the company’s ESG efforts as part of the company’s investor relations function. This may take the form of getting on 50 calls over a summer, in advance of the company’s annual meeting in the fall, to talk about ESG issues with institutional investors.

Aside from proactive communication, Microsoft also sees ESG as an opportunity. For instance, the company must comply with the European Union’s General Data Protection Regulation (GDPR) or face fines of up to 4% of revenues. But it also sells cloud services to other companies who face GDPR risk.

“Suddenly if you’re a mid-sized U.S. company with employees or customers in Europe and are subject to the GDPR, do you want to take on that risk in-house and rely on your own IT department? Or do you want to trust Microsoft cloud services where we’ve put in contractual guarantees that will ensure GDPR compliance for you?” Lippman said in the article.

Clearly, Microsoft’s answer is that it can be a leader in ESG issues, and also sell its expertise to others.