Count the carbon – why sustainability teams need internal audit support

In Climate Change 2023: Synthesis Report the UN states that “The extent to which current and future generations will experience a hotter and different world depends on choices now and in the near term” and, according to the Chartered IIA’s Risk in Focus 2024, “Climate Change, Biodiversity & Environmental Sustainability” is consistently ranked in the top ten risks facing organisations today. Rules and regulations are still evolving in different jurisdictions, but even organisations that are not yet directly required to report sustainability performance should expect to in future either in their own right or as part of a supply chain.

Internal auditors should therefore be asking:

What can I do today to help tomorrow?

How can I help my organisation handle this risk?

What choices can I make, as an auditor, to affect how future generations experience tomorrow’s world?

Unfortunately, there are no complete answers. But since taking on the role of VP of Sustainability, having until now been a chief audit executive (CAE), the lens through which I view sustainability has changed. I now like to focus my team on three key areas:  Commitment, Action and Reporting. I believe that, as a methodology for internal auditors, this helps to frame the challenge.

1. Commitment

In order to make a change, we must first make a commitment. We often make commitments at the beginning of a new year in the form of resolutions – for example, “I will go running five times a week” or “I will eat less chocolate”. But what if we made our commitments public and published them to the world, so that everyone knew what we are striving to achieve?

This is in effect what companies are doing in their sustainability reports. And the level of commitment is not trivial. Often, the commitments cover three areas roughly following the environmental, social and governance acronym (ESG). For example, an organisation might commit to reducing Scope 1 and Scope 2 carbon emissions by 50% by 2030 and 100% by 2050, or to improve employee engagement by a certain percentage by a certain year.

So, one important first step for internal auditors should be to consider how these commitments were made. Are they based on scientific evidence? Are they in line with the Paris Agreement and compatible with limiting global warming to 1.5°C? Have they been committed with the Science Based Targets initiative (SBTi), and have they been approved? One question that is often overlooked is whether they are in line with the overall strategy of the organisation (or whether the strategy of the organisation is in line with the sustainability commitments it is making)?

2. Action

This is where it all happens, and so should be an area of focus for internal audit. What are the action plans for each commitment? For example, does the organisation have a coherent, logical and scientific carbon abatement strategy that matches the commitments made? Has the organisation developed a marginal abatement cost curve to ensure that the actions taken reduce emissions in a way that is most financially beneficial to the organisation, as well as its stakeholders and society at large?

Here, it can be helpful to play the useful role of “critical friend” focusing more on advisory rather than assurance engagements to help the sustainability team especially at the early stage. If, for example, a plan has been agreed to move a fleet of vehicles to BEV or PHEV by 2030, but no actions have been undertaken by the fleet department in the given jurisdiction, then internal audit could legitimately ask “why not?”.

Likewise, an internal audit team might help the sustainability team by double-checking the logic behind the choice of actions taken and where these actions are happening. For example, if management chooses to purchase electric vehicles in a country where electricity is “dirty” (carbon intensive), this could be rightly questioned or challenged.

3. Reporting

This is perhaps the easiest and hardest area to audit.

On one level, the audit process could be perceived to be straightforward. There are standards, and auditing disclosures to standards is arguably fairly simple. If, for example, the standard requires an organisation to publish the “difference of average pay levels between female and male employees, expressed as a percentage of the average pay level of male employees”, then there must be data to support the disclosure. Obtain the data, check it and conclude on the audit step.

But there are nuances to consider as well. One of the key attributes of the new European Sustainability Reporting Standards (ESRS), which were published so that organisations could comply with the European Corporate Sustainability Reporting Directive (CSRD), is the concept of double-materiality. Broadly speaking, this requires an organisation to consider impact materiality (the impact of an organisation on the outside world) and financial materiality (the financial impact
of the outside world on the organisation). This process is hugely important, but
also hugely subjective. Apart from mandatory disclosures, how an organisation decides what is material and what is not and, therefore, what gets disclosed and
what doesn’t is largely up to the organisation itself to decide, as long as it is appropriately documented.

An internal audit team considering disclosure needs to be equipped to deal with, and challenge, this ambiguity. However, the difficulties are compounded by the fact that sustainability teams are themselves still trying to understand all the nuances, and there are critical differences between what is required by legislation and what is good corporate citizenship. Internal audit teams can hardly be expected to be experts so early in the process, and so, should initially focus on the former rather than the latter.

Add to these three steps the complications around multi-jurisdictional regulations, regulatory interoperability, differing reporting deadlines, the complications of capturing accurate data across a wide range of activities, and the internal controls required for each data set (not to mention the Sarbanes-Oxley controls required for data sets that might eventually find their way into a US filing) and you have a topic that is wide enough and broad enough to give any conscientious internal audit department a full-blown headache.

Amid the complexity, two things are certain: sustainability cannot be ignored by internal audit departments in any organisation, and actions taken today will inevitably affect how effectively sustainability departments guide their organisations to make the right choices for the future of us all. Considering in turn each element of Commitment, Action and Reporting might therefore be as good a place to start as any when planning the first internal audit engagement on sustainability.

Back to the data – a personal perspective

Until now, many organisations based their calculations of greenhouse gas (GHG) emissions in Scope 1 and Scope 2 (broadly speaking, those emissions directly created by business operations or indirectly purchased as energy to run the business) on regional managers’ estimates of the fuel used in their parts of the business around the world. This may ultimately not be good enough for internal or external assurance – under the CSRD, external auditors will need to provide “limited” and then “reasonable” assurance on sustainability disclosures, so internal audit must be confident that GHG disclosures reported by their organisations are accurate and documented, and can be tracked to source if necessary.

One way to provide this documentation is to go back to the original invoices. Often, this will mean collecting thousands of fuel and energy invoices from around the world in different formats and languages. Tabulating the data from these can be technically difficult and time-consuming.

One solution is to ask a utility or fuel billing manager to collate the data needed, another is to use artificial intelligence (AI) to parse the relevant
data into tables.

Once the quantities of fuel and energy used are known, these amounts must be multiplied by the correct carbon intensity factors – eg, the amount of carbon emitted for each litre of fuel or kWh of electricity used. This can vary significantly, according to the distance the oil or gas travels, how it is transported, how electricity is generated in each country etc, etc.

When complete, this process will provide figures for Scope 1 and 2 GHG emissions that internal and external auditors can select by region and/or year to support with relevant source data, so that disclosed figures can be traced and verified.

Organisations will face varying sustainability reporting challenges, but I believe that many will struggle to turn large quantities of information into traceable, auditable data. It’s easy to believe that disclosed data is “correct”. However, if you don’t ask the right questions about where it comes from and what it means, you might not get the full picture. The internal auditor mindset should add rigour to such processes and challenge “facts” to ensure that they are supported by robust evidence.

Most sustainability teams do not include former internal or external auditors, and can lack experience of what makes data auditable. To remedy this, sustainability teams could offer experienced internal auditors career opportunities to gain team members who understand the importance of internal controls and audit trails.

It’s worth remembering that we have been developing processes to account for cash for hundreds (possibly thousands) of years. Now we need to reach a similar level of rigour and accuracy for carbon in just two or three.

I personally foresee a day when all invoices will include the carbon cost as well as the financial cost. Sustainability-based ERP systems will automatically collect these figures and store them. Such carbon-ERP systems will need to be global to cover the entire organisation. For many years, finance teams have operated “No purchase order, no pay” policies. One day, maybe we will have “No carbon data, no pay” policies. It would make sustainability auditing much more straightforward.

Richard Brasher is Vice-President Sustainability at LKQ Corporation. The opinions in this article are his own and not those of his employer.

This article was published in January 2024.