Auditing Corporate Responsibility
Today's internal auditor has an important role to play in ensuring CSR policies are successful
As pressure for organizations to become good corporate citizens increases, social responsibility is becoming an intrinsic part of their strategic planning processes. The World Business Council for Sustainable Development defines corporate social responsibility (CSR) as "the continuing commitment by business to behave ethically and contribute to economic development while improving the quality of life of the workforce and their families, as well as of the local community and society at large."
"CSR is an emerging area that is closely linked to governance and risk," says Jim Key, CIA, partner at Shenandoah Group, based in Beaufort, S.C., and an IIA instructor. "An increasing number of organizations are setting goals for CSR in the areas of carbon footprint, sustainability, human rights, and supply chain management. This goal setting leads to reporting progress to stakeholders and, as in all disclosures, internal auditors should be assuring the process."
Data from The IIA Research Foundation's recent Common Body of Knowledge survey indicates that 24 percent of the internal auditor respondents currently have a role in CSR, but an additional 32 percent expect to have a role in it in the next three years. Internal auditors who understand CSR and sustainability, including trends, requirements, and tools, have a competitive edge within their audit function.
"As CSR continues to become an issue that is material to the bottom line of many corporations, internal auditors need to verify and gauge the internal control functions within a company to effectively respond to CSR issues and minimize risks to the company," says Lincoln Romain, CPEA, Strategic Advisory Board Chair for the Board of Directors of Environmental, Health, and Safety Auditor Certifications (BEAC), and senior manager, Environmental, Health, and Safety, Global Crossing Development Co., in N.J.
The Components of CSR
According to CSRwire - a source of CSR and sustainability information - stakeholders, regulators, and nongovernmental organizations are beginning to demand information about a company's social and environmental impact, and stakeholders are rewarding companies that make strides to improve their performance in these areas. PricewaterhouseCoopers' (PC's) Sustainability Yearbook 2008 also finds that the demand for transparency has led to the emergence of improved financial and corporate governance reporting.
For an organization to implement a successful CSR plan, it must commit to responsibility from beginning to end. According to PC's Sustainability Yearbook, companies will have to take responsibility from the "excavation of raw material all the way to the pollution of land, water, and atmosphere when a product is either recycled or disposed of."
Wal-Mart recently unveiled Sustainability 360, a plan to work with its suppliers throughout the entire supply chain to help suppliers reduce their global footprint, thereby reducing Wal-Mart's, as well. Other companies in various sectors have followed Wal-Mart's lead and, in turn, new requirements for suppliers and producers have trickled down, affecting each aspect of the production cycle - from packaging to promotion to delivery. "Wal-Mart has grasped the opportunity to demonstrate that the deep changes it's making for sustainability outcomes can reap significant financial returns over time," says Assheton Carter, PHD, chief advisor, Environmental Leadership for the Center for Environmental Leadership in Business, Conservation International, based in Washington, D.C. "Companies are a part of, not apart from society. CSR is a prism through which they can see uncovered business value and exposure to unanticipated risk," he adds.
An important aspect of social responsibility is ethics. Investors and consumers are becoming more vocal in their demands that corporations, and countries, practice business ethically. There are numerous examples in the media almost daily of organizations being called out for CSR abuses.
Internal Auditing's Role
According to Key, the internal auditor's entryway into adding value to the CSR movement is through governance and risk management, which should provide reasonable assurance that the organization can meet its strategic objectives. "CSR and sustainability are a subset of an enterprise's vision, values, and strategy," he explains. "Therefore, the internal audit activity must provide assurance and consulting services to management and the board to assess how well the organization is doing in meeting its CSR goals."
Jerrold Atlas, CPEA, environmental auditor at Consolidated Edison Co. in New York, and Chair of BEAC agrees: "It is important that internal auditors have an awareness of the activities that impact the corporation's actual, as well as perceived, CSR and sustainability performance. Internal auditors should monitor the aspects of the corporation's performance with respect to these issues and can contribute significantly to the success of the efforts by pointing out areas for improvement and new initiatives to fulfill corporate aspirations."
The IIA will offer the "Corporate Social Responsibility: Opportunities for Internal Audit" seminar in July 2008. According to Cyndi Summers, IIA director, Program Development, it will be an opportunity for internal auditors to learn the economic value proposition and emerging trends in CSR. "This is also the ideal setting in which to network with peers from all over the world to discuss how their organizations - and countries - use CSR policies and to help better understand the role internal auditors should play in the CSR realm," she says.
One of the topics covered in the seminar is the "triple bottom line" and how it applies to internal auditing. According to Key, the line suggests that organizations are committed "not only to the traditional bottom line of economic viability (e.g., financial performance), but also to the environmental soundness of organizations and social performance. "These three bottom lines are in every organization's best interest in their own business continuity," Key says. "In other words, CSR is becoming an area in which investment can be made to grow, improve, or innovate current business models." Practitioners will learn some of the reporting challenges and the latest emerging practices in assurance.
Key also suggests practitioners become familiar with the definition of internal auditing, the Code of Ethics, and The IIA's International Standards for the Professional Practice of Internal Auditing (Standards) that require internal auditors to assure governance, risk, and compliance and, by association, CSR.
Toward a Common Goal
BEAC, an independent standard-setting body for environmental, health, and safety (EHS) auditing, was established in 1997 as a joint venture by The IIA and The Auditing Roundtable (previously known as The Environmental Auditing Roundtable). BEAC issues the Certified Professional Environmental Auditor (CPEA) exam and certification. Many organizations are requiring that their EHS auditors earn the CPEA designation. It has been recognized by the U.S. Environmental Protection Agency and the U.S. Department of Energy, and the American Chemistry Council requires that those who audit the Responsible Care program at its member companies pass the BEAC exam.
"EHS auditors can partner with internal auditors to meet the CSR demands," Romain says. "Many corporations are already aligning the EHS auditing function with the internal audit department, which should continue as CSR and other environmental issues continue to become increasingly visible."
According to Atlas, the CPEA designation identifies an auditor who has the appropriate education, demonstrates knowledge and experience, adheres to a rigorous code of ethics, performs audits in accordance with established standards, and maintains a required level of continuing education. "The CPEA provides a level of comfort that the individual evaluating the company's CSR performance has the requisite skills to meet the highest standards," Romain adds.
Dave Richards, CIA, IIA president, is optimistic about BEAC's continued success. "Organizations are increasingly including EHS factors in their enterprise risk management reviews and have expanded the U.S Sarbanes-Oxley Act of 2002 requirements to include environmental measurements," he says. "Therefore, the value and visibility of CPEA-certified professionals who are knowledgeable in CSR policies is becoming more important to organizations."
Becoming Good Citizens
According to CSRwire, an organization that is considered a "good corporate citizen" is one that shows a commitment to its stakeholders through socially responsible business practices and transparent operations. A recent benchmarking survey of 150 European senior finance executives by CFO Europe Research Services found that finance executives are taking the environment and climate change seriously. They also want to be partners in setting environmental strategies, lending their expertise to areas once thought restricted to the "soft" areas of marketing and communication.
The survey concludes, "As the environment gets ever more attention at board level, CEOs will be looking to the management team for innovation. Environmentally-aware CFOs, with their view across the entire organization, are well placed to provide it." In turn, internal auditors who stay abreast of current news and policies regarding CSR are also ideally poised to make a real difference within their organizations and to the world.
Making CSR a Priority
CSR is beginning to strongly impact an organization's ethical culture and should be an important factor in the bottom line. "There is no question that as more corporations become aware of the importance of maintaining social responsibilities to the expectations of their customers, employees, neighbors, and other stakeholders, it will become a priority," Atlas says. "It will be a vital concern to maintain a good image as a responsible corporate citizen such that the leadership of the corporation will want to be assured that its performance in CSR is meeting their goals. This is where internal auditors have a role to play in ensuring the desired level of performance is being met and sustained."
