Introduction
Sustainability has become a significant issue since people around the world are facing severe natural catastrophes including the recent forest fires in the US, flooding in Pakistan, and drought across Europe. Increasing extreme weather not only causes people but also organizations to think about going green, in another word - sustainability.

In practice, sustainability can be divided into three main aspects including environmental, social and governance (“ESG”). According to Brundtland Commission’s report, sustainability can be translated to a broad concept that meets the needs of the present without compromising the ability of future generations to meet their needs. Thus, sustainability has become the major objective and challenge for organizations nowadays and they should get a grip on the risk and opportunities.

Why is ESG important for each company?
When the organizations focus more on sustainability, it will benefit the organization including driving internal innovation, attracting employees, building better brand loyalty, garnering positive publicity for the organization, fulfilling the requirements of law and regulation, etc. Therefore, it becomes unavoidable for the organization to take the ESG journey.

Frameworks, maturity levels and the role of the internal audit function
According to Prof. Dr. Wayne Visser, organizations can be classified into 3 groups: sustainability 1.0 (age of marketing - the organization supports environmental donations and sponsorships), sustainability 2.0 (age of management - the organization incorporates the sustainability into its codes) and sustainability 3.0 (age of responsibility - the organization is characterized by a systemic approach to sustainability through innovative business models and revolutionizing products and services).

Internal audit and risk management functions should take the initiative to engage in this sustainable journey by assessing their own organization in which stage the organization is before moving on any ESG journey mentioned above.

Besides, according to The Institute of Internal Auditors (“IIA”), the internal audit function should at least provide the following assurance over the ESG reporting:

• The internal audit function should ensure the accuracy, timeliness and consistency of the ESG reporting.
• The internal audit function should verify the information shown on the ESG report is consistent with financial disclosure.
• The internal audit function should ensure that the organization conducts materiality or risk assessment on ESG reporting.
• The internal audit function should assess the effectiveness of the internal controls which govern the processes for collecting the ESG-related information and data.

Trusted Advisory
According to the IIA, the internal audit function should also provide insights and foresights according to the following aspects:

1. Building an ESG control environment - The organization should build the corresponding control environment regarding ESG. Besides, internal auditor can also advise on developing specific internal controls over ESG reporting.
2. ESG metrics - Since ESG metrics are incorporated into the nature of the business, each organization should define its own sustainability framework to accurately reflect its sustainability efforts.
3. Where ESG risk should be managed – The internal audit function should provide guidance in ESG.
4. Transformation projects - Internal auditor should play a decisive and monitoring role when the organization launches the net zero objectives project.

Moreover, since the internal audit function is in the position that allows the internal auditor to have a holistic understanding of the risks of the organization, it can contribute to the organization by guiding the sustainability strategy. Normally, the internal audit function oversees the completeness of the information provided to external stakeholders and the compliance with the selected sustainable reporting framework. However, below are some examples of elements of the sustainability strategy in which the internal audit function can help the organization to ensure that the sustainability investment might not turn out to be a green washing or green wishing promotional instrument:

Identification and interview of stakeholders
Companies have to identify the external and internal stakeholders who might have an impact on the sustainability strategy. Internal audit function should help identify the external and internal stakeholders.

Alignment of the sustainability strategy/program towards the mission, vision, and values of the corporation
The internal audit function should ensure that the organization drives its business based on corporation values.

Review of sustainability KPI
The internal audit function assists in assessing whether the selected KPI is working as part of the sustainability strategy.

Review of the incentive program related to sustainability
If the organization includes sustainability in its incentive program, the internal audit function should play a critical role in reviewing and assessing the adequacy and efficacy of the incentive program.

Critical success factors for a smooth transition into the ESG journey
In order to be successful in transiting into the ESG journey, the internal audit function should ensure that they are complying with the professional standards, such as standard 2120 Risk management, IIA Standard 2130 and IIA Standard 1210, which give the internal audit function the necessary authority to discharge their duties on the ESG reporting and have necessary proficiency to perform its engagements through training and staffing. Also, the internal audit charter should include the work of ESG work in order to grant enough authority to the internal audit function performing the work.

Benefits of broadening the IA scope
Although there will be additional and unknown challenges by the internal audit function when the internal audit function engages in the ESG journey, it can demonstrate its value and allow the staff to obtain additional knowledge.

Conclusion
All in all, it is important for the organization to care more about ESG so as to continuously operate for the next generation. The internal audit function should be given enough authority to access all information via an updated internal audit charter and give insights into the risks the organization is currently exposed to during the ESG journey. As the internal auditor, it is both a risk and an opportunity to take this trend in order to show its value.

Source:
Debruyne, D. (June 2022). ESG - sustainability: a risk or opportunity for Internal Audit?

If there are any aspects which we may assist, please do not hesitate to contact:

Gloria So  Partner, SW Hong Kong

gloria.so@shinewing.hk (Tel. 3583 8517)