Internal Audit Considerations: The new urgency of environmental, social, and governance and internal audit’s role in driving progress

Considering the pressing impetus for change, the chief audit executive or senior internal auditor need to quickly bring these critical issues to the attention of management and the board of directors. They should also be prepared to advise how internal audit can provide both advisory and auditing support for strategic ESG priorities.

Internal audit has an opportunity to advance ESG maturity and drive positive organizational change by undertaking the following:

• Emerging trends: Raise awareness at the board and senior leadership levels about ESG priorities and implications.

• Strategy: Link ESG issues and factors to strategy, showing the risks related to inadequately addressing short- term and long-term priorities.

• ESG materiality matters: Materiality is linked to stakeholders and what they deem to be decision-worthy information. ESG issues are plentiful — but not all constitute the level of criticality required for corporate disclosure. Internal auditors can play a key role in evaluating decisions for disclosure including prudent application of materiality thresholds.

• Management system: Map current data input, collection, management, and output for ESG decision making and reporting to ensure rigor of data quality (i.e. completeness and accuracy). Data quality is essential for adequate assurance of public disclosures and, by association, the company’s reputation. 

• Controls: Validate key controls for management system effectiveness and robustness of data used to support reporting and disclosures.

• Inventory ESG disclosures requirements: Know what disclosures are required and by whom for those who want to pursue a compliance-only strategy (e.g. government, securities commissions, accounting guidelines, industry standards, etc.). This is non-negotiable if your securities commission requires sustainability disclosures (e.g. diversity among the board / senior leadership teams).

• Competition: Conduct industry benchmarking for leading ESG practices and trends.

• Reporting: Establish disclosure controls and procedures; ensure reporting is not “greenwashing”.

MNP’s model serves as a guide to sustainability maturity

ESG is not a destination, but an ongoing process throughout the business lifecycle. Realizing advantages requires a commitment to continuously investing in, managing, monitoring, and improving ESG efforts.

Targeting a desired ESG maturity level and embedding ESG pillars into strategic and operational priorities requires a meaningful dialogue between management and the board of directors. A baseline maturity assessment of the organization’s current approach to sustainability is an ideal starting point. This will help internal audit teams gather the data necessary to work with the board and management to establish the desired future state — or, in other words, the intended maturity level that will facilitate corporate objectives.

A sustainability maturity model demonstrates the stages of ESG integration and common features of each stage. This model breaks down ESG frameworks into meaningful components — operations, stakeholders, governance, strategy, and reporting — which drive a successful sustainability program.

MNP’s model can be used to:

• Conduct a baseline assessment of an organization’s current ESG maturity
• Evaluate the maturity of existing processes for stakeholder identification and consultation
• Assess the approach to, and rigor of, ESG reporting
• Determine the current maturity of the organization’s ESG strategies
• Assess how current ESG efforts compare with other organizations
• Gauge the maturity of governance oversight by the board of directors
• Identify ways to improve the organization’s approach to ESG auditing and reporting

Moving along the continuum, corporate leaders can choose the level of ESG maturity that links to strategic objectives or is prescribed by relevant legislation. This model is adaptable and facilitates differing levels of maturity for individual components (i.e. operations, stakeholders, governance, strategy, and reporting). And it provides organizations with flexibility in adopting custom-fit sustainability practices.

For example, consultation may take some time to raise the overall maturity of the stakeholders component — however an organization can still take certain steps in parallel to rapidly scale governance capabilities and skillsets.

It’s also worthwhile to acknowledge that achieving stage five may not be achievable or even necessary for many organizations. What’s immediately important is realizing the many advantages in moving forward from zero.

Top

Reporting framework critical 

There is no standard approach to ESG, but the Chief Audit Executive can take a number of actions to ensure the process generates reliable, ESG-standardized information. The following 10 considerations may be helpful in evaluating your internal audit role in assisting your organization on its ESG implementation and maturation journey.

It’s also helpful to keep in mind that meeting stakeholder expectations for meaningful and reliable ESG disclosures requires both a robust governance structure encompassing the board and internal audit, as well as third-party, independent assurance of ESG disclosures and reporting.

Higher ESG maturity, greater competitive advantage

The global focus and expectations around ESG will rapidly intensify in the years ahead. chief audit executives and internal audit departments are ideally positioned to influence and support your company’s transition to an ESG-mature model. The key to sustainability success is leveraging the power of culture to drive change across the entire organization. And the discipline involved with linking ESG from strategy to operations requires clarity across the Three Lines (of Defense) Model, including the board’s role in effective oversight: “All roles working together collectively contribute to the creation and protection of value when they are aligned with each other and with the prioritized interests of stakeholders.”

Internal audit has the right independent perspective, position, and ponderance to understand strategy, observe operations, identify risks and assess controls to communicate on the effectiveness and maturation of their company’s adoption of ESG. Bringing both lenses of assurance and advisory services will serve to raise awareness of critical ESG issues as well as to evaluate management’s response to these same issues. Internal audit must also work with the other lines of defense to understand the holistic implications of risks on ESG strategy to ensure long-term success for their company.

An article by the Harvard Law School Forum on Corporate Governance on the strategic imperative of culture and ESG effectiveness found “… [social] practices [among businesses] are a barometer for corporate culture. Where companies have a strong and shared culture across the organisation, practices tend to be strong. Where a culture is poor, or considered ‘toxic’, [social practices] [tend] to follow the same pattern.” Understanding the interrelated risks and drivers of ESG success will need to be clearly identified and articulated to both senior leadership teams and the board of directors.

It’s the right time for internal audit to assume a strategic advisory role and bring ESG progress into focus for boards, executives, and management teams. The real risk is not starting the sustainability journey to realize the vital benefits. Now is the time to build a respected brand, value for stakeholders and greater resilience, sustainability, and competitive advantage.

1.Internal Auditors Role in ESG, Edward Olson, MNP, National IIA Roundtable, Institute of Internal Auditors Canada, February 23