Thank You!

You are attempting to access subscriber-restricted content.

Are You Ready to Experience Everything Internal Auditor (Ia) Has to Offer?

​​Measuring Sustainability

A four-pronged assessment model enables internal auditors to determine the maturity of their organization’s corporate social responsibility efforts.

Comments Views

​Maintaining a socially responsible approach to business plays an integral part in the operations of many of today's most successful organizations. In fact, whereas sustainable business practices may have once been viewed largely as an obligation, they are now often seen as central to organizational success.

The United Nations Global Compact defines sustainability as encompassing "environmental, social, and corporate governance issues" as embodied in its Ten Principles, which covers human rights, labor, the environment, and anti-corruption. With each passing year, it becomes more and more important for internal auditors to be involved in sustainability and to help ensure effectiveness in this critical area. Stewardship and safeguarding assets have long been key to assessing risk and helping manage an organization's resources. To be at the cutting edge of our profession requires addressing sustainability strategies in every internal audit engagement.

This level of commitment to sustainability requires pioneering and developing new paths in professional internal audit services. In the 1980s, I designed the "Cutting Edge Audit Maturity Model" (see below) to measure the maturity of the internal audit function I led at that time. And while many years have since passed, the model has continued, and even added, relevance for today's stakeholders. Each of its four components — Organization, Professionalism, Change, and Quality — has sustainability messages for boards, audit committees, management, and every internal auditor. The components can be used to develop key performance indicators and benchmarks to measure both an organization's sustainability maturity and the professionalism of its internal audit services.


The maturity model's Organization line represents the strategies, structures, systems, style, staff, skills, and shared values that create an organization and internal auditing excellence — not just within but across its supply chains, from all suppliers to all customers. These seven elements derive from the McKinsey 7S Framework, developed by well-known business consultants Tom Peters and Robert Waterman, which states that each of the elements needs to be aligned for an organization to perform well. The elements should be motivated, governed, regulated, and integrated at the board level, by senior management, and by supervision — and implemented at all operating levels, including internal audit.

Suppliers and Customers With their arrows pointing outward in either direction, the Suppliers and Customers points on the Organization line indicate the importance of supply chain and customer relationship management in the governance of every organization and service. No organization operates or achieves excellence in a vacuum. The more this concept is understood and heeded by internal auditors in their charter, planning, and engagement work, the greater the maturity of their assurance and consultancy services.​

Every organization and service is accountable for its impact on the environment and for how it addresses and measures this and social issues in its economic objectives. Many of today's organizations are addressing these issues, measuring and communicating their impact to all stakeholders. This responsibility is at all levels in an organization and the internal audit activity. It is increasingly being seen as fundamental to good governance and should be seen in the objectives of every internal audit engagement. ​​


Today's organizations need to be professional, and this imperative extends to all internal audit activities. Insight and the ability to penetrate deeply into operations from board level to the daily operations of all functions is a must. That insight and penetration requires a systematic and disciplined approach to management. For internal auditors this means providing service in line with The IIA's Definition of Internal Auditing. But Professionalism encompasses more than just the Definition and the International Standards for the Professional Practice of Internal Auditing. It is the whole International Professional Practices Framework (IPPF), including its Code of Ethics, Practice Advisories, Practice Guides, Position Papers, and research publications. Evidence of adherence to all of these should start in an internal audit charter approved at the board level, and it should flow through to every engagement in the services internal audit provides.

Depth As illustrated by the maturity model's downward-pointing arrow, the greater the maturity of professionalism, the deeper a board and internal auditor can penetrate an organization's operations and the better their decision making and effectiveness will be.

All boards and internal audit functions should measure the depth of their impact and contribution on the sustainability strategies and objectives of the organizations they serve. This can, and is, being achieved by many using the excellent measures in the United Nations Global Reporting Initiative sustainability reporting guidelines, as well as by recognizing and using in all internal audit engagements the sustainability assurance guidance in the IPPF.   ​


The Change line represents time. Change is perpetually with us — and not always for the better. It causes us to live in a perpetually transitional state, moving ever faster. Having the attributes and performance abilities to manage change, assess the associated risks, and mitigate or control those risks is a key contributor to success for all organizations, the environments in which they operate, and internal audit planning and engagements.

Past, Present, and Future With arrows pointing in both directions and touching Professionalism and Organization, Change emphasizes the maturity links across past, present, and future. What is learned from the past and present significantly influences the management of risk in the future. Risk-based decision making at the board level and in auditing is a must for all organizations.  

Beyond the Horizon represents the "unknown," yet in the present and immediate future there are often many indicators of organizational threats, challenges, and opportunities. Being aware of and having the risk intelligence and wisdom to manage beyond the horizon is a sign of increasing maturity at board and executive levels in every organization. Having the imagination and insight to recognise change beyond the horizon is a skill all internal auditors should develop. ​

Perpetual change can have both positive and adverse consequences for sustainability of the planet and its resources. Recognition of this reality by boards and internal auditing is essential. Impacts and influences on sustainability by change factors should be measured by every organization and in every internal audit engagement.  

Quality Circle/Cycle

The model's Quality circle illustrates the reengineering process that drives change and improvement in every organization and professional service, often represented by the plan-do-check-act (PDCA) cycle — a four-step management approach used in the control of processes and products. The quality management culture established by this cycle motivates change in practice, focusing on the customer through continuous improvement and innovation. Quality management is a continuous, collaborative process that requires a total commitment by every team and everyone in an organization and profession. It addresses all strategies, policies, and processes and spawns new methods, practices, products, and services in all areas it touches. It delights suppliers, customers, and everyone on the planet, and it continuously makes paradigm shifts toward excellence.

Quality Assurance is not the same as quality control. It is the confidence of knowing that all supplies, processes, products, and services are meeting customer requirements, as confirmed through measurement. It is a maturity reached through understanding quality principles, creating a quality culture, practicing quality standards, constantly measuring outcomes, and knowing the perceptions of suppliers, customers, and other stakeholders.

Continuous Improvement is not the correction of mistakes or errors. It involves building process maturity, improving economics, increasing effectiveness, and being more efficient in every operational activity and professional service, across all supply chains.

Innovation is the paradigm shift, the exploration into new practices with a sense of inspiration and imagination and a focus on improvement, creating new value for all stakeholders. Efforts are driven by competition and a desire to be at the cutting edge — to be the best. Quality and continuous improvement are mandatory for compliance with The IIA's International Professional Practices Framework. Innovation is key to the successful development of the internal audit profession and has been since 1947.

Quality, continuous improvement, and innovation touch on and impact each of the lines of the maturity model — Organization, Professionalism, and Change. Contributing to and measuring sustainability issues in the Quality Cycle is a must for every organization. Complying with the IPPF requires this for internal auditing.  

Sustainability, Today and Tomorrow

Sustainability is key to the economy, effectiveness, and efficiency of an organization achieving its objectives and to the communication relationships with all its stakeholders. In this century, more than ever before, the integration of sustainability into financial and management reporting has become a requirement in law and a priority in performance management dashboards. As well, assurance of sustainability is critical to an organization's reputation.

Sustainability is also an essential part of an organization's governance, risk management, and control, across all its supply chains — internal and external, national, and global. It should be guided by an organization's social and environmental policies, and it should satisfy the U.N.'s 10 Principles, which aims to help organizations adopt socially responsible practices. Each policy should have a direct bearing on the organization's entire decision making at board, management, and operational levels.

Over the past decade, corporate focus on sustainability has increased in almost every country in the world, driven not only by international organizations, institutes, and governments, but also many professions and standard makers. The Committee of Sponsoring Organizations of the Treadway Commission (COSO), for example, linked sustainability to the components of its enterprise risk management framework in the 2013 COSO thought paper, Demystifying Sustainability Risk (PDF). The International Integrated Reporting Council, of which IIA CEO and President Richard Chambers serves as a member, has developed a model for corporate reporting — Integrated Reporting — that helps encourage the advancement of a more sustainable global economy. Moreover, The IIA is continuing to contribute to sustainability for the global profession of internal auditing through its own standards, guides, and position papers.  

The Cutting Edge Audit Maturity Model relates well to the current importance of integrating sustainability risks, strategies, and practices into every part of an organization's operations, reporting, and assurance. From each of the model's four components, sustainable practices and assurances can be recognized, developed, and measured by every board and internal auditor.  ​​

Internal Auditor is pleased to provide you an opportunity to share your thoughts about the articles posted on this site. Some comments may be reprinted elsewhere, online or offline. We encourage lively, open discussion and only ask that you refrain from personal comments and remarks that are off topic. Internal Auditor reserves the right to remove comments.



Comment on this article

comments powered by Disqus
  • Galvanize-September-2020-Premium-1
  • Auditboard-September-2020-Premium-3