Thank You!

You are attempting to access subscriber-restricted content.

Are You Ready to Experience Everything Internal Auditor (Ia) Has to Offer?

​​​​​​Shift to Sustainability

Understanding the organization’s CSR risks is the starting point for identifying areas where internal audit can add value.​

Comments Views

Did you hear it? Probably not. It came without fanfare. No bells, no whistles, no corks being popped. No one really knows exactly when the tipping point was reached. It's one of those shifts that can really only be seen clearly through the rearview mirror.

What am I talking about? It's the day sustainability became recognized as a mainstream pillar of corporate governance. The lack of fanfare in no way undermines the magnitude of the change on corporate boards throughout the world. Executives and board members are committing to measuring, managing, and disclosing their strategies for addressing the environmental, social, and governance challenges that often are core to their company's mission.

The Governance & Accountability Institute recently reported that 53 percent of S&P 500 and 57 percent of Fortune 500 companies are reporting on their environmental, social, and governance impacts through a formal sustainability reporting process. That's up from 19 percent and 20 percent, respectively, in 2011. The report goes on to state that, "Reporting on sustainability seems to increase the trust that investors, employees, and other stakeholders have in the companies that report."

Companies committing to increased transparency and accountability are being rewarded for their efforts. A global study by Massachusetts Institute of Technology's Sloan Management Review and the Boston Consulting Group in early 2013 reveals that the percentage of companies reporting a profit from their sustainability efforts rose 23 percent from the prior year, to 37 percent in 2012.

Company boards and managers on the leading edge of sustainability are shining a light on all aspects of their operations to search out innovative and practical solutions to challenging environmental, social, and governance issues. Sustainability initiatives are being pursued to differentiate market presence, attract talent, and build competitive advantages.

Understanding the corporate social responsibility (CSR) risks relative to the organization is the starting point for identifying areas where internal audit can add value to the sustainability process. The IIA's Evaluating Corporate Social Responsibility/Sustainable Developments Practice Guide (2010) provides internal auditors with a sound framework to audit risks and controls related to CSR. Many CSR risks are interrelated and may be found embedded within existing risk assessments. Risk factors to consider include:


Once an organization commits to pursuing sustainability, the performance bar is raised with regard to public perception. Noncompliance with laws, errors in disclosures, or the appearance of hypocrisy can result in an immediate stakeholder backlash.


The sheer volume and complexity of regulations related to the environment, health and safety, consumer protection, employment, conflict of interest, and fraud can create significant compliance hurdles. Failure to develop a proactive approach toward compliance may cause stakeholders to question a company's motives and destroy their trust in the organization.

Human Capital

People want to work for organizations that respect their rights, have a culture of integrity, and demonstrate a commitment to social and community concerns. Companies perceived as lacking these traits are going to find it difficult to attract the talent needed for their businesses to succeed.

Business Partners

Aligning with external business partners that do not share the same commitment to sustainability could create an exposure for the organization through "guilt by association."


Developing processes, products, or services without considering sustainability may expose the company to criticism and consumer backlash (boycotts).

Equity Markets

Socially responsible investment appears to be here to stay. Failure to pursue sustainable practices may result in financial pressure and investor discontent. It is important to understand where the organization resides within the range of sustainability development to enable internal audit to tailor activities to areas where it can add the most value (see "Levels of Sustainability," this page). For organizations in the early stages of sustainability development, internal audit can add value by incorporating CSR audit objectives within existing audit activities:

  • Assess the alignment of the organization's business and sustainability strategies. Are there inconsistencies or conflicts in approach?
  • Modify internal audit risk assessment approaches to identify sustainability risks. Are measures established to monitor risks?
  • Provide assurance as to processes in place to ensure regulatory compliance relative to sustainability issues. Can these activities be grouped and elevated to provide management with a different perspective?
  • Provide assurance over the organization's sustainability disclosures. Are processes in place to ensure information is accurate and relevant?
  • Report sustainability progress, performance, and issues to the board of directors and audit committee. Are the strategic issues related to sustainability being adequately communicated?

The definition of sustainability varies by industry and within society as a whole. However, at its core, sustainability means the same thing to everyone: to continue, to carry on, to keep going. Internal audit departments that have not ventured into this arena should consider adding CSR to their risk and planning processes. Sustainability is here to stay.Levels of Sustainability




Comment on this article

comments powered by Disqus
  • Gleim_Oct2018_Premium 1
  • IIA CERT CIA_Oct2018_PRemium 2
  • IIA CIALS_Oct2018_Premium 3