The EU is the first significant jurisdiction to adopt mandatory and audited sustainability reporting, with 10,000 larger companies reporting next year on 2024 accounts under the EU corporate sustainability reporting directive (CSRD). However, auditors are already having to audit comprehensive EU sustainability reports for major companies, focused on the double materiality concerns of a company’s impact on the environment and society as well as its financial exposure to social and environmental trends.
Harun Saki, head of assurance at professional association Accountancy Europe, says: ‘Our profession is aware of the scrutiny of the first year in Europe. All the world is watching how the reporting and how the assurance will be. We get messages from companies about auditors looking at everything because they don’t want miss anything.’
‘There’s a learning curve for everyone’
Any mistakes that are detected later could carry reputational risks for auditors, ‘so they’re trying hard’, Saki says. This may generate ‘some tension with companies who are themselves trying to understand the rules and report in time’, he adds. ‘They’re already under pressure, then you have auditors coming in and asking questions. And with ESG [environmental, social and governance] you are going to different departments to ask questions, and they may not be used to auditors, so there’s a learning curve for everyone.’
An example may be human resources questioning requests to yield up salary, gender and other personal information about employees, he says.
Late guidance
One extra difficulty is that while the directive is initially insisting that sustainability reporting assurance is undertaken through limited assurance engagements (which may become ‘reasonable’ assurance from 2028), European Commission technical guidance on how to undertake these audits may not be released until October 2026. The legislation’s preamble stresses the initial standard allows auditors to state assurance ‘in a negative form of expression … that no matter has been identified by the practitioner to conclude … the subject matter is materially misstated’. But that is it.
ACCA head of audit and assurance Antonis Diolas says: ‘It means there will be a gap where there is no EU sustainability assurance standard, and the obligation is there.’ The EU executive has in the meantime asked the Committee of European Auditing Oversight Bodies (CEAOB) to develop non-binding guidelines on limited assurance on sustainability reporting, but that is still under consideration, to be released by 1 October 2024, with the consultation having ended only in July 2024.
IAASB standards
Meanwhile, the International Auditing and Assurance Standards Board (IAASB) plans to approve and adopt a major newly developed standard for sustainability assurance engagements in the second half of this year, with due diligence probably finalised by December.
Its ISSA 5000, General Requirements for Sustainability Assurance Engagements, has already been subjected to public consultation, and will guide limited and reasonable assurance engagements on sustainability information. The standard is designed to be framework-neutral – in other words, it will mesh with standards from the International Sustainability Standards Board, the GRI, the International Organization for Standardization, as well as the EU reporting standards, supporting accountant and non-accountant assurance practitioners undertaking sustainability assurance engagements.
Larger firms are already preparing for the brave new world of sustainability assurance
The firms
But given that EU auditors will be assessing 2024 sustainability reports, due to be published in 2025, Diolas says they are more likely to use the existing ISAE 3000 (revised), which was first released in 2013 for audits other than financial information, including voluntary sustainability reports.
Meanwhile, auditors are preparing for the brave new world of sustainability assurance. Larger firms and networks working with larger companies are already doing this. ‘The firms have developed teams, some with separate departments to equip themselves, and are trying to train their staff to be ready to undertake this work and they are working with their clients,’ says Diolas.
ACCA is actively helping firms with upskilling staff, developing certificates on sustainability for finance, reporting and assurance at introductory and continuing professional development level. It has also released thought leadership papers such as Sustainability assurance: rising to the challenge. This report provides an overview of ISAE 3000 and its key requirements, for example. ACCA has also been funnelling feedback to the IAASB on its newly developed standard, to the CEAOB on its guidance and to EU member states considering how to implement the directive, and is staging webinars on the topics.
Auditors assessing sustainability reports will have to develop knowledge of ESG topics to become effective assessors, says Diolas. ‘I’m not going to know everything about the environment just because I decided to become a sustainability assurance provider,’ he stresses.
Many skills from financial auditing will be transferable, notably professional scepticism
Transferable skills
But many skills from financial auditing will be transferable, notably professional scepticism. ‘Obviously it’s a new space; there’s a lot of information that is subjective information,’ he says, pointing to past greenwashing by companies. Financial auditing also teaches auditors to look for unexpected omissions in sustainability reports, given other facts known about a company.
Moreover, soft skills such as client liaison and professionalism, and understanding client reporting systems and operations will be transferable, he emphasises.
Nicolette Behncke, PwC Germany partner for sustainability services, says: ‘Market participants expect full transparency and want to be kept in the loop at all times. Reliable information is absolutely essential for creating the necessary level of trust. Doing appropriate due diligence on a company’s non-financial data and information and conducting an external audit can form the basis for this level of trust.’
Tanguy Legein, audit partner at KPMG Belgium, says that sustainability assurance will become progressively more robust. He says that tracking data on sustainability efforts via simple spreadsheets, as many companies do, will be inadequate for the requirements of European Sustainability Reporting Standards and the CSRD. ‘Companies need at least a robust internal control process to verify that data,’ he says.
‘Assurance will eventually be comparable to that for financial information’
Legein expects ‘reasonable assurance’ will come to EU sustainability audits, ‘comparable to the level applied for financial information’, which will mean much more work. The directive’s preamble states: ‘reasonable assurance engagement entails extensive procedures including consideration of internal controls of the reporting undertaking and substantive testing’.
Materiality
Whichever level of assurance applies, Saki points out that auditors must consider whether inaccuracies or weaknesses in sustainability reports are material. ‘Should investors, lenders, creditors and shareholders know this, would they change their decisions?’ he asks.
But if misinformation is discovered through audit, auditors must ask whether it is pervasive. He says: ‘Is there a systemic issue for which we cannot even find the border? Or is it a really isolated case, already identified and being taken care of by the management?’
The materiality of inaccuracies is a tough call given report readers will have different requirements. Investors may be interested in the broader view, but some NGOs want all the detail. ‘If you have a single case of a work accident somewhere in Asia, for some it may still be relevant and important,’ Saki points out. That might push auditors to look at more detail now than in subsequent years when expectations have settled down, he suggests.
