Share

ESG and Internal Audit

In recent months, there has been a significant focus by companies and the Securities and Exchange Commission (SEC) on Environmental, Social, and Governance (ESG) related disclosures. Companies are making huge investments in their ESG programs, and many have started to adopt a voluntary examination of their ESG disclosures. Additionally, the SEC has recently invited public comments on climate change disclosures.

In our prior articles, we discussed the importance of ESG for the Board of companies and the challenges in ESG implementation. In this article, we will discuss how an Internal Audit (IA) function can assist the Board and ESG program managers in accomplishing its business objectives and managing risks associated with ESG strategy and implementation.

The IA function can add significant value to its ESG program and disclosures. IA can proactively advise the line management responsible for managing an ESG program on governance, risks, processes, and internal controls. With its direct reporting to the Board, IA can relay appropriate messaging for risk management of ESG programs helping to ensure timely allocation of resources and action plans.

The following are the common consulting or assurance roles IA functions can assist with:

• In its consulting role and responsibilities, IA can be involved in a rollout of an ESG program and its company’s ESG strategy, identifying potential risks so that proper risk mitigation procedures are included in the ESG program.
• Many companies implement applications to manage an ESG program. IA can review the specifications of such implementation and advise on controls to build into such programs.
• ESG procedures of a company can involve significant data collection and its summarization from various systems. The accuracy, completeness for key metric calculations, and reporting of such data come with its own set of risks, requiring a need to establish proper control mechanisms to prevent or detect any errors in a timely manner. IA can provide reasonable assurance on the data and data collection procedures and provide recommendations to improve such procedures.
• IA can perform audits in connection with the company’s ESG procedures and provide recommendations.
• If the company requests an examination of its ESG disclosures, then IA can assist management and external auditors through the testing of systems and internal controls. This allows management to make appropriate representations and allows auditors to rely on internal audit and/or internal controls to make their audits efficient.

Not managing ESG risks can expose significant reputational and financial risks to a company. There are known instances of exaggerated ESG reporting referred to as “greenwashing,” where a company’s marketing efforts attempt to convince consumers about a higher level of ESG goal than can be measured and proven. For example, when Volkswagen’s fraudulent claims regarding emissions surfaced, it lost billions of dollars in shareholder value and spent a hefty sum of money for fines and subsequent monitoring programs.

A recent publication from the Institute of Internal Auditors titled “Internal Audit’s Role in ESG Reporting” highlights such concerns from a risk management perspective and outlines both the advisory and assurance-related value add that the IA function can provide to companies.

Companies of all sizes will eventually make certain disclosures regarding ESG and building up robust programs with IA’s assistance can certainly help mitigate the risks. Incorporating ESG risks in annual risk assessments and formally including ESG projects for consideration in the Internal Audit project universe is a best practice that all IA departments should implement.