Internal Audit and the Audit 
Committee’s Role in ESG 
Executive webinar recap  
EXECUTIVE KNOWLEDGE BRIEF

2 
Table of Contents 
 
 
 
 
Introduction ................................................................................................................................................... 3 
A need for collaboration ............................................................................................................................... 3 
Why ESG? ...................................................................................................................................................... 4 
The SOX parallels ......................................................................................................................................... 4 
Solidifying trust ............................................................................................................................................. 5 
An incomplete picture .................................................................................................................................. 5

3 
 
Introduction 
 
 
 
 
A need for collaboration 
As environmental, social and governance (ESG) issues continue to dominate the global conversation 
and increasingly become core components of the risk landscape, it can be somewhat overwhelming 
determining where internal audit fits in. The recent rule proposals from the SEC on ESG reporting are only the 
latest example of how prominent the topic has become and the importance of defining internal audit’s role.  
But not only does internal audit play a part in the ESG conversation, it should fill a critical need within the 
organization to communicate, inform, and guide how the organization navigates an increasingly ESG-
conscious world.  In the latest IIA Executive Member Webinar, a panel of thought leaders in the profession 
discussed internal audit’s critical role in ESG reporting, how these leaders work to establish the audit 
committee’s role in advancing ESG within their respective organizations, and what strategies they implement 
with their audit committees regarding ESG.

4 
 
Audit leader perspectives 
Informed responses from IIA members 
 
 
 
Why ESG? 
There is little argument that internal audit should provide assurance on the accuracy of ESG reporting. “There 
are a few core reasons why this is so important,” said Jeff Sebree, director, internal audit at Cerner 
Corporation. “First, there’s a growing focus from the SEC from a regulatory perspective. If the SEC cares, 
internal audit certainly should. This is actually a large opportunity to display value to our stakeholders. Just as 
we’ve done with SOX and ERM activities, internal audit can be there to support assurance and really usher in 
the ESG reporting dynamic. There’s just a natural fit there.”  
Sebree also noted how ESG initiatives are having a direct impact on company-wide strategy. “This might even 
be the most important reason,” he said. “This fact alone means that this needs to be audited.”  
Suri Musiri, Vice President, Internal Audit at TFI International Inc, agreed while relating it to his organization’s 
perspective. “Internal audit has the most diverse background in terms of all organizational functions including 
finance, operations, technology, etc. We touch all of them, and that gives us a prime position to provide value 
add to the company.” 
The SOX parallels 
While the topic itself is different, the panelists agreed the reporting parallels to the Sarbanes-Oxley Act of 2002 
(SOX) are impossible to ignore. Indeed, their past experiences with IT organizations and internal audit 
functions provide made-ready case studies to guide their focus and actions. 
“As far as advancing the ESG initiatives, much like SOX, the focus needs to be on establishing key 
partnerships,” said Sebree. Such partnerships include the audit committee chair, the external auditor, and the 
C-suite officer with purview over the topic. “Just as it was with SOX, there are a lot of moving parts, right now, 
and in order to be successful, coordination with the first line and all stakeholders is critical.” 
Additionally, the SOX experience provides guidance on how to structure reporting processes. According to 
Musiri, filing an ESG report is not so different from a SOX report or any other report. “Many of the processes 
align,” he said.   
“If we take a step back 20 years ago when SOX was first implemented, there was a lot of hullaballoo around 
it and its compliance and reporting requirements just like ESG today,” said Asim Fareeduddin, vice president, 
Regulatory Controls & IT Security Assurance at RELX. “Audit committees recognize this, and they know 
internal audit’s experience with frameworks. We know how to comb through those to understand what direction

5 
 
the committee needs to point. If internal audit as a trusted advisor recognizes ESG as a topic to pay attention 
to, they know they need to pay attention.”   
Solidifying trust 
Just because such relationships already exist, however, does not mean that internal audit can take them for 
granted, especially with emerging risks, such as ESG. Indeed, internal audit needs to be diligent in their 
communication to establish that the trust placed within them is warranted. 
“It’s on us to be educated on ESG and to establish our own credibility,” said Ron Pachura, chief audit executive 
at Conduent. “Partnering with our external audit group, for example, we have gathered a ton of new information 
that got us up to speed on what is trending. Internal audit has to learn not just the basics, but the nuances of 
the topic and any and all concerns stakeholders might have.” 
Another great way to build confidence in internal audit’s capabilities, said Musiri, is to take part in materiality 
assessments with upper management. “These essentially develop your company’s ESG risk profile. While 
you’re not going to cover everything, by doing so it establishes internal audit as a value add. We want to be 
that business partner.” 
This participation also extends to voluntary ESG reporting organizations may already be doing, as well as 
evaluating how effective or accurate those reports may be. This is particularly important for mitigating the risk 
of “greenwashing.” 
“This is one area where internal audit can really add value,” said Sebree. “We can help the organization identify 
what their sources of truth are. Today, you have a lot of disparate reporting processes that get accumulated 
into an ESG report. With financial reporting, you have one system of record. How are we going to do that for 
ESG? If you are thinking about that now and offering this guidance to organizations, it will go a long way to 
moving toward a system that can hold up to regulatory scrutiny.”  
An incomplete picture 
As prominent as it is, the ESG conversation is far from being complete. Indeed, environmental and 
sustainability issues tend to dominate most current ESG discussions. The other elements of ESG — the social 
and governance aspects — are likely to become the focus of regulators in the not-too-distant future. This 
means that even the most mature ESG reporting models offered by organizations cannot consider themselves 
finalized. In the short term, this means that internal audit cannot just rely on what already exists to get a 
complete view of ESG: it must also think ahead.   
“Start with the annual risk assessment and perhaps extend ESG to its own standalone risk assessment, but 
always remember that’s just the beginning,” said Fareeduddin. “The lens must always be widening.”

6 
 
 
 
 
About The IIA Executive Membership 
This knowledge brief is an exclusive benefit of The IIA Executive Membership. This membership delivers all IIA member benefits, plus exemplifies 
the preeminent membership for a high-level, seasoned internal audit executive. Members access customized tools, tailored content, and peer-to-
peer networking focused on leadership, team development, performance, and problem solving.  
About The IIA 
The Institute of Internal Auditors (IIA) is an international professional association that serves more than 215,000 global members and has awarded
180,000 Certified Internal Auditor (CIA) certifications worldwide. Established in 1941, The IIA is recognized as the internal audit profession's leader
in standards, certification, education, research, and technical guidance throughout the world. For more information, visit https://www.theiia.org. 
Disclaimer 
The IIA publishes this document for informational and educational purposes. This material is not intended to provide definitive answers to specific
individual circumstances and as such is only intended to be used as a guide. The IIA recommends seeking independent expert advice relating directly
to any specific situation. The IIA accepts no responsibility for anyone placing sole reliance on this material. 
Copyright 
Copyright © 2022 The Institute of Internal Auditors, Inc. All rights reserved. For permission to reproduce, please contact copyright@theiia.org.