Environmental, social, and governance (ESG) reporting is becoming a top priority as organizations understand the benefits related to ESG strategies ranging from long-term value creation to lowered compliance costs.

Management boards increasingly demand strong governance structures and internal controls over ESG data. Organizations are designing and implementing controls over the collection, review, and reporting of sustainability and ESG information.

Establishing effective governance over internal controls isn’t a one-time task but a continuous process that requires commitment.

This article covers:

• What is ESG?
• How has the ESG regulatory environment changed?
• Why is an ESG governance program important?
• How do you establish effective governance over internal controls?
• Who should be involved with ESG governance?

ESG is a framework to assess how well organizations provide reliable, consistent, and comparable ESG data. The framework creates an opportunity for organizations to explain how they increase their competitive advantage in the marketplace. Each ESG category includes criteria an organization can assess to address the needs of investors, customers, shareholders, employees, and members.

Outside of the SEC Climate Disclosure proposal, other regulations and pending bills include:

• The European Union’s Corporate Sustainability Reporting Directive (CSRD). Approved in November 2022 by the European Council and the European Parliament, the directive modernizes and strengthens the rules concerning the social and environmental information that companies must report. A broader set of large companies, including some US companies with EU operations, will now be required to report on sustainability.
• California’s Climate Corporate Data Accountability Act (Senate Bill 253). The proposed bill cleared the California senate on May 30, 2023, and will next go before the California State Assembly for another vote. If the bill becomes law, the public and investors know the carbon emissions from partnerships, corporations, limited liability companies, and other California business entities with revenues in excess of $1 billion. The proposed bill reflects California’s goals for sustainability.

Design and Implement ESG-Related Internal Controls

To design internal control activities, an organization should complete the following:

• Complete an ESG Risk Assessment. Control activities should address the organization’s ESG risk appetite. By completing a risk assessment, the organization will identify and rank high risk processes within the organizations related to ESG. The risk assessment should include factors such as impact and likelihood so as to rank those risks which need control activities.
• Define the ESG Control Objective. Based on the risk, define a clear and concise control objective. The objective should describe the desired outcome of implementing the control. It should be measurable.
• Determine ESG Control Activities. Determine the control activities that need to be implemented to achieve the control objective.
• Assign Responsibility. Assign responsibility for each control objective to specific controls owner or team. Those assigned should have the necessary authority and resources to effectively implement and operate the controls.
• Monitor and Review. Once control objectives are defined and controls are implemented, monitor their effectiveness. This ensures controls are working as intended and identifies areas of improvement.

The organization should consider an integrated approach when defining ESG control objectives and implementing ESG controls. The control environment should already be in place within the organization before this implementation. Most organizations already have risk assessments, risk appetite metrics, and risk strategies that include ESG risk considerations. Including ESG risks and corresponding controls within the existing control framework will ease ESG control implementation efforts and create a stronger control environment.

Areas of ESG Internal Controls

ESG internal controls cover key areas.

Lessons Learned from the Sarbanes-Oxley Act (SOX)

Pressure on organizations to assess, manage, and disclose ESG risk has created an increase in ESG audits and financial audits that incorporate ESG data. A demand for the same rigor that goes into SOX financial reporting will soon be required for ESG. Companies that plan for these new regulations are at an advantage when external assurance is needed.

In March 2023, Committee of Sponsoring Organization (COSO) developed an integrated framework that provides guidance on Achieving Effective Internal Controls over Sustainability Reporting. This framework mentions the value in leveraging existing controls. SOX processes may be modified and applied to ESG information.

Internal Audit Team

The role of internal audit is to assure ESG initiatives’ effectiveness, integrity, and alignment with organizational objectives. With regards to ESG, internal audit can pinpoint areas where the company might be subject to ESG risk related to reputational damage, non-compliance, and operational inefficiencies.

Internal audits to review, verify, and improve ESG practices becomes increasingly vital as ESG concerns become more integrated into business operations and strategy. ESG auditing helps in risk management and fosters trust among all stakeholders.

Chief Financial Officer

The role of the Chief Financial Officer (CFO) in ESG has evolved and expanded. Today, a CFO should help identify, assess, and mitigate ESG-related risks to help ensure the organization’s financial resilience.

Controller

The role of a controller in a company revolves around overseeing control environments related to the accounting and financial reporting functions. The controller’s role intersects with ESG in various ways.

The controller must ensure the accuracy and completeness of ESG metrics alongside other financial data. Ensuring the reliability of ESG data requires robust internal control. Successful controllers oversee these controls to ensure ESG reporting integrity.

IT Team

Many institutions have never gathered ESG data before or are gathering this data from third parties. This raises concerns over the quality and reliability of ESG data. Teams have relied on manual processes that don’t achieve completeness and accuracy objectives.

ESG reporting requires the collection, storage, and analysis of vast amount of data, much of which comes from diverse sources. The IT team ensures that there are adequate systems in place to support these data collection and retention processes.

IT teams should ensure that general IT controls are in place for system access, changes, and monitoring related to the collection, verification, security, and retention of ESG data. IT general controls should be designed and implemented to consider protection of ESG data from cybersecurity threats and data regulation requirements.

We’re Here to Help

For guidance on establishing governance and internal controls around ESG initiatives, contact your Moss Adams professional.

Additional Resources

• ESG Audits Services
• Environmental, Social, and Governance Services
• SOX 404 Compliance Services