A recent study from IFAC (International Federation of Accountants), AICPA (American Institute of Certified Public Accountants) and CIMA, (Chartered Institute of Management Accountants), ‘The state of play in reporting and assurance of sustainability information’ (
here), showed that 95% of companies disclose some level of ESG (or sustainability) data. However, only 64% obtain assurance and for 80% of those, that assurance is limited. That is in the form of negative assurance - ‘Nothing has come to our attention… to cause us to believe the subject matter information is materially misstated’. This current state of play contrasts with the high expectations of sustainability reporting and assurance. This is leading to an increasing gap in trust between what companies are reporting and whether, and to what level, they are obtaining assurance.
Take PwC’s Global Investor Survey 2022 (
here), where 87% of investors stated a belief that corporate reporting contains at least some unsupported claims about a company’s sustainability performance (that is greenwashing). In addition, investor confidence in limited assurance was only marginally higher than that of a review performed by the internal audit function (
here). Investors' higher confidence in reasonable assurance, demonstrates a clear need for more transparent and trustworthy information in sustainability reporting.
This growing expectation from investors aligns with the fast approaching European Sustainability Reporting Standards (ESRS) that will require some 50,000 companies to disclose a suite of metrics covering environmental, social and governance and at the same time obtain limited, eventually reasonable, assurance. In short, the ESRS will challenge companies to take a significant step in closing the trust gap when it comes to sustainability reporting and assurance.
The International Auditing and Assurance Standards Board (IAASB) is also progressing its plan to develop a new overarching standard for assurance on sustainability reporting – ‘ISSA 5000’. The exposure draft timeline has been accelerated and is expected to land in summer 2023, followed by a comment period extending to the end of 2023 and a finalised standard in autumn 2024. The standard has been developed in recognition of the urgency of elevating sustainability assurance. This is a result of emerging standards, such as the CSRD, and arguably represents another example of the growing expectations of companies when reporting on sustainability information.
How is the corporate world responding to these growing expectations?
This article considers how companies can prepare for what’s coming in sustainability assurance and the steps to take to set their strategy and start their journey now. This is so, be it through mandated or voluntary assurance, organisations can mitigate the growing risks arising from a trust gap in sustainability reporting.
- Who is setting the expectation for sustainability assurance in Europe?
The ESRS is the first-place European companies, and non-EU groups with a business presence in the EU, will look when it comes to assurance requirements. The European Commission proposal for a Corporate Sustainability Reporting Directive (CSRD) requires companies to report on sustainability issues. Following this, in November 2022, the European Financial Reporting Advisory Group (EFRAG) released 12 European Sustainability Reporting Standards (ESRS) covering general hierarchy, separate ‘E’, ‘S’ and ‘G’ topics as well as general concepts. The 12 ESR standards cover more than 80 disclosure requirements and 1,000 data points. For entities on 2024-year end reports, the requirements for reporting and assurance will come as early as 2025. With the CSRD now in force, there is much to be done if companies are to be ready in time
In addition, regulators outside Europe can not be ignored. The SEC is still in process of finalising its rule that would require disclosure of climate-related risks, including assurance over scope 1 and 2 emissions. It also remains to be seen whether the IFRS Sustainability Disclosure Standards may be adopted in various jurisdictions; and if they will be adopted with a view to implement future assurance requirements for certain companies.
Alongside this other local regulations continue to develop, most recently the Securities and Exchange Board of India (SEBI) announced a requirement for mandatory reporting on a number of sustainability KPIs and mandatory reasonable assurance for those disclosures. The regulation takes a staggered approach with a number of listed entities being impacted as early as FY24 and additional value chain disclosures and assurance on a ‘comply or explain’ basis from FY25. This will almost certainly result in requests for information from subsidiaries, customers or suppliers headquartered outside of India.
Assurance standards, ISSA 5000 in particular, are also relevant. Covering ‘general requirements’, the new standard will be framework neutral and principles-based. This means it can be applied to all sustainability frameworks and standards, as well as all sustainability subject matters. It, therefore, may be applied and perhaps supersede the current ISAE 3000(R) / ISAE 3410(R) standards, when it comes to assurance engagements over CSRD reporting. ISSA 5000 will include guidance for both limited and reasonable assurance engagements and can be expected to be expanded upon in future years with additional specific ISSAs that dive deeper into assurance over certain subject matters. It is not yet clear whether the EU will adopt ISSA 5000; instead it may adopt its own standard or complement the standard with EU specific guidelines. However what is clear is that the development of the standard is looking to the future and encompassing the growing demand for assurance over sustainability reporting and the step up to reasonable assurance.
- The audit committee should expect a growing role…
Regulatory inquiries, negative press coverage, loss of competitive advantage, decrease in stock value… These are all examples of the negative impacts of publicizing inappropriate sustainability information, or omitting significant disclosures.
Audit committees have long acted as a critical function for companies. They provide oversight of the financial reporting process, the audit process, the company's system of internal controls and compliance with laws and regulations. There is already a pattern of movement towards similar responsibilities being conferred in regards to sustainability reporting:
- Under the CSRD, the audit committee will have a direct oversight role over sustainability reporting, similar to their oversight on financial reporting.
- Under the proposed SEC climate-related disclosure regulation, new information that is required to be included in the financial statements footnotes will increase responsibility of management and audit committees, including under the Sarbanes-Oxley rules.
- National jurisdictions may also integrate new responsibilities for boards of directors and audit committees through their own corporate governance codes
As regulatory requirements ramp up and reporting continues to be increasingly important to investors and other stakeholders’ decision-making, audit committees will see sustainability reporting and assurance oversight moving into their sphere of responsibility. Audit committee will need to be ready for:
- the new types of disclosures to navigate, like the future-orientated information required in transition plans and scenario analysis,
- the reliance they will need to place on third party data and for requests from companies to rely on their own data,
- for disclosures that require information along the full upstream and downstream value chain, and
- an overall strategy that gives the time and resources needed to prepare to mitigate risk of qualification in future assurance reports.
- Confirm whether sustainability information currently reported is aligned with strategy
Defining a strategy starts with a clear picture of your current status and a complete understanding of publicly reported sustainability information across all communication channels, for example corporate reporting, websites and marketing material. It is critical to understanding what is in the public sphere and whether the information is relevant to the business, strategy and stakeholders to be sure that you are assuring what matters. You may consider industry/peer practices, entity public commitments (such as net zero emissions) and sustainability KPIs in management compensation schemes, when making this determination.
- Be prepared for the global rise of new regulation
Understanding early the scope and timing of current or proposed sustainability reporting and assurance regulations is critical to determining your strategy and timing. This includes consideration of cross-border impacts of certain regulations and anticipation of further changes in global sustainability regulation.
Even if you don’t believe your organisation is subject to regulation, anticipate changing investor needs and broader stakeholders’ expectations. For example, regulation can impact an organisation beyond its traditional boundaries with a need for upstream and downstream value chain information (such as scope 3 GHG emissions). That means entities relying on your information and you in turn relying on theirs - would you be confident in relying on unassured information and would your customers or suppliers feel the same?
- Confirm the level and type of external assurance that will give credibility to your reporting
Assurance can be over a selection of KPIs or a full sustainability report and be to a limited or reasonable level. Beyond regulation, consider your needs - for decision making, strategy versus your competitors, reputational risks or stakeholders’ concerns about greenwashing. Think about how assurance can create an additional line of defence against each of these risks and investors’ preference. In PwC’s 2022 Global Investor Survey, 75% investors said they would have moderate or higher confidence in sustainability reporting if independent reasonable assurance is obtained (that is. to the same level as financial statements), compared to 54% having moderate or higher confidence where independent limited assurance is obtained (here). 74% investors also said they would have moderate or higher confidence in reporting where assurance covers reporting as a whole (not just a subset of what is reported) (here). This preference for reasonable assurance and assurance over a full sustainability report may help to define your target in terms of the scope of information assured, level of assurance and timeline.
- Ensure a practical path to assurance is defined
Understanding the maturity of your sustainability reporting process is critical to meet the expectations of a thorough assurance process. It also provides visibility on effort and time needed to prepare. There are a multitude of options that can support progress towards your target, for example you may choose to start with limited assurance over a selection of KPIs and expand these to achieve reasonable assurance of your full sustainability report, over a number of reporting cycles.
It is important to continually assess your assurance strategy and evaluate whether this adequately reduces risks. These risks could include: failure to address regulation, risk of receiving a qualified external opinion, or reputational risk and/or loss of competitive advantage from failure to gain assurance in line with stakeholder expectations.
- Choose an assurance provider
Stakeholders, and upcoming regulations, expect the audit committees to step up and challenge the selection of sustainability assurance providers as they do for financial audit. Consider expertise in subject matters, experience in implementing assurance methodology in complex environments, independence and ethical standards, professional scepticism and a comprehensive view of industries and organisations, across all types of corporate reporting. Interrelation between sustainability and financial assurance strategy can also bring tangible time saving benefits as well as consistency across corporate reporting as a whole.
Expectations of assurance providers are high. Understanding what each provider offers and whether they are able to meet your expectations is important to a credible strategy and ensuring you are supported on your journey over a range of geographies, global and local needs, and beyond the baseline.
- Preparing for sustainability assurance - when to start… now!
Sustainability reporting and assurance requirements are coming fast. Especially in Europe with ESRS regulation impacting some entities as early as 2025. Companies, and their governance bodies, need to act now or face growing risks of non-compliance, reputational risks or loss of competitive advantage. Many steps can be taken in preparation for what’s coming. There is no better time to consider implementation of a robust strategy that allows for appropriate time and planning, risk mitigation, strong governance and to get the most value from assurance.