© 2021 KPMG ASPAC Limited, a Hong Kong incorporated company and a member firm of the KPMG global organisation of independent 
member firms affiliated with KPMG International Limited, a private English company limited by guarantee. All rights reserved.
1
Why the drive for sustainable change now?
Over the years we have seen a shift in the capital markets from a focus on maximising shareholder return to 
maximising shareholder value. Organisations are responding by reporting publicly on their ESG strategies, 
commitments, actions and results. As highlighted in the Institute of Internal Auditor’s (IIA) recent white paper -
‘Internal Audit’s role in ESG reporting’,²  several key factors have emerged that are making this shift more rapid: 
Environmental considers how an 
organisation performs as a steward 
of nature. This can include issues 
related to carbon emissions, waste 
management, water management, 
raw material sourcing, and climate 
change vulnerability. 
Social examines how organisations 
manage relationships with 
employees, customers, and the wider 
community. Risks that fall under this 
category can include corporate social 
responsibility, labour management, 
data privacy, general security, health 
and safety and wellbeing. 
Governance refers to variables 
such as business ethics, board and  
leadership, executive pay, audits, 
internal controls, intellectual 
property protection, and 
shareholder rights. 
Defining E-S-G
Investor and public interest
Investors and the public are 
expecting corporates to manage the 
ESG risks in their businesses and 
also factor in the environmental, 
social and community impact of 
their initiatives. Failure to do so 
many involve reputational risks, 
financial impact, potential lawsuits 
and other legal risks. We are 
consequently seeing a shift in the 
capital markets as products and 
services transition towards more 
sustainable approaches. 
Regulation
As of 1 July 2020, a new ESG 
reporting framework was issued by 
the HKEX for listed companies which 
includes environmental and social 
KPIs to be disclosed. With a Cross-
Agency Steering Group on Green and 
Sustainable Finance launched in 
2020, more policy and regulatory 
initiatives with enhanced 
requirements on financial institutions 
and corporations regarding ESG are 
expected, especially with respect to 
climate. To this end, by 2025 TCFD 
disclosures will be mandated in the 
finance sector in Hong Kong. 
Frameworks
Although no single environmental 
standard exists, there are several 
recognised standards that provide 
market guidance on how to 
monitor, evaluate and report on 
environmental-related disclosures. 
Many organisations reference the 
frameworks in their ESG reporting. 
Whilst these frameworks are 
useful, there is a need for better 
and more accurate data as this 
information is used by 
policymakers, financial regulators 
and investors to make business 
decisions. 
As with financial reporting, the independent and objective assurance only internal audit can provide must 
be an integral part of an organisation’s ESG response. 
Internal Audit’s role in ESG 
The same but different: providing objective insights, 
assurance and advice - on ESG matters
There has been an uptick in ESG reporting worldwide, with a recent KPMG study demonstrating 
that 80% of companies now report on ESG topics.¹ Internal audit can play a critical role in providing 
objective assurance and advice on ESG reporting and sustainability matters more broadly.

© 2021 KPMG ASPAC Limited, a Hong Kong incorporated company and a member firm of the KPMG global organisation of independent 
member firms affiliated with KPMG International Limited, a private English company limited by guarantee. All rights reserved.
2
Internal Audit’s role in ESG 
The same but different: providing objective insights, assurance and advice - on ESG 
matters
Management teams across organisations are recognising the opportunities and risks ESG 
presents. This includes the due-diligence required to integrate ESG measures across any 
organisation. To make informed decisions, directors must have reliable assurance on the 
effectiveness of ESG management, including ESG governance, risk assessment, KPI monitoring 
and reporting. That assurance should come from internal audit. 
Assurance
According to the IIA2, at a minimum the internal audit 
function should provide the following assurance over 
ESG reporting; 
—
Review reporting metrics for relevancy, 
accuracy, timeliness and consistency: It is 
critical that all public ESG reports provide 
information that accurately depicts an 
organisation’s ESG efforts. This is particularly 
important as regulatory oversight and public 
scrutiny increases. 
—
Review reporting for consistency with formal 
financial disclosure filings: While ESG reporting 
provides non-financial data, any information that 
conflicts with formal financial disclosures will 
raise a red flag with investors and regulators.
—
Conduct materiality or risk assessments on 
ESG reporting: Organisations must have a clear 
understanding on how ongoing ESG efforts or 
public commitments to reaching ESG goals can 
rise to the level of materiality. 
—
Incorporate ESG into regular audit plans. 
—
Build an ESG control environment: Internal 
audit can advise on developing specific internal 
controls for ESG reporting.
—
Recommend reporting metrics: Internal audit 
can provide insights into the kind of data that 
accurately reflects relevant ESG efforts within the 
organisation.
—
Advise on ESG Governance: Internal audit can 
provide guidance on ESG governance because of 
its holistic understanding of risk across the 
organisation. 
Advisory
More broadly, internal audit can support 
management in answering relevant questions 
such as:
—
Do we have a clear view on all ESG risks, 
including compliance risk related to existing and 
forthcoming national and international 
legislation, and are those regularly re-assessed?
—
Do we have a proper ESG culture that goes 
hand in hand with our ESG initiatives?
—
Do we measure our ESG activities, based on 
KPIs linked to the ESG strategy and do we 
report in a controlled and reliable way?
Sustainability Reporting Frameworks to leverage
Global Reporting 
Initiative (GRI) is 
designed for 
disclosure on a wide 
range of ESG issues 
and topics relevant to 
stakeholders.
Sustainability 
Accounting Standards 
Board (SASB) is more 
narrowly focused on a 
selected few disclosures 
relevant to a company’s 
overall sector and is 
geared more toward an 
investor audience.
Task Force on Climate-
related Financial 
Disclosures (TCFD) is a 
more recently introduced 
reporting framework and 
is fixed solely on climate-
related financial risk.
International Integrated 
Reporting Council (IIRC) 
supports development of 
integrated reports on an 
organisation’s strategy, 
governance, performance 
and prospects in the 
context of its external 
environment.
01
02
03
04

© 2021 KPMG ASPAC Limited, a Hong Kong incorporated company and a member firm of the KPMG global organisation of independent 
member firms affiliated with KPMG International Limited, a private English company limited by guarantee. All rights reserved.
3
Internal Audit’s role in ESG 
Any internal audit activity should go beyond simply identifying risks to include identifying root 
causes, potential risk management strategies and preventive controls. It should also ensure that 
governance, risk management and internal controls are operating effectively throughout the 
organisation. 
KPMG has developed an internal audit work program combining different elements of well-known 
standards, which serve as a basis for good practices, supplemented by our internal expertise in the 
areas of internal audit and ESG. 
In their assessment, internal auditors should examine aspects that define the company’s ESG 
policy like high-level oversight, risk assessment, due diligence procedures and awareness and 
implementation actions.
Key ESG 
categories
Governance
Human rights
Labor practices
Environment
Operating practices
Customer issues
Community
Policies and procedures
—
Entity-wide policies & procedures on 
human rights, health & safety, etc.
—
Existence of relevant processes
(e.g. supply chain, production, sales)
—
Consistency between policy framework
—
Policy management
Auditing and monitoring
—
Monitoring & tracking of regulatory change
—
Transactional, process & control testing
—
Third party and employee compliance due 
diligence & management (licensing)
—
Periodic ESG Risk program evaluation
—
Involvement of 2nd & 3rdline
Issues management and investigation
—
Issues/complaints management & remediation
—
Responding to government 
investigations/exams/inspections
—
Response plan & process for investigating 
alleged non-compliance
—
Continuous improvement
Reporting
—
Periodic reporting 
to management & 
the board
—
Mandatory 
regulatory reporting
—
External reporting 
to stakeholders
—
Record keeping
ESG risks
—
Risk (& opportunity) assessment
—
Regulatory requirements
—
New product review
—
Third party due diligence
High level oversight
—
Definition of ESG
—
Mission, vision, values
& strategy
—
Periodic review by
top management
—
Context &
stakeholder
analysis
—
Time, resource
& budget
Culture & awareness
—
Engage & create dialogue 
with all the stakeholders
—
Culture/tone of ESG/ 
sustainability & behavioral 
change
—
Regular and frequent 
training & communication
Tools and data
—
Technology to support 
ESG program (testing, 
training records, etc.)
—
Predictive measures: key 
risk indicators and key 
performance indicators
—
Root cause analysis & 
tending
KPMG internal audit 
methodologies
ESG
risk

Internal Audit’s role 
in ESG 
How can KPMG help?
KPMG has profound experience and a 
tested methodology to deliver solutions 
across the spectrum of internal audit as 
well as ESG advisory services. 
We differentiate ourselves by our 
Flexible methodology
KPMG’s internal audit methodology is flexible and can 
be tailored to each company’s specific needs. This can 
range from examining aspects that define the 
company’s ESG policy like high-level oversight, risk 
assessment, due diligence procedures and awareness 
to the ESG policy’s implementation and quality, 
consistency and reporting aspects. 
Expertise
Our team of subject matter professionals, with 
expertise in internal audit as well as ESG has the skills 
and knowledge to provide innovative internal audit 
services that meet varied needs across a wide range of 
industries.
Multidisciplinary approach.
We have access to a wide range of competencies within 
KPMG. Our experienced and highly qualified core team 
can always appeal to appropriate Subject Matter 
Professionals within the KPMG network as needed. In 
addition, KPMG can serve as a one-stop-shop and 
support organisations with the implementation of 
possible points of improvement brought forward by the 
internal audit.
Source 1: “The Time Has Come: The KPMG Survey of Sustainability Reporting 2020,” Executive Summary, KPMG, December 2020, 
https://assets.kpmg/content/dam/kpmg/xx/pdf/2020/12/the-time-has-come-executive-summary.pdf. 
Source 2: “Internal audit’s role in ESG reporting’ The Institute of Internal Auditors, Lake, Mary FL, 2021. https://global.theiia.org/about/about-internal-
auditing/Public%20Documents/White-Paper-Internal-Audits-Role-in-ESG-Reporting.pdf
Contact us
Pat Woo 
Partner, KPMG China and Global 
Co-Chair, Sustainable Finance,
KPMG IMPACT
T: +852 3927 5674
E: pat.woo@kpmg.com
Alva Lee 
Partner, Head of Governance, 
Risk and Compliance Services, 
Hong Kong
T: +852 2143 8764
E: alva.lee@kpmg.com
Erik Bleekrode 
Partner, Head of Insurance KPMG China and 
Asia Pacific
Hong Kong 
T: +852 2826 7218
E: erik.bleekrode@kpmg.com
Jens Kessler 
Director, Governance, Risk and Compliance 
Services, Hong Kong
T: ++852 2143 8584
E: jens.kessler@kpmg.com
© 2021 KPMG ASPAC Limited, a Hong Kong incorporated company and a member firm of the KPMG global organisation of independent member 
firms affiliated with KPMG International Limited, a private English company limited by guarantee. All rights reserved.
The KPMG name and logo are registered trademarks or trademarks of KPMG International.
The information contained herein is of a general nature and is not intended to address the circumstances of any particular individual or entity. 
Although we endeavour to provide accurate and timely information, there can be no guarantee that such information is accurateas of the date it is 
received or that it will continue to be accurate in the future. No one should act on such information without appropriate professional advice after a 
thorough examination of the particular situation.
kpmg.com/cn/socialmedia