Internal audit’s role in ESG reporting

IN MANY discussions and forums on environmental, social, and governance (ESG) issues, large institutional investors are escalating their requests for greater corporate transparency. Investors are keen to know how companies are addressing ESG risks and opportunities because they provide insights to the ability to adapt to the ever-changing business environment. This resulted in a surge of ESG-related data collection and eventual disclosures in the form of a sustainability report.

In his 2022 letter to chief executive officers (CEOs), Larry Fink, the chairman and CEO of BlackRock, said: “We focus on sustainability not because we’re environmentalists, but because we are capitalists and fiduciaries to our clients… These targets, and the quality of plans to meet them, are critical to the long-term economic interests of your shareholders. It’s also why we ask you to issue reports… because we believe these are essential tools for understanding a company’s ability to adapt for the future.”

A 2019 Harvard Business Review article, The Investor Revolution, noted that shareholders were getting serious about sustainability. ESG issues have traditionally been of secondary concern to investors, the article said. “But in recent years, institutional investors and pension funds have grown too large to diversify away from systemic risks, forcing them to consider the environmental and social impact of their portfolios… To respond to this shift in focus, companies must publish a statement of purpose, provide investors with integrated financial and ESG reports.”

As ESG continues to take centre stage in world news, investors and other stakeholders are appraising companies, not just on their financial reports but also their ESG declarations.

Given the accelerating pace of change in the business environment, stakeholders are sharpening their focus on ESG risks faced by many organisations. This amplified awareness is exerting pressure on corporates to gather, assess, and disclose their ESG positions along with their associated risks and opportunities.

It’s now apparent to many organisations that their ESG-related activities have a strong bearing on their reputation and cost of conducting business. That has led to some organisations reporting inflated figures or obfuscating information relating to their ESG activities, commonly known as greenwashing.

On the other side of the table, investors understand that the risks and opportunities related to ESG would have immediate or future financial and/or strategic impacts on the organisation. Therefore there are higher expectations than ever, from all readers of the sustainability report (not just investors), that the information presented in the report be reliable and relevant to decision-making.

To achieve the transparency, the Singapore Exchange (SGX) requires each listed company to publish an annual sustainability report, describing the primary components on a “comply or explain” basis, and on a mandatory basis for the component where the issuer is in any of the industries identified, in accordance with SGX’s listing rules.

And to increase stakeholder confidence in the accuracy and reliability of the sustainability information disclosed, SGX has mandated that the sustainability report of all SGX-listed companies would require, minimally, an internal review to be conducted by the internal audit department of the organisation.

SGX’s Practice Note 7.6 Sustainability Reporting Guide says that the board has ultimate responsibility for the organisation’s sustainability reporting. The board’s role includes setting strategic objectives which should include an appropriate focus on sustainability. Internal audit therefore plays a critical role in governance and control in the organisation. Not only does internal audit provide the board with the independent assurance that the sustainability governance is structured and functioning through the levels of management, but also that the ESG-related risks and opportunities are adequately considered, and disclosed, in the sustainability report.

To support the internal audit profession in Singapore in navigating through the new mandate, The Institute of Internal Auditors (IIA) Singapore swiftly developed a Guide to Internal Review of Sustainability Report, which is available for free to all its members.

As a trusted partner, internal auditors support the stakeholders in connecting the dots by assessing the organisation’s ESG risks from multiple perspectives. For example, in assessing governance and policy, internal auditors can consider whether a governing structure supports effective climate risk management and whether information on climate risk is being reported to the board.

The independence of the internal audit function is the most critical part of its role in governance and ESG assurance as demonstrated by the IIA’s “Three Lines Model”.

The internal review can highlight the adequacy of policies, controls, and responsibilities with respect to ESG strategies and tactics at a particular point in time. More focused ESG reviews can provide a deeper dive into specific ESG areas, such as control activities surrounding the ESG-related data collection process. The internal review can be extended to determine how various corporate functions, businesses, local and overseas entities form an integral part of the entire data collection workflow so that the disclosed information is complete and representative of the organisation’s business and global presence.

Internal audit can consider adopting a continuous auditing approach, incorporating assessment of ESG risk areas into the audit plans to provide a pulse check on the business during the year. This approach can help highlight the extent to which ESG-related activities are being identified, considered, and documented throughout the year. Any observations made can be addressed immediately, and reflected in a clear, balanced and objective sustainability report.

ESG disclosure will intensify in the coming years as more stakeholders are raising their demands for reliable information. Information reported by a company needs to be credible and support decision-making for investors and other stakeholders. Internal audit is well-positioned to provide that assurance, not only to the board but to all readers of the sustainability report.

The writer is a governor of the board at The Institute of Internal Auditors Singapore, and senior vice-president and group head, internal audit, at ST Engineering.