Internal control is all about trust and transparency – but what does that mean in a world where sustainability information is becoming more prevalent and important? A new report from ACCA, The Internal Audit Foundation and the Institute of Internal Auditors (IIA) addresses this vital question.
With the help of 50 ACCA and IIA members across the world who participated in a series of roundtables and interviews, as well as a survey of almost 1,000 respondents, Internal control over sustainability data looks at the extent to which internal control is being exercised over sustainability information.
Finance professionals need to appreciate the different nature of the data involved
The report’s authors stress that it is intended to be practical, offering a series of recommendations and observations that they hope will help finance, accountancy and internal audit professionals in the field.
Influencing strategy
The report stresses the growing importance of sustainability data, and the need for internal controls around its collection and reporting. ‘The transition of entities to more sustainable business models requires them to adapt their models to reflect complex strategic drivers, such as circularity and the achievement of climate-related targets,’ it says.
This begins with the setting of strategic goals that are translated into a plan and roadmap; these yield a series of success factors that are measured by key performance indicators, and their achievement is monitored by both internal performance management systems and external reporting requirements. In other words, there is a clear link between strategic outcomes and internal controls.
Risks and challenges
But the report notes that ‘there are challenges and opportunities to address if a reasonable level of control’ is to be achieved over sustainability data – and these are more substantial for smaller entities, which may need to satisfy the reporting requirements of larger-company customers.
Realistically, it says, finance and internal audit professionals need to rethink their approach when applying the principles of internal control to sustainability data, and appreciate the different nature of the data involved. The challenge, it adds, is that a system of financially driven internal controls that can be applied to sustainability data does not exist.
‘The social and governance strands are the ones that always gave me the biggest headaches’
Part of the solution may be one of education rather than process: ‘There is, perhaps, a need to reframe the internal control discussion to be broader and to upskill process owners, management, internal auditors and others…raising awareness of what is achievable.’
A key risk in applying internal control over sustainability data is ‘inadvertent reliance upon data that is not robust’, warns the report. As one roundtable participant, an external auditor, commented, ‘When it comes to, say, health and safety metrics, assuring completeness is close to impossible. The [social] and [governance] strands are the ones that always gave me the biggest headaches.’
Collaborative
Establishing internal control over sustainability-related data is complex and involves the participation of many functions within the business. Contributors to the roundtable events identified a range of challenges around data in particular, including the scope of data collected, and the existence of differing standards (and interpretations of them) that confused data collection.
This was confirmed by survey respondents; together with roundtable participants, they identified these significant hurdles (in order of frequency):
- poor data quality and fragmented sources
- lack of uniformity and clear frameworks
- insufficient skills, knowledge and resources
- weak leadership support and unclear data ownership
- immature or poorly defined processes
- difficulty adapting financial control models to sustainability data.
The survey also found that more than six in 10 respondents felt that internal control over sustainability data was ‘extremely’ or ‘very’ important, but it was also clear that there is still a lot of work to be done in establishing these controls – and only half of respondents said that there was a high level of leadership support. ‘The message,’ says the report, ‘is that there is a considerable opportunity for improvement.’
The report discusses how an effective internal control system over sustainability data can be developed within an organisation, noting that this will take comprehensive action in a number of areas, from systems to training:
The report also stresses that there are real opportunities here for finance and audit professionals to ‘establish their relevance to data quality and governance throughout the entity, not only to financial objectives’.
Engage external assurance and undertake readiness assessments
Practical recommendations for professionals tasked with strengthening internal controls over sustainability data include the following:
- Ensure that the entity has included sustainability-related objectives in its strategic goals.
- Identify current data collected and evaluate its appropriateness.
- Strengthen data governance and ownership.
- Improve data with technology and automation.
- Undertake capacity building and training.
- Establish effective leadership and ‘tone at the top’.
- Ensure consistency of processes and metrics.
- Embrace technology for delivering control strategies.
- Engage external assurance and undertake readiness assessments.
Accountancy, finance and internal audit professionals have a vital role to play, the report concludes, in ensuring that the data presented is ‘robust and, as far as is practical, accurate’. But this report, it adds, ‘has demonstrated that this remains a journey’.
