Research Connection, April 2007

Auditing Sustainable Development

Internal auditors can add value by assessing their organization’s sustainability
management system.

Increasingly, boards of directors are realizing that sustainable development is an essential part of corporate governance. The number of companies publishing sustainability — or corporate social responsibility — reports continues to grow. Formerly seen as a marketing tool, today these reports are used to demonstrate transparency on policies and progress made on the company’s economic, environmental, and social responsibilities. Sustainable development thinking emerges quickly and affects many organizations, both in the public and private sector.

Organizations are recognizing that they need a system to structure formerly scattered elements of sustainability information gathering and fill in missing links. Internal auditors are well-positioned to assist management in implementing a sustainability management system and perform system audits after the implementation phase. To do so, however, they must acquire knowledge about sustainability and applicable audit techniques.

THE SUSTAINABILITY MANAGEMENT SYSTEM
According to the United Nations’ Brundtland Commission, sustainable development is a process of change in which exploitation of resources, the direction of investments, the orientation of technological development, and institutional change are in harmony and enhance both current and future potential to meet human needs and aspirations. Sustainable development seeks to find the balance between economic, environmental, and social performance.

Organizations following the Global Reporting Initiative’s (GRI’s) reporting guidelines use specific performance indicators to identify reportable sustainability achievements and challenges. GRI also requires that the organization describe its sustainability management system. In addition to having a sustainability policy and strategy, such a system should include four phases: 1) planning and risk management, 2) implementation and operations, 3) checking and corrective action, and 4) management review and continual improvement. Management is responsible for implementing the sustainability management system, and internal auditing should perform an assessment of its adequacy and effectiveness.

POLICY AND STRATEGY
The sustainability policy should be appropriate to the nature, scale, and sustainability impacts of an organization’s activities, products, or services. Internal auditors should review the process that sets and reviews the policy. Auditors should test whether the policy is consistent with the organization’s strategic plan and other policies, and verify that it includes all relevant laws, regulations, protocols, and industry standards. They also should determine whether the policy has been communicated to all stakeholders. Further, the policy should be reviewed to identify if it reflects top management commitment and clear targets and objectives.

The sustainability strategy should be consistent with the sustainability policy and overall organizational plan. Processes that have been recognized as being critical to the risk assessment process should be addressed, and the strategy should provide sufficient information and direction to enable effective sustainability objectives, targets, and plans. To determine the practical usefulness of the sustainability strategy, internal auditors should interview those involved in defining the objectives, targets, and plans; review the processes associated with generating them; and communicate their conclusions to top management and the board.

PLANNING AND RISK MANAGEMENT
The planning phase of the management cycle links the sustainability policy and strategy to objectives and targets. Auditors should determine whether described roles and responsibilities are consistent with the strategy and policies, included in job descriptions, and understood by relevant staff and employees. To accomplish this, auditors can review personnel files and conduct interviews or surveys.

Internal auditors should investigate whether systems designed to ensure consistency of objectives and targets with the policy and strategy are adequate and effective. In particular, they should review whether specific objectives and targets assigned to one employee are in conflict with those assigned to another employee. For example, if a buyer in a supermarket chain is instructed to procure fruit at the lowest price possible, desired aspects of labor conditions or the use of pesticides at the supplier’s plantation may not meet the company’s sustainability standards. Internal auditing should evaluate whether objectives and targets meet specific, measurable, achievable, risk related, and time bound (SMART) criteria.

Given the sustainability objectives and targets set as a result of the organization’s policy and strategy, procedures should be established and maintained to identify controllable aspects of the organization’s activities, products, and services. Internal auditing should review the design and maintenance of these procedures. In particular, the determination of relevant aspects by which sustainability impact will be measured should be subject to review. GRI’s Indicator Protocols can be used as reference materials to determine the best suitable performance indicator. Examples are direct and indirect greenhouse gas emissions by weight, or the noise in decibels produced by departing airplanes within 10 kilometers from an airport.

The auditors should ensure that sustainability aspects are included in the organization’s risk management. In their consultancy role, internal auditors can assist management in identifying, evaluating, and implementing risk management methodologies and controls to address sustainable development risks. As part of their audit, they should gather evidence and determine whether the objectives of the risk management processes have been met.

IMPLEMENTATION AND OPERATION
Auditors should determine that overall responsibility for the sustainability program and its management system is assigned to one individual who reports to top management. Auditors should interview this person to assess the effectiveness of the reporting line. Also, the auditors should evaluate whether the sustainability manager is sufficiently empowered to ensure realization of the program and interview top management and others in the organization to learn their perspective on the manager’s effectiveness. Further, auditors should review formal reports to top management. These reports may reveal problems in achieving desired results. Auditors should evaluate whether corrective actions to address these problems are adequate.

The process by which resources are allocated to enable achievement of sustainability objectives and targets should be reviewed. Auditors should assess whether there is a process formally accepting commitments to objectives and targets by responsible managers. Also, auditors should determine whether there are consequences if they are not met. Scrutiny over the feasibility of objectives and targets will be much better if failure to meet them results in noticeable penalties. Internal auditors should evaluate whether auditable performance indicators have been set. Performance indicators are auditable if they meet SMART criteria and the trail from original source data to reported figures can be tested.

Resources to accomplish objectives and targets include people, specialized skills, measurement and other equipment, precautionary measures, working conditions, and money. Internal auditors should review formal policies and instructions and test their adequacy by inspection and interview. External assessments by authorities (e.g., those who review compliance with environmental regulations or working conditions) can be of help to the internal auditors in understanding the organizational level of sustainability maturity.

Additionally, internal auditors should determine whether an overall training program has been established to introduce sustainability thinking into an organization. The purpose of training is to create sustainability awareness and understand the roles individuals should assume and the responsibilities they have to achieve objectives and targets. Auditors should verify that top management is a strong sponsor of this training program. Top management may demonstrate this by kicking off each training session or sending personalized invitations to employees. Internal auditing should check whether employees at all levels of the organization receive training based on the level at which they operate. Auditors should verify that the purpose of each training program is clearly set and that an evaluation system has been established to measure its quality and effectiveness. The auditors may observe one or more training sessions to get an impression of the quality of the training program. They also can use surveys amongst the trainees for the same purpose.

Finally, internal auditors should review the adequacy of the sustainability communication plan. This plan should describe the purpose of, and channel(s) used for, each communication. Internal auditors should also evaluate how the effectiveness of the communication — in terms of increased awareness — is measured, and whether the communication plan is adjusted when needed. Communication channels may include: Internet and intranet, staff magazines, press releases, open door events, conferences, advertisements, webcasts, and a formal sustainability report. Auditors should evaluate whether the communication plan is tailored to the needs of the organization and whether the goals of the communication plan are consistent with the sustainability policy and strategy.

CHECKING AND CORRECTIVE ACTION
There is a long history of reporting on financial performance based on widely accepted criteria. Most internal auditors know how to test the reliability of quantified reports by evaluating the adequacy of performance indicators, given the set sustainability objectives and targets. Internal auditors should evaluate the adequacy and effectiveness of the processes generating the performance indicators. Process weaknesses may surface during interviews with users of these indicators. Internal auditors should further investigate these to identify root causes.

Performance indicators are an effective monitoring tool if they are used for corrective action when needed. Whenever possible, performance indicators should be quantitative, as they are easier to audit for reliability than qualitative measures (e.g., safety, comfort).

Auditors should evaluate the effectiveness of measures taken to register reported nonconformities with the sustainability management system. The processes should include reports and complaints from both inside and outside the organization. Auditors should review the complaint settlement process and test its effectiveness by selecting a sample of complaints and following through on them, including communication to the complainer. Interviews or surveys also can help the auditor identify whether the root cause of the complaint has been eliminated.

MANAGEMENT REVIEW AND CONTINUAL IMPROVEMENT
Periodic management review of the adequacy and effectiveness of the sustainability management system is essential to ensure continuous improvement. Auditors should review processes resulting in information used for this review, testing the accuracy of the information, and evaluating the plausibility of information that cannot be tested. Auditors should verify that controls are effective to ensure that the information provided is consistent with other reports used to monitor performance. Based on internal audits performed, the chief audit executive should also provide input for the management review. However, internal auditing should not be responsible for management decisions resulting from these audit reports.

Auditors should determine whether the review conclusions are clear and lead to actions that ensure continual improvement of the sustainability management system. The auditors should verify that objectives and targets are reviewed periodically and adjusted when needed. Also, they should verify that the outcome of the management review, and its resulting adjusted objectives and targets, are communicated clearly and included in the planning phase for the next period, thus closing the loop of the sustainability management system.

ADDING VALUE
Internal auditors have an opportunity to demonstrate added value to their sustainable organization. Roles auditors can play include:

• Assist in the design/implementation of the sustainability management system.
• Assist in creating sustainability awareness or training employees.
• Perform limited scope audits requested by top management.
• Perform supply chain audits.
• Perform compliance audits.
• Advise on the appointment of outside assessors.
• Coordinate audit activities by external assessors.

Auditors must have a good understanding of sustainability concepts and known best practices in the industry. To enhance credibility, the CAE should consider recruiting sustainability specialists.

HANS NIEUWLANDS, CIA, CCSA, CGAP, RA, is coordinator, internal auditors and CSR, at Royal Nivra in Amsterdam, the Netherlands.

This article is based on Sustainability and Internal Auditing (August 2006), The IIA Research Foundation.