Key Considerations for Developing your ESG Audit Strategy – September 2023
Internal Audit on 
Sustainability Reporting Process

© 2023 Deloitte & Touche Enterprise Risk Services Pte Ltd
2
ESG Reporting is a disclosure of  an organisation's environmental, social, and governance initiatives and data. It allows the 
organisation to be more transparent to its stakeholders on how they manage the ESG risks and mitigation plan.
Environmental, Social, and Governance (“ESG”) Reporting
Snapshot of Singapore ESG Reporting Requirements
Compliance with SGX 
Sustainability Reporting 
requirements 
Sustainability Report Practice Note 7.6
The company should provide climate-related disclosures, consistent with the TCFD 
recommendations. If the company is under the identified industries, mandatory climate-related 
disclosures, consistent with the TCFD recommendations is required from 1 January 2023/2024 
onwards, depending on the industry type.
Sustainability Report Listing Rule 711A
Companies listed on SGX must issue a sustainability report for its financial year, no later than 4 
months after the end of the financial year, or where the issuer has conducted external assurance 
on the sustainability report, no later than 5 months after the end of the financial year. 
Sustainability Report Listing Rule 711B
The sustainability report must describe the sustainability practices with reference to the 
following primary components: (a) material environmental, social and governance factors; (aa)  
climate-related disclosures consistent with the recommendations of the Task Force on Climate-
related Financial Disclosures; (b) policies, practices and performance; (c) targets; (d)
sustainability reporting framework; and (e) Board statement and associated governance 
structure for sustainability practices. 
Any primary component exclusion requires disclosure of such exclusion and describe what it 
does instead, with reasons for doing so, except for component (aa) for identified industries 
under Practice Note 7F (e.g., financial).
Sustainability reporting process must be subject to internal review. The company may 
additionally commission an independent external assurance on the sustainability report.
Sustainability Report Practice Note 7.6.3
The Board has ultimate responsibility for the issuer's 
sustainability reporting and determining the ESG 
factors identified as material to the business and that 
they are monitored and managed. 
Management has responsibility to ensure that the ESG 
factors are monitored on an ongoing basis and 
properly managed (e.g., Sustainability, Finance, Legal, 
Strategy, Operations, Compliance teams etc)
Compliance with MAS 
Guidelines on 
Environmental Risk 
Management requirements 
Guidelines established for Banks, Asset Managers and Insurer. Guidelines coverage, 1) 
Governance and strategy, Risk Management, Disclosure (Bank), 2) Governance and Strategy, 
Research and Portfolio Construction, Portfolio Risk Management, Stewardship, Disclosure, (Asset 
Manager), 3) Governance and strategy, Risk Management, Underwriting, Investment, Disclosure 
(Insurer).
Guidelines on Environmental Risk Management
A clear allocation of responsibilities for management of 
environmental risk in accordance with the three lines 
of defence model. E.g.:
Board – Approval of framework/policy
Senior Management – Development and 
implementation of framework/ policy/ tools/ metrics
Effective 1 
January 2022
Effective 8 
June 2022
Regulatory Requirement
Regulatory Requirement Details
Responsibility

© 2023 Deloitte & Touche Enterprise Risk Services Pte Ltd
3
Snapshot of Singapore ESG Reporting Requirements (Cont’d)
Environmental, Social, and Governance (“ESG”) Reporting
Effective 1 
January 2023
Regulatory Requirement
Regulatory Requirement Details
Compliance with MAS 
Disclosure and Reporting 
Guidelines for Retail ESG 
Funds
This guidelines applies to an authorised or recognised scheme which: (a) uses or includes ESG 
factors as its key investment focus and strategy. This means that ESG factors significantly 
influence the scheme’s selection of investment assets; and (b) represents itself as an ESG-
focused scheme.
MAS has established a series of regulations designed to reduce the risk of greenwashing. 
These are laid out in the Code on Collective Investment Schemes (“CIS Code”) and the 
Securities and Futures (Offers of Investments) (Collective Investment Schemes) Regulations 
(“SF(CIS)R”) and were most recently updated in Circular No. CFC 02/2022.
Disclosure and Reporting Guidelines for Retail ESG 
Funds
The responsible person of an ESG Fund should indicate 
in the respective OPERA form 1, 2, 1-A or 2-A that the 
scheme is an ESG Fund and ensure that the Annual 
Report and additional disclosures are made as required 
under paragraph 13 & 14 of the guidelines.
1.
A digital ESG disclosure
2. Sustainable Financing 
Solution
3. Perform internal audit 
plan or gap analysis
1. MAS and SGX have launched ESGenomein September 2022, a digital disclosure portal for 
companies to report ESG data in a structured and efficient manner, and for investors to 
access such data in a consistent and comparable format. Companies are encouraged to 
use the platform to disclose and track performance of metrics that are disclosed in their 
sustainability reports or as part of their internal workflow management and tracking. 
Currently, usage of ESGenome is not mandatory. 
2. MAS would anchor sustainable finance external review, certification, assurance, and 
ratings firms in Singapore, as they would play a key role in ensuring the transparency and 
integrity of sustainable finance solutions. This would strengthen local technical capacity 
for sustainable finance-related assurance and verification.
3. Establish Sustainability Report internal audit plan.
Perform internal audit and monitor the implementation of remedial actions in response to 
the audit findings. 
Going Forward
Responsibility

© 2023 Deloitte & Touche Enterprise Risk Services Pte Ltd
4
As the pace and impact of societal and environmental disruption continues to intensify, organizations need to build 
capacity to drive ESG performance and resilience.
ESG within the Organisation
Internal audit
Integrate ESG risk and compliance considerations into the 
internal audit plan to instill discipline and enhance controls 
related to material ESG risks.
Finance
Incorporate ESG-related risks into investor 
engagement, pricing, forecasting and budgeting, 
capital-allocation and annual reporting.
Legal
Understand and manage risk and liability considerations 
elated to ESG performance – e.g., inadequate, or inaccurate 
disclosure of material financial risks.
Compliance
Broaden the integration of ESG performance 
into the existing management control 
frameworks to support compliance
around ESG risk.
Risk
Identify, manage and respond to latent and emerging ESG 
risks; integrate ESG risk capabilities into existing risk and 
control frameworks.
Strategy
Integrate ESG factors to drive innovative and brand-
enhancing strategies, including strategic choices across 
the value chain.
Communication
Optimize strategic communications to 
stakeholders to navigate changing expectations 
and credibly demonstrate prioritization and 
management of ESG risk and opportunities.
Human resources
Invest in leading practices around employee health and 
safety, diversity, equity, and inclusion, and development to 
attract, retain and incentivize talent to innovate, drive 
productivity and deliver on the business strategy.
Sustainability function
Design and activate strategies to deliver on the 
corporate strategy, purpose and ESG objectives 
to drive performance.
Operations
Prioritize and measure opportunities for cost savings, risk 
mitigation, and reputation enhancement and implement 
solutions to reduce resource inputs and wasteful outputs.
ESG

© 2023 Deloitte & Touche Enterprise Risk Services Pte Ltd
5
The Role of Internal Auditor in ESG
The role of Internal Auditor in ESG
Must consider
ESG risks that:

Affect the business and operating environment.

Have a material effect on the financial statements.
Must improve their ability to

Capture information about ESG-related matters that may affect the 
financial statements.

Assess the risks of material misstatement of the financial statements 
resulting from such matters.

Evaluate such matters to determine whether they may need to be 
reflected in the financial statemets.
ESG Audit evaluates the ESG risks of your organization’s operations. It also assess the effectiveness of your ESG initiatives; the progress you are making toward your 
corporate ESG commitments.
Internal Auditors should perform risk assessments that include obtaining an understanding of the company and its environment. Those assessments must now consider 
the potential impact of ESG risks on the financial statements.

© 2023 Deloitte & Touche Enterprise Risk Services Pte Ltd
6
Internal Audit Approach
Internal Audit 
Framework
Standalone 
reviews
Integrated 
audit 
approach
Competencies
Focused 
reviews
Some of the common approaches to integrating ESG risk and reporting in Internal Audit Plan:
•
To highlight policies, controls, and responsibilities with respect to ESG strategies as of a 
particular point in time. 
•
For example, the existence of governance structure? Are the relevant monitoring 
controls established?
Standalone 
reviews
•
For ESG areas of high stakeholder concern or low-risk appetite.
•
These deep dive reviews can provide valuable assurance in key ESG areas, to ascertain 
that individual ESG program elements are operating as they should.
•
Internal audit teams may layer in periodic checkpoints, such as six-month check-ins or 
quarterly updates, to ensure that action or mitigation plans are implemented, and issues 
are effectively remediated.
Focused 
reviews
•
This approach can be used as part of any audit as a pulse check on the business that 
provides reasonable assurance that ESG-related activities are being appropriately 
identified, considered, and documented.
Integrated 
Audit 
Approach
•
Devoting resources to research and monitor ESG regulatory guidance and updates, 
understand ESG risk and reporting trends and frameworks in your industry, and 
benchmark ESG topics in your industry.
•
Build ESG knowledge through targeted training or via certifications such as the Global 
Reporting Initiative’s Professional Certification Program or Competent Boards’ ESG 
Certificate Program.
Investing in 
ESG 
Competencies

© 2023 Deloitte & Touche Enterprise Risk Services Pte Ltd
7
Leveraging the COSO Framework for ESG Reporting
Control Environment
• Setting “control” consciousness (typically from management and the board) that guides ESG reporting objectives while setting the stage for the 
processes and discipline needed to govern controls.
• Establishing the organization’s commitment to creating structures that provide ethical, independent, sustainable, and accountable oversight of 
internal controls development and performance.
Risk Assessment
• Guiding with clear objectives that support the identification and analysis of specific ESG risks to the achievement of organizational objectives.
• Considering both internal and external stakeholder needs.
• Identifying and assessing changes impacting internal controls (e.g., regulatory changes, M&A, geographical exposures, tech rollouts).
Control Activities
• Establishing policies and procedures that effectively mitigate or manage identified ESG risks, in alignment with risk assessments performed.
• Tailoring control activity appropriately where practical.
Information and Communication
• Gathering or generating timely, relevant, and reliable ESG data to support effective functioning of internal controls.
• Verifying that appropriate performance measures (e.g., Key Performance Indicators and performance matrices) and communication processes are 
established to describe and share ESG information both internally and externally.
• Using risk assessments to guide selection of critical ESG factors to monitor and disclose.
Monitoring
• Using review activities (separate from reviews performed as control activities) to support the organization in assessing whether all COSO 
components are present and functioning.
• Employing ongoing evaluations built into business processes, periodic separate evaluations (e.g., conducted by internal audit), or independent third-
party reviews.
• Communicating deficiencies in a timely manner to those responsible for corrective action.

© 2023 Deloitte & Touche Enterprise Risk Services Pte Ltd
8
We help you become a more sustainable, resilient organization capable of delivering lasting financial and business value 
through these three areas:
Connect with Us
We help organisation to understand 
appropriate policy, control landscape, 
and responsibilities around your 
matured ESG program.
We perform an in-depth review to provide 
valuable assurance on key ESG areas, where 
stakeholders have concern, or where risk 
appetite is low.
We use this approach as pulse check on 
the business as part of any audit 
performed to ensure ESG related 
activities are being appropriately 
identified, considered, and documented.
Standalone 
reviews 
Focused
reviews
Integrated audit 
approach
Get in touch
Cheryl Lim
Executive Director
Deloitte Risk Advisory
cherylim@deloitte.com
Andy Wee
Director
Deloitte Risk Advisory
awee@deloitte.com
Victor Wong
Senior Manager
Deloitte Risk Advisory
vicwong@deloitte.com