Internal Audit’s Role in Supporting Sustainability Reporting

ESG is a global trend and not just a US-European initiative, as evidenced by the State of Play in Sustainability Assurance/ Benchmarking Global Practice survey [8]: 79% of the largest companies in China (excluding Hong Kong) publish ESG reporting, of which 54% are reporting based on GRI (Global Reporting Initiative) standards [9], 100% (62%) in Hong Kong, 98% (47%) in India, 72% (72%) in Turkey [10]. Thus, the disclosure of ESG in these countries is based on the same international standards that are common in the world, and in some cases additionally takes into account the specifics of the country.

In addition, despite the standards and initiatives in the non-financial disclosure part, their use is not mandatory in a number of countries. The reliability of information submitted in the direction of sustainable development is important. Confirmation of the accuracy of reporting by an external audit is not a mandatory regulatory requirement and often depends on the choice of companies. All these factors lead to the phenomenon of “greenwashing”, which poses serious risks to all groups of stakeholders.

In order to reduce the risk of the impact of unreliable nonfinancial reporting on the decisions of investors, shareholders, and financial institutions, regulatory bodies began to move closer to existing ESG standards and tighten the requirements for submitting non-financial reporting [1].

Taking into account the European Commission directive in Georgia, the ESRS prepared by EFRAG based on the PTF-NFRS recommendations, published in March 2023 as the last working paper of the PTF-ESRS cluster, will be used as a basis for sustainability reporting, while in July 2023, the European Commission issued the directive on the mandatory use of ESRS, the implementation of which began in four phases from 2024 through 2028.

Regulators pay special attention to the reliability of ESG reporting, which leads to an increase in the role of internal audit in creating guarantees of objectivity, accuracy and compliance with ESG reporting of large companies. ESG reporting is the final stage in the implementation of the company's ESG program, which is integrated into the overall corporate governance scheme with a built-in control system. That is why the internal audit, which, in comparison with external audit, has a deeper knowledge of the company's business processes, can verify the reliability of the information at the stage of its submission, which allows timely identification of expected risks and informing management, as well as assist in external audit when checking/verifying ESG reports.

4.1 Function of internal audit in ESG: Current situation

The conducted researches show that the consideration of ESG issues by internal audit is insignificant during the audit.

North American Pulse of Internal Audit study conducted by the International Institute of Internal Auditors (IIA) in 2021 [11], issues related to ESG and sustainability accounted for about 1% of internal audit plans. According to the report by the IIA and the Auditing Firm EY [12], 35% of respondents noted that internal audits in their companies are not related to ESG issues at all.

Despite the above, the situation still changes dynamically. In May 2021, IIA released the Role of Internal Audit in ESG Reporting [13], stating that Effective ESG governance, like effective corporate governance in general, requires mutual agreement between key stakeholders as described in the Three Line Model. In case of any risk, the internal audit should have all kinds of resources to support governance and management by providing objective opinions and advice on ESG-related issues.

According to the above document, the minimum functions of the internal audit in terms of providing authentic assurance should include:

1. Analysis of reporting indicators/indicators in terms of relevance, accuracy, timeliness and consistency;
2. Consideration of applications on compliance with official requirements for disclosure of financial information;
3. Measurement of the materiality or risks of ESG reporting;
4. Inclusion of ESG in regular audit plans.

In terms of advices / recommendations

1. Creation of ESG control environment;
2. Recommendation on reporting indicators/performance;
3. Consulting on corporate ESG governance

It should be noted that the quality of participation of the internal audit in auditing the ESG reporting is affected by such important factors as: a comprehensive system of internal control and risk management, the content and volume of internal audit services provided to the board of directors and executive bodies in accordance with the corporate governance practices of a particular company [14].

However, it is also clear that the current situation requires internal auditing to go beyond the narrow audit tasks defined by it for annual non-financial reporting and to include/take into account these tasks more broadly in the sustainability programs implemented by companies.

The professional competencies of the internal auditor, including knowledge of modern standards for the organization of internal control and risk management systems, corporate governance standards, preparation of financial and non-financial reporting, together with understanding the specifics of the company's activities, give the internal (and not external) audit the right to become the main provider of assurances and perform the role of a business advisor in introducing certain ESG practice in the company [15].

The implementation of such a task is related to the selection of priority directions for research and the implementation of specific action programs.

4.2 Possible areas of activity/directions of the internal audit on ESG issues

At the initial stage of internal audit, procedures can be used to check the effectiveness of the existing control of the company's ESG model using standard criteria and compliance audit tools: checking the presence of ESG goals and development strategies, assessing the dynamics of goal achievement by quantitative indicators, the degree of integration of goals into management decisions, etc.

Meanwhile, the internal auditor's actions can be extended to new areas and aspects such as:

1. Thematic audit of individual aspects of ESG (E – environmental, S – social, G – governance);
2. Analysis of the effectiveness of operational activities in achieving the objectives of ESG
3. Measurement of the company's completeness (including benchmarking), including levels of risk management and integration into corporate governance systems;
4. Initiating and supporting situational studies on ESG topics (primarily climate risks and opportunities);

In order to improve the strategy and tactics of ESG programs, internal auditors should demonstrate readiness to support their company's ESG and facilitate cross-functional research. Depending on the specifics of the company, the internal audit may also include other roles that, by unconditional compliance with its independence and objectivity, can strengthen the ESG processes for the company.

4.3 Problems of internal audit of the ESG system

When conducting an internal audit of an ESG system, an internal auditor may encounter a number of problems, and the choice of solution depends on many factors. These factors must be taken into account by the internal auditor at all stages of his activity.

4.3.1 Lack of uniform standard for disclosure of non-financial information

According to the report of State of Play in Sustainability Assurance/Benchmarking Global Practice, 69% of organizations in the world use standards created by the Global Reporting Initiative (GRI) and 62% – concepts that reflect the UN Sustainable Development Goals (SDG) 24% and 15% use also the Recommendations of the Task Force on Climate Related Financial Disclosures, TCFD) and the S1 and S2 Standards of sustainability reporting, prepared by Sustainability Accounting Standards Board (SASB). As we have already mentioned above the International Accounting Standards Board (IASB) has developed for the company in the context of its activities IFRS S1 General Requirements for Disclosure of Sustainability-related Financial Information [16] and IFRS S2 Climate-related Disclosures [17]. Therefore, it is expected that sustainability reporting will be equivalent to financial reporting and, therefore, companies that make definitions according to IFRS must carry out appropriate processes and controls to ensure that sustainability information is provided at the same level, quality and period of time as it is done on financial information [18]. However, despite the above, a unified approach has not yet been formed regarding what kind of mandatory non-financial information and in what form should be presented in the Sustainable Development Reporting.

4.3.2 Voluntary nature of non-financial disclosure

Until 2024, the disclosure of non-financial information under current ESG standards was voluntary, and from 01 January 2024, it began to be implemented in four phases until January 2028.

4.3.3 Lack of necessary knowledge and experience when conducting the audit of ESG system

The International Internal Audit Standard “2030 – Resource Management” requires that “The chief audit executive must ensure that internal audit resources are appropriate, sufficient, and effectively deployed to achieve the approved plan”.

Therefore, before conducting an ESG audit, the internal auditor must assess his own qualifications and available resources to conduct such an audit. If the necessary competencies are not available, third-party resources can be used to conduct an audit of the ESG system, including hiring the ESG specialists for consultation.

An urgent task for internal audit specialists is to acquire specialized competencies on the most pressing ESG issues for a particular company, which are provided by various educational institutes and business schools.

In order to carry out the IT control testing or reporting check /verification tasks, the internal auditor can involve certain specialists from his own organization as part of cross-functional programs.

4.3.4 Difficulties with obtaining data necessary for auditing, non-standardized data

The information required for ESG audits may be prepared by different departments in the company, which may not be functionally related to each other, so the information prepared by them is not supplied to the centralized data system and may contain information prepared by various sources, including data from the company's accounting systems, management reporting, spreadsheets and presentation materials. Moreover, when collecting data, the reliability of the information provided must be taken into account. Internal audits must be involved in testing the collection of non-financial information to ensure their proper functioning.

4.3.5 Low level/degree of regulation of implemented ESG processes

In some cases, companies that claim/pursue different ESG goals have not developed clear plans for their achievement and monitoring systems for intermediate stages, which can make it difficult to measure the current status of the implementation of these goals and the degree of their integration into the operational and strategic plans of companies.

Additional problems arise in the case when some ESG issues go beyond the boundaries of the organization. Shareholders’ 'expectation is to receive information about contractors’ social responsibility requirements (e.g., absence of schemes for hiring/involvement of personnel, non-use of adolescent labor).

4.3.6 In supelative level of coordination between structural units of the company to achieve ESG goals

As a rule, in large companies, several units/departments/structural subdivisions are involved in achieving ESG goals. The absence of an established system of internal communications is the reason for the lack of a unified view of general processes in the field of ESG, which most often leads to distortion of ESG communities. As mentioned above, the result of misinterpretation and perception is the phenomenon of “Greenwashing”. One of the ways out of this is to train employees about the company's sustainability strategy, climate, risks and opportunities, and the impact of their results on the company.

4.4 Practical steps when conducting internal ESG audits

Regardless of the level and specifics of the development of the company's activities, the initial stage of the activity of an internal auditor in the ESG sphere can be an assessment of the level of development (maturity) of the internal control system of the ESG management sphere [19].

A step forward in this direction will be the development of a methodology/algorithm, which includes the following steps:

1. Preliminary study of internal control state for each ESG aspect. Depending on the specifics of the company's activities, the weight and contribution of each of these 3 aspects to the ESG system may differ both due to objective reasons and due to insufficient attention on the part of the organization to these aspects.

2. Development of a system of indicators that objectively reflect the state of the internal control system for each aspect of the ESG.

3. Development of a rating scale for each indicator and the formation of the basis for an audit report on the level of internal control in the field of the company's ESG system.

The result of such activities can be ESG Controls Maturity Assessment Matrix, the approach to the formation of which is presented below.

As an example, the elements that can be measured according to each ESG aspect are given. The company can also develop elements for its own purposes. The example uses a 1 to 3 points system for each indicator based on an expert assessment from an internal audit, with justification for each rating (Tables 1-4).

Table 1. The example shows the weight of individual aspects of ESG, which is determined by the degree of their importance to the company

Table 2. Example of assessment of the control system

Table 3. An example of a control matrix considering three aspects of ESG

The shortcomings identified during the assessment are recorded by the internal auditor and indicated improvement of the control system.

The results can be used as part of an internal audit report on the effectiveness of the company's internal controls, risk management and corporate governance systems.

The above algorithm uses a risk-based approach, where control is measured in areas of sustainable development associated with significant risks (for example, according to the company's risk map).

For evaluation purposes, it is possible to use an adapted variant of the COSO standard “Internal Control-Integrated Framework” [20], where the ESG aspects are divided into five components of the internal environment - control environment, risk assessment, control procedures, information and communication, monitoring procedures, and based on the results, an assessment of each component is given.