ACHIEVING EFFECTIVE INTERNAL CONTROLOVER SUSTAINABILITY REPORTING (ICSR):
Building Trust and Confidence through the
COSO Internal Control—Integrated Framework

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKTABLE OF CONTENTS
Nonauthoritative, Interpretative Publication.....................................................................................................4
Preface by Two Previous COSO Chairs: The Call to Action............................................................................5
Executive Summary....................................................................................................................................................6
Definitions....................................................................................................................................................................8
Acknowledgments......................................................................................................................................................9
Recommendations: Building Trust and Confidence in Sustainable Business Information.................... 11
Background............................................................................................................................................................... 16
What Is COSO?............................................................................................................................................................. 17
ICIF-2013: The Basics................................................................................................................................................... 19
Applying ICIF-2013 to Nonfinancial Information......................................................................................................... 20
Sustainable Business Information: Goals and Users.................................................................................................... 21
Regulatory Bodies and Standard Setters that Oversee ESG Reporting..................................................................... 24
ESG: Types of Sustainable Business Information........................................................................................................ 25
Delivery of ESG Reporting........................................................................................................................................... 26
Differences between Conventional Financial Reporting and Sustainable Business Information............................... 28

Applying the ICIF-2013 Principles to Sustainability: Building Internal Control overSustainability Reporting (ICSR)............................................................................................................................ 32
Component: Control Environment.............................................................................................................................. 34
1. Demonstrates commitment to integrity and ethical values............................................................................... 34
2. Exercises board of directors’ oversight responsibilities..................................................................................... 38
3. Establishes structures, authority, and responsibilities........................................................................................ 42
4. Demonstrates commitment to competent human resources............................................................................ 45
5. Enforces accountability...................................................................................................................................... 47
Component: Risk Assessment..................................................................................................................................... 50
6. Specifies suitable objectives.............................................................................................................................. 50
7. Identifies and analyzes risks to meeting sustainable business objectives......................................................... 56
8. Assesses fraud risk............................................................................................................................................. 61
9. Identifies and analyzes significant changes and emerging trends.................................................................... 65
Component: Control Activities.................................................................................................................................... 69
10. Selects and develops control activities............................................................................................................ 69
11. Selects and develops general controls over technology................................................................................. 72
12. Deploys oversight through policies and procedures....................................................................................... 78
Component: Information and Communication............................................................................................................ 82
13. Uses relevant information............................................................................................................................... 82
14. Communicates internally................................................................................................................................ 86
15. Communicates externally................................................................................................................................ 89

2

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKTABLE OF CONTENTS(Continued)
Component: Monitoring Activities............................................................................................................................... 93
16. Conducts ongoing and/or separate evaluations............................................................................................ 93
17. Evaluates and communicates deficiencies..................................................................................................... 96
Principles in Action: Illustrative Cases......................................................................................................................... 98
Illustration: A publicly held organization subject to disclosure regulations considers its reporting agenda......... 99
Illustration: A privately held supplier begins its sustainable business journey................................................... 101
Illustration: A publicly held organization continues its evolution toward reasonable assurance........................ 103

Top 10 Takeaways................................................................................................................................................ 105
Biographies............................................................................................................................................................ 106
Sources.................................................................................................................................................................... 108

3

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

Originally formed in 1985, COSO is a joint initiative of five private-sector organizations and isdedicated to helping organizations improve performance by developing thought leadershipthat enhances internal control, risk management, governance, and fraud deterrence. COSO’s
supporting organizations are the American Accounting Association (AAA), the American Instituteof Certified Public Accountants (AICPA), Financial Executives International (FEI), the Institute ofManagement Accountants (IMA), and The Institute of Internal Auditors (IIA).

NONAUTHORITATIVE, INTERPRETATIVE PUBLICATIONThis report is nonauthoritative. It expresses only the interpretations, opinions, andperspectives of the authors on how the COSO Internal Control—Integrated Framework
may apply to sustainable business activities and information.
Copyright © 2023, Committee of Sponsoring Organizations of the Treadway Commission (COSO).

COSO BOARD MEMBERS
Lucia WindCOSO Chair

Daniel C. Murdock
Financial Executives International

Paul J. Sobel
COSO Chair (2018-2022)

Larry R. White
Institute of Management Accountants

Douglas F. Prawitt
American Accounting Association

Jeffrey C. Thomson
Institute of Management Accountants (2018-2022)

Jennifer Burns
American Institute of CPAs

Patty K. Miller
The Institute of Internal Auditors

For more information, please visit www.coso.org.

4

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKPREFACE BY TWO PREVIOUS COSO
CHAIRS: THE CALL TO ACTIONW

hen first issued in 1992, the Committeeof Sponsoring Organizations of theTreadway Commission (COSO) Internal
Control—Integrated Framework was focused ontrying to resolve unprecedented, unexpected, andembarrassing fraudulent corporate financial reporting.
Tarnished by these events, the sponsoring organizations
banded together to try to heal their bruised reputations,mitigate these events, and develop a solution so that
corporate fraudulent financial reporting would neverreoccur. With the appointment and leadership offormer U.S. Securities and Exchange Commission (SEC)
Commissioner James C. Treadway Jr., they did so in
the form of defining internal control and laying out aconstruct and model for all organizations of any size to
use in order to develop and evaluate internal control,a key term that surprisingly had not been formally welldefined in the past. Unfortunately, however, regulation
to require the evaluation and reporting on internal
control was proposed but not approved.
Fast-forward to 2000. Fraudulent corporate financial
reporting crept back onto the landscape with numerous
restatements and destruction of enterprise value atlevels never seen before. This time, however, the U.S.
Congress and SEC acted more decisively. As part of the
Sarbanes-Oxley Act of 2002 (SOX) and formation of the
Public Company Accounting Oversight Board (PCAOB),
an evaluation of internal control over financial reporting(ICFR) by using a “suitable framework” became required,to which the 1992 COSO framework qualified. Today, theframework is essentially the only such suitable frameworkused by U.S. stock exchange companies to report on theeffectiveness of ICFR through a management certification
and, for large companies, additional external auditor
assurance of ICFR.
A major revision and update to the 1992 edition
occurred from 2011 to 2013 and culminated in

the release of the revised 2013 Internal Control—
Integrated Framework. The 2013 version is the mostwidely used internal control framework to meet therequirement of SOX Section 404 and reporting on
ICFR. It has been translated into most of the languagesof the major stock exchange countries.
An important modification in the 2013 edition wasto eliminate the word “financial” from the reporting
objective to expand the scope and application of theframework to all forms of reporting, which the revised
version defines as internal, external, financial, andnonfinancial. One reason for this modification was
the clear recognition in 2013 of additional corporate
reporting already occurring in the form of enhanced
regulatory reporting, corporate social responsibility,
corporate citizenship, sustainability, and now, mostrecently, reporting on environmental, social, andgovernance (ESG), which reflects both financial andnonfinancial information with the lens of preservationof resources, performance, and value creation.
As past COSO chairs involved in the development
and dissemination of the 2013 revised Internal
Control—Integrated Framework, we are pleased
to see the realization of the modifications made toincrease the applicability to all forms of reporting and,in particular, to sustainability and ESG reporting. We
are both thoroughly convinced that the use of the 2013
framework for sustainability and ESG reporting will
greatly enhance the overall effectiveness, efficiency,
and accuracy of the underlying processes and internal
controls as well as the accuracy of this reporting.
Sustainability and ESG reporting now seem to havebecome a permanent expansion of corporate reporting
all over the world to better meet the needs of multiple
stakeholders in understanding the sources of enterprisevalue. Accordingly, there should be effective internal
control over this reporting. •David L. Landsittel

Robert B. Hirth Jr.

COSO Chair, 2008-2013

COSO Chair, 2013-2018

5

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKEXECUTIVE SUMMARY

E

ffective internal controls are good forbusiness.
This is perhaps an interesting way tointroduce the purpose of this thought paper, but,as its authors, our collective knowledge is verystraightforward in this regard. Internal controls
have value beyond compliance and externalfinancial reporting. Effective internal controls canhelp an organization articulate its purpose, set its
objectives and strategy, and grow on a sustained
basis with confidence and integrity in all types of
information.
The Committee of Sponsoring Organizationsof the Treadway Commission (COSO) Internal
Control—Integrated Framework, originallyissued in 1992 and refreshed in 2013 (ICIF-2013
or Framework), was developed as guidance tohelp improve confidence in all types of dataand information. We cite from the Framework’s
foreword, dated May 2013:• The Framework will enable organizations todevelop and maintain systems of internal control
that can enhance the likelihood of achieving theorganization’s objectives and adapt to changes
in the business and operating environments
effectively and efficiently.
• The Framework continues to emphasize theimportance of management judgment indesigning, implementing, and conducting
internal control, and in assessing theeffectiveness of a system of internal control.
• The Framework has been enhanced byexpanding the financial reporting category ofobjectives to include other important formsof reporting, such as nonfinancial and internalreporting.
We believe that this expansion is inclusive ofsustainable business information. Often referred
to as “nonfinancial,” “balanced scorecard,”“performance dashboard,” “environmental, social,and governance (ESG),” “integrated,” or “impact”
data, this information is accelerating in importanceas organizations seek to improve their enterprise
performance and relationships with stakeholders,both local and global. Given the increasing
complexities and challenges of doing businessin the world today, organizations are doing so inorder to generate sustained value—ethically andresponsibly—over the longer term. Companies
are improving their performance management
systems to have reliable data for decision making.
Meanwhile, investors and rating agencies aroundthe world are increasingly seeking and relying
on sustainability performance data. So, there is aneed among all stakeholder groups for effective
controls and oversight so that this information ishigh-quality and fit for purpose: decision making inthis changing world.
Whether the 1992 or 2013 version, the COSO
Internal Control—Integrated Frameworks(collectively ICIF) are holistic. An organization’s
entire integrated system supports how it achieves
its objectives, and effective external ESG reporting
rests on the totality of these enterprise-wide
processes. Moreover, rather than bright-linedifferentiation, the substance of the respective
components, principles, and points of focus
overlap. Indeed, as the title indicates, the intention
is integration.

The Road to ICSRThis paper updates and expands on the 2017
study Leveraging the COSO Internal Control—
Integrated Framework to Improve Confidencein Sustainability Performance Data, which wascoauthored by Robert H. Herz, Brad J. Monterio,
and Jeffrey C. Thomson, who received invaluable
input and counsel from then COSO Chair Robert
Hirth. That paper advocated for greater integration
between sustainability and finance teams as an
essential driver of the path forward to improved
internal and external reporting on sustainability
and enhanced data quality for management ofsustainable business issues. While some of thepeople and companies interviewed for the 2017
paper embraced that premise and had started to
implement processes and internal controls in this6

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

area, our overall sense was that most companies
had not yet begun the journey.
Fast-forward to 2023. From our interviews forthis publication, we perceive a sea change inattitudes since 2017. With sustainability and ESG
reporting now having become a top area of focus
for CEOs, senior management, boards, investors,
regulators, customers, and other stakeholders, wefind that many more companies are now in various
stages of implementing controls and governanceprocesses over the collection, review, andreporting of sustainability information, including
creating multifunctional teams that bring together

a company’s sustainability, finance and accounting,risk management, legal, and internal audit
professionals. So, akin to internal control overfinancial reporting (ICFR), we are now seeing the
emergence of what we call internal control oversustainability reporting (ICSR). While organizations
are at different stages in this process, the needto bring together people with experience andexpertise in the many dimensions of sustainablebusiness with people experienced in ICFR
continues, in our view, to be an essential elementof successful design and implementation of ICSR
and management of sustainability issues. •7

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKDEFINITIONS
Without precise, generally accepted definitions, many people conventionally use variations of the term“sustainability” or “ESG” interchangeably. Following this convention and without bright-line definitions,in this publication, we generally use the following terminology:
Sustainability: meeting the needs of the present
without compromising the ability of future
generations to meet their own needs.

transactions, and sustainable business management
refers to the means by which an organization
directs and oversees its sustainable businessactivities and reporting.

Sustainable business: the activities andtransactions that an organization conducts toachieve long-term survival as a going concern
and concurrently deliver value that meets the
expectations of all stakeholders that contributeresources for the organization to achieve its
objectives. Following from this, sustainablebusiness information and sustainable business
reporting mean the data or information that reflects
an organization’s sustainable business activities and

ESG: an acronym for environmental, social, andgovernance. Often, this term is used synonymouslyor as a shorthand for sustainability or sustainablebusiness to refer to the internal and external
information value chain. More narrowly andwithin, this term is used generally to describe theconstructs of external disclosure of categories ofsustainable business information to investors andother stakeholders. •8

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKACKNOWLEDGMENTS
The COSO board acknowledges the six coauthors of this publication. This publication would not havebeen possible without their dedication, expertise, and contributions.
Robert B. Hirth Jr.
Senior Managing Director, Protiviti

Managing Editor and Coauthor
Shari Helaine Littan
Director of Corporate Reporting Research andThought Leadership, Institute of Management
Accountants

Douglas Hileman
President, Douglas Hileman Consulting, LLC
Brad Joseph Monterio
Global Executive Vice President, Member
Competency & Learning, The Institute ofInternal Auditors

Coauthors
Robert H. Herz
Former Chairman of the Financial AccountingStandards Board; original member of theInternational Accounting Standards Board;
former board member, Sustainability AccountingStandards Board Foundation

Jeffrey C. Thomson
President and CEO, Institute of Management
Accountants

The authors appreciate the input of all contributors to our research and publication, including:
Brigitte de Graaff
Assistant Professor, Researcher, and CMA Program
Director, Vrije Universiteit Amsterdam; Chair, IMA
Sustainable Business Management Global Task ForceCharles Mario Abela
Senior Strategic Advisor, Value Balancing AllianceSanjay Anand
Chairperson and CEO, Sarbanes Oxley Group LLC

Jim DeLoach
Managing Director, Protiviti

Liz BarzelattoVice President and Chief Auditor, IBM Corporation

Michal P. Dusza
Partner, KPMG

Jared Brandman
Senior Vice President, General Counsel, andSecretary, National Vision

Aaron Gagnon
Partner and Chief Audit Officer, McKinsey &Company

Hank BoernerChairman and Chief Strategist, Governance &Accountability Institute

Manpreet Grewal
Corporate Vice President, Controller, and Chief
Accounting Officer, United States Steel

Debbie Biddle-Castillo
Managing Director, Advisory Services, Internal Audit,
KPMG

Janine Guillot
Former Special Advisor to the International
Sustainability Standards Board Chair; former CEO,
Sustainability Accounting Standards Board and Value
Reporting Foundation

Kevin Dancey
CEO, International Federation of Accountants

9ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

Jeffrey Hales
Member, International Sustainability Standards
Board
Maura Hodge
IMPACT Audit Leader, KPMG
Patti Humble
Chief Accounting Officer, UPS
Loreal Jiles
Vice President, Research and Thought Leadershipand Global Head of DE&I, Institute of Management
Accountants
Paul Juras
Vander Wolk Professor of Management Accounting
and Operational Performance, Babson College
Robert King
Corporate Vice President and Chief Audit Executive,
FedEx Corporation
Tjeerd Krumpelman
Global Head of Reporting, Regulations &Stakeholder Management, ABN AMROMark LaMonte
Partner, WilliamsMarston LLC
Michael Littenberg
Partner and Global Head of ESG, CSR, and Businessand Human Rights, Ropes & Gray LLP
Gina Mastantuono
CFO, ServiceNow

Christopher McClure
Partner, ESG Services Leader, Crowe LLPTim Mohin
Partner and Director, Boston Consulting Group;
former CEO, Global Reporting Initiative
Kevin O’Connell
ESG Trust Solutions Practice and Global Asset &Wealth Management ESG Leader, PwC
Ivor O’Neill
Managing Director, Risk Services, KPMG
Edward Olson
Partner, National Leader, Environmental, Social,and Governance, MNP LLP
Kristin Proos
Director, Global Finance Strategy and ESG
Reporting, Whirlpool Corporation
Marc Siegel
Assurance Partner, Corporate and ESG Reporting
Thought Leader, Ernst & Young LLP
Kristen Sullivan
Partner, Global Audit and Assurance Sustainability &Climate Services Leader, Deloitte
Marty Vanderploeg
Nonexecutive Chair, Workiva
Larry White
Executive Director, Resource Consumption
Accounting Institute10

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

Recommendations: Building Trustand Confidence in Sustainable
Business InformationAs the discussion, insights, and illustrations make clear, applying effective internal controls tosustainability information for internal and external purposes constitutes a rapidly growing use ofexisting risk and control concepts. Few best practices have been established. While some larger
institutions have progressed in building controls around environmental, social, and governance (ESG)
reporting, many organizations have designed ad hoc controls around certain key sustainable businessmetrics. Many also perform internal verification and assurance procedures to ensure management
comfort with this information. Yet few of them seem to have developed effective, integrated systems
of internal control over their material or decision-useful sustainable business information. There is an
expectation among policy makers, investors, and other stakeholder groups that some organizations will
be able to achieve reasonable assurance, rather than limited assurance, on their external disclosuresrelating to climate and other ESG risks. All organizations, and particularly professional accountancyorganizations, are on a learning and growth journey to build trust and confidence in sustainablebusiness information for internal and external decision making. A good starting point for implementing
internal control over sustainability reporting (ICSR) is the process and ecosystem of the Committeeof Sponsoring Organizations of the Treadway Commission (COSO) Internal Control—Integrated
Framework—originally issued in 1992 and refreshed in 2013 (ICIF-2013 or Framework)—with a key
addition, the concept of organizational commitment to integrity and purpose, which is an important
aspect of sustainability (see Figure R-1: Flow of Internal Control Framework).

FIGURE R-1: FLOW OF INTERNAL CONTROL FRAMEWORKCommit tointegrity/purpose

Determine
objectives

Evaluate
effectivenessBased on Leveraging the COSO
Internal Control—Integrated
Framework to Improve Confidencein Sustainability Performance Data

Identify andassess risks

Identify control
activities

11

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKThis framework creates five action points:
1. Commit to integrity by stating your purpose: One of the key elements of beginning a sustainablebusiness program is the articulation of an organization’s purpose and commitment to acting withintegrity. In many cases, an organization can look to its existing mission statement and values. In othercases, however, it may prove beneficial to consider a broader perspective: the reason that stakeholders
contribute their precious resources to an organization and what they expect in return.
2. Determine objectives: The organization establishes, documents, and communicates internal andexternal sustainable business objectives and establish measurement and reporting principles for specificsustainable business factors with sufficient detail that they may be applied properly and considered inassessing potential risks in the process of preparing sustainable business data.
3. Identify and assess risks (and consider opportunities): To identify significant risks, the organization
evaluates the relevant qualitative and quantitative risk factors—for example, those that might result ina misstatement—that are reasonably likely to jeopardize the achievement of its sustainable businessobjectives. This includes a determination of the extent of the risk and whether and how it may be
managed. Moreover, one of the key benefits of developing and implementing sustainable businessinitiatives is highlighting means for turning risks into strategic opportunities, such as reduced waste,enhanced stakeholder engagement, and improved resource deployment.
4. Identify control activities: With an understanding of the risks to achieving sustainable businessobjectives and the processes that underpin the measurement, management, and reporting of the data,
the organization identifies specific control activities to manage a risk or mitigate it to an acceptable level.
5. Evaluate effectiveness: Having established internal control over sustainable business activities and
ESG disclosures, the organization can regularly evaluate system design and operation to determine
whether or not the Framework components and principles (see Background) are present andfunctioning.
As some examples in this paper illustrate, applying ICIF-2013 as a systematic, consistent framework
to the achievement of an effective system of internal control over sustainable business activities andreporting can result in a variety of benefits, including:• Alignment of an organization’s employees, partners, and stakeholders with its commitment to purpose
and articulated objectives.
• Enhanced data quality, utility, comparability, and reliability.
• Strengthened ability to support operations and compliance objectives.
• Better-informed decision making by internal management, external investors, and other stakeholders.
• Enhanced understanding of risks and the ability to mitigate them.
• Greater overall market efficiency.
• Increased access to and lowered cost of capital.
These benefits are most likely to accrue to organizations that have aligned their sustainable businessobjectives with their business strategies and focused on the issues most likely to contribute toperformance and value preservation and creation.

12

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKAligning External Reporting and Internal Benefits
Delivering Internal Benefits
Metrics related to key sustainability issues can provide organizations with business intelligence tosupport internal decision making and the management of performance and impacts. In reviewing its
management of key sustainable business information for internal reporting objectives, an organization
may wish to consider the following factors related to its data governance and management practices(this does not represent a comprehensive list of considerations, but rather an attempt to highlight certain
key aspects of such an assessment):• Does the organization’s creation, collection, validation, storage, use, archive, and deletion ofsustainable business-related data assets adhere to its data governance policy or strategy to support
responsible management?
• Is relevant, reliable sustainable business information integrated into existing management reporting
systems, processes, and reports? If so, is management actively using this information to run its
operations? If not, why not?
• Is data lineage (the connection to original sources) maintained throughout information systems andthe supply chain?
• Does the organization leverage technology to establish and maintain data lineage, access information,and connect to source data? If not, can it readily do so?
• Are relevant connections and dependencies maintained and preserved between sustainable businessinformation and other types of information?
• How often is key sustainability data collected? Can it be collected and reported internally in a timely
and cost-effective manner?
• Is decision-useful sustainable business information integrated into the key analyses supporting
management decisions, such as those related to resource allocation, product development, mergers
and acquisitions, compliance, and risk management?
• Are employee and supply chain partner incentives aligned with the organization’s sustainable businessobjectives, such as service and product development? Is product design in accordance with demands
around sustainability from customers throughout the distribution chain?
• Do the reports have meaning and usefulness beyond compliance with financial reporting standards
and support management decision making on the deployment and use of resources so that theorganization produces results and achieves its purpose?

Delivering External Benefits
Meanwhile, the same information can provide decision-useful disclosures for external users, such as
investors. In reviewing its data management practices for key performance indicators (KPIs) specific toexternal sustainability reporting objectives, an organization may wish to consider the following factors(this is not intended to be a comprehensive list):• Is key sustainability information integrated into existing reporting systems? If not, can it be readily
incorporated? Or can effective controls be built around current or other reliable systems and platforms?
• Have consistent, formal policies been established across the organization to help ensure reliable
sustainability data collection, validation, analysis, and reporting/communication?
• Has the organization established and communicated clear ownership of and accountability for thecollection, validation, and reporting/communication of key sustainability information and implemented
means for intervention and correction toward the achievement of established objectives?

13

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK• Are the organization’s sustainability reporting/communication processes well documented, including
controls to prevent or detect misstatements? Are they aligned with other external communication
channels for consistency?
• Have internal audit, the compliance team, the CFO team, and relevant third parties such as an external
assurance provider (if required or deemed beneficial) been engaged to review the quality of key
sustainability information, supporting processes, and the system of internal control?
• Is there confidence in data quality? Would a CEO or CFO feel enabled to sign a certification withconfidence?
To realize both internal and external benefits of an effective system of internal controls over sustainablebusiness reporting for both internal and external users, data lineage and governance is critical. KPIs andtransactional data for financial and ESG/sustainable business decision support and reporting must be
governed in a holistic and integrated data architecture. Today, much financial reporting data is likely to
be structured, housed in the general ledger systems, and flowed through enterprise resource planning(ERP) processes. ESG and sustainable business information, on the other hand, tends to be longerterm and more qualitative, with data sources both within and outside of the organization’s systems,
and considerable estimation and data modeling are required. At the same time, operations teams may
have access to specific data that is highly actionable for correcting deviations. It is extremely valuable totranslate and connect financial information, operational data, and sustainable business information. This
integration supports not only ESG reporting but also internal decision making.

Key Takeaways: Stakeholder Goals around Sustainability
A number of key themes—and important top takeaways—have emerged as organizations begin orcontinue their journeys toward establishing and maintaining an effective system of internal control overfinancial and sustainable business information. Despite the fact that ICSR is not well established inpractice, crucial insights can be gained from the experiences of those organizations that are leading theway for others, including:• Cultivate a culture of accountability: For internal control over sustainable business informationand performance data to function effectively, it is essential that everyone involved in the collection,
validation, management, and communication of sustainability information understands the strategic
significance of organizational performance on key issues as well as the critical importance of effective
controls to ensure that decision makers have access to reliable information about that performance.
• Revisit the interrelationship of purpose and various objectives: One of the primary means foran organization to use sustainable business concepts and practices strategically is to consider—andreconsider—how its stated mission or purpose drives its objectives. As ICIF-2013 demonstrates, it isimportant for an organization’s objectives, whether financial, nonfinancial, compliance, operational,
internal, or sustainable business to be balanced, harmonized, and understood throughout theorganization. Effective controls begin by considering this balance.
• Establish a cross-functional team: Assembling and educating a cross-functional team can be avaluable early step to start the integration process. Such a team provides diverse perspectives andsubject matter expertise in assessing sustainability-related issues, metrics, and controls. Organizations
may wish to draw from a diverse set of departments, including finance and accounting; sustainability;
environmental, health, and safety (EH&S); risk management; internal audit; investor relations; strategy;
operations; information technology (IT); compliance; human resources; and legal. Some organizations
might even consider inviting key value chain partners to participate.

14

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK• Leverage existing expertise: It’s important to keep in mind that ICSR is a new application of triedand-true concepts from control over financial information, and the CFO team has already developed
considerable expertise in applying these concepts. The team has experience and understanding—notjust with internal control but also with data measurement, management, reporting, and analysis—
and it is well positioned to drive the design, establishment, and maintenance of internal control oversustainable business information. In addition, operations teams have valuable insights into how anorganization is actually producing the goods and services that are being delivered. Over time, CFO
teams can help educate and train other organizational functions on how to ensure their sustainability
data achieves the same quality and credibility as financial data and how it can be integrated moreeasily into ongoing performance management and the periodic external reporting cycle.
• Leverage existing controls: Internal control over some sustainable business information may require
the establishment of new processes and new controls. Yet the processes that already exist as partof internal control over financial reporting (ICFR) may be modified and applied to sustainability
information. For example, automated controls built into IT platforms, data governance policies, or
established monitoring techniques can be leveraged in the design and development of the control
system over sustainability data.
• Leverage enabling technologies and platforms: Technologies may carry risks, such as business
continuity risks related to system failure, security risks related to cloud-based data storage, andintegration risks associated with “ripping and replacing” systems. Yet organizations consider how theymight adapt existing or emerging technologies to establish and maintain an effective system of internal
control over sustainable business information. The systems around sustainable business information
are often immature and depend on spreadsheets with few formal controls. By incorporating thisinformation into IT platforms with well-established controls, an organization can significantly improve
decision-maker confidence in data that has previously been measured, validated, managed, andreported outside the formal financial control environment.
• Focus on decision usefulness: Organizations may be reluctant to establish internal control oversustainable business information due to many factors, not the least of which is the sheer volume ofdata that might be covered—for example, the dozens (or, in some cases, hundreds) of KPIs that are
typically included in a sustainability report. Such an undertaking could involve a significant amount oftime, effort, and cost. Traditionally, prioritizing information by its importance is captured by the concept
of “materiality” (see Principle 6 for discussion). By viewing sustainability through the lens of decisionusefulness, an organization can focus on covering a small subset of metrics that are most important to
its success over time by reducing risk and contributing to growth and value creation.
• Start early: It can take time to design and refine a system of controls that fully supports reporting
objectives, so it’s important to begin the conversation sooner rather than later.
Each of these lessons is likely to prove more valuable to an organization that has integrated its
sustainability practices and business strategy. Just as an entity’s control environment provides thefoundation for effective ICFR, it is also an essential starting point for designing, implementing,and maintaining an effective system of internal control over decision-useful sustainable businessinformation. •15

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

BackgroundS

ustainability is multidisciplinary. The professionals needed to bring sustainability to an organization
have different backgrounds and areas of expertise. While some have significant familiarity withinternal control systems, they may lack familiarity with sustainability. Others may have expertisein public policy or corporate social responsibility but lack the background in developing sophisticatedgovernance and reporting systems. Further, sustainability means the involvement of participants from a
range of other areas, such as legal, human resources, facilities, operations, and investor relations, all ofwhom may lack understanding of COSO and reporting systems.
The goal of this publication is to provide a valuable means for facilitating this interdisciplinary
cooperation. As noted throughout, ICIF is holistic. While it indeed supports the development andexecution of ICFR, it explains “how to” support the operationalizing of sustainability throughout anorganization.
As a result, many readers will find this Background section helpful in providing context andunderstanding the Framework.
Nearly every modern global company issues some form of external reporting on sustainability. Somecompanies issue reports to comply with newly adopted or proposed regulations and securities markets
listing requirements (see Figure B-1: Disclosure of ESG Information). Where not mandated, companies
are issuing sustainability reports voluntarily to respond to stakeholder demands.

FIGURE B-1: DISCLOSURE OF ESG INFORMATION

Scope of Reporting and Assurance
Reporting:
Most companies reported
some information on GHG,
other environmental, social,and governance sustainability
matters. 89% of companies
provided information in all
four of the ESG categories
examined in this study.

GHG

92%

Other Environmental
98%

Social96%

Governance95%

All Topics
89%

Source: The State of Play in Reporting and Assurance of Sustainability Information: 2019-2020 Data & Analysis

Sustainable business information from these reports, as well as from individualized questionnaires andcommercial ratings, are readily delivered to investors, policy makers, and a range of stakeholders throughmodern software applications and platforms. Such information has become part of the data used in
the competition for capital—particularly from institutional investors such as asset managers, insurancecompanies, and lenders with long-term horizons. At the same time, by articulating corporate purpose andobjectives, companies are integrating sustainable business information with traditional performance metrics
to identify and respond to risks, identify and realize opportunities, and create effective strategies for value
preservation and creation over the short, medium, and long term. Organizations and their key stakeholders

16

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

recognize that making effective business and investment decisions requires information beyond traditional,
historic, short-term financial measures.
However, significant concerns remain regarding the nascent systems that are producing this decisioncritical information. This raises the fundamental question: How can the ecosystem generate accurate andreliable sustainable business information that meets the dynamic needs of diverse stakeholder groups?

What Is COSO?
COSO refers to the Committee of Sponsoring Organizations of the Treadway Commission, which ismade up of five global accountancy and auditing organizations: American Accounting Association (AAA);
Association of International Certified Public Accountants (AICPA); Financial Executives International(FEI); Institute of Management Accountants; and The Institute of Internal Auditors (IIA) (see Figure B-2:
Sponsoring Organizations). COSO was founded in 1985 in response to regulatory and market concerns
about the quality of financial reporting. Today, these five organizations continue to work collaboratively
under the COSO partnership.

FIGURE B-2: SPONSORING ORGANIZATIONSIn COSO’s earliest days, the five organizations sponsored the National Commission on Fraudulent
Financial Reporting (Commission), a nongovernmental initiative that included representatives from
corporations, audit firms, investment firms, and the New York Stock Exchange. The Commission’s firstchair, James C. Treadway Jr., general counsel of Paine Webber, was particularly passionate about thequality of financial information and the need for potential reform. In 1987, the Commission issued a setof recommendations that highlighted the need for a workable framework to address internal controls—asystem of governance, processes, and oversight—that produced relevant and reliable financial information.
Ultimately, in 1992 (with some revisions through 1994), COSO published its first framework, called theInternal Control—Integrated Framework. The publication made two giant steps forward. First, it provided
a definition of “internal control.” Second, it provided a common framework for evaluating and improving
internal control systems. The goal of issuing this framework was to support various professionals infinancial reporting with common language and concepts.
Later, ICIF became a premier tool for operationalizing and implementing the Sarbanes-Oxley Act
of 2002 (SOX), which gave both the U.S. Securities and Exchange Commission (SEC) and the PublicCompany Accounting Oversight Board (PCAOB) responsibility to issue interpretive regulations for
implementing SOX’s provisions, many of which were novel.1 The PCAOB describes its authority “toestablish auditing and related professional practice standards for registered public accounting firms tofollow in the preparation of audit reports for public companies, other issuers, and broker-dealers.”
With respect to annual report filings, these new requirements for public companies under the SEC’s
1
This publication does not offer legal advice. Any references to legal and regulatory matters in this publication are for educational and descriptive
purposes.

17

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

authority included:• A report by management that assesses how well ICFR is functioning, commonly known as SOX Section
404(a), and• An auditor’s report attesting to management’s report, commonly known as SOX Section 404(b).
Formally, the SEC did not mandate use of ICIF, but instead mandated the use of a suitable frameworkthat satisfies four suitability criteria to operationalize SOX’s assessment standards.2 Professionals withresponsibilities for compliance with SOX look to ICIF for guidance. Therefore, the Framework, while notmandatorily imposed by the SEC, may be considered “generally accepted.”

FIGURE B-3: EVOLUTION OF ICIF

e
nc
ia
pl
m

Information & Communication

Unit A
Unit B
Activity 1
Activity 2

Monitoring

Control Activities

2013 COSO Cube

Co

pe

O

ns

io

t
ra

F
Re inan
po ci
rt al
in
g

1992 COSO Cube

Risk Assessment
Control Environment

Source: COSO materials

In 2013, COSO released an updated framework (ICIF-2013) that superseded previous versions
and became the operative document (see Figure B-3: Evolution of ICIF). The updated Framework
incorporates a risk-based approach to designing, assessing, and reporting on internal controls. In
addition, the update responded to the evolution of audit procedures and critiques because the original
formulation was sometimes inadequate for practical, real-world preparer and audit challenges. ICIF-2013endured and remains a gold standard framework regarding internal control, oversight, and governanceof information used not only for external reporting but also for sustainable business management.
Although ICIF-2013 generally finds its roots in the United States, it is also used internationally, incountries such as Japan, Canada, and China, where there are similar mandates to SOX for internal
control assessment and reporting. Multinational companies that must file with the SEC look to ICIF-2013
and apply its well-accepted concepts and principles to units operating around the world.

2
Final Rule: Management’s Report on Internal Control Over Financial Reporting and Certification of Disclosure in Exchange Act Periodic Reports
states that a suitable framework must (1) be free from bias; (2) permit reasonably consistent qualitative and quantitative measurements of a company’s
internal control; (3) be sufficiently complete so that those relevant factors that would alter a conclusion about the effectiveness of a company’s internal
controls are not omitted; and (4) be relevant to an evaluation of internal control over financial reporting.

18

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKICIF-2013: The Basics
ICIF-2013 defines internal control as follows:Internal control is a process, effected by an entity’s board of directors, management,
and other personnel, designed to provide reasonable assurance regarding the achievementof objectives relating to operations, reporting, and compliance.
ICIF-2013 is comprised of five components:• Control Environment• Risk Assessment• Control Activities• Information and Communication• Monitoring Activities
Following from the definition of internal control, the model provides three categories of objectives:operations objectives, reporting objectives, and compliance objectives. The interaction of the objectives
and the components leads to the iconic diagram that demonstrates ICIF-2013 as a cube (as shown in
Figure B-3). The cube is further subdivided to correspond to the way entities are typically organized.
These categories are the levels of entity, division, operating unit, and function.
Each of the five components contains two to five principles, for a total of 17 principles. These makeup the heart of the Framework in describing how effective internal controls can be operationalized. An
organization has achieved an effective system of internal controls when all principles are present andfunctioning. As shown in Figure B-4: Components, Principles, and Points of Focus, each principle isfurther subdivided into points of focus that explain how the principle works in practice. Generally, the

FIGURE B-4: COMPONENTS, PRINCIPLES, AND POINTS OF FOCUS
Components

Principles

No. of Points of Focus

1. Commitment to integrity and ethical values
2. Independent board of directors oversight
3. Structures, reporting lines, authorities, responsibilities
4. Attract, develop, and retain competent people
5. People held accountable for internal control

4
4
3
4
5

6. Clear objectives specified
7. Risks identified to achievement of objectives
8. Potential for fraud considered
9. Significant changes identified and assessed

15
5
4
3

10. Control activities selected and developed
11. General IT controls selected and developed
12. Controls deployed through policies and procedures

646

13. Quality information obtained, generated, and used
14. Internal control information internally communicated
15. Internal control information externally communicated5
4
5

16. Ongoing and/or separate evaluations conducted
17. Internal control deficiencies evaluated and communicated73

Source: Protiviti

19

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

points of focus help the user interpret and apply the Framework’s principles to the organizational levels.
Through its components, principles, and points of focus, ICIF-2013 provides a comprehensive roadmap for handling sustainable business activities and information.

Applying ICIF-2013 to Nonfinancial Information
Corporate reporting teams, regulators and standard setters, investors, policy makers, and otherstakeholders have been responding to vocal and active demands for sustainable business information.
Initially, this information was termed “nonfinancial” for multiple reasons. First, the information wasfor reporting outside the basic financial statements and notes to the financial statements so that theterm “nonfinancial” distinguished information that was not part of an annual report subject to audit. In
addition, the term reflected the fact that some of the metrics, indicators, and qualitative descriptions ofsustainable business information were not monetized. For example, corporate reporting of greenhousegas (GHG) emissions typically follows the GHG Protocol, which generally calls for information-basedcarbon dioxide equivalents rather than dollars. Similarly, corporate reporting under the category ofdiversity, equity, and inclusion (part of the “S” in ESG as it addresses social inclusion and the value ofhuman resources) is based on percentages of representatives from specific demographic groups, such as
the percentage of women on a board of directors. This information is nonmonetized or nonfinancial.
As various stakeholders showed increased interest in sustainable business information, COSO
responded by issuing materials that expressly endorsed the use of ICIF-2013. COSO incorporated theterm “nonfinancial” directly into the 2013 Framework. In addition, with respect to applying its Enterprise
Risk Management—Integrating with Strategy and Performance framework (ERM Framework), COSO
delivered two publications:• Demystifying Sustainability Risk: Integrating the triple bottom line into an enterprise risk
management program• Enterprise Risk Management—Applying enterprise risk management to environmental, social andgovernance-related risks
These publications demonstrate how the ERM Framework can be interpreted and applied to support
an organization’s sustainable business strategy that it carries out through its internal control system(Principle 7).

20

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

Sustainable Business Information: Goals and Users
Following global drivers for sustainable development, organizations around the world are reconsidering
their activities and producing new information.

FIGURE B-5: OCEAN TOMO INTANGIBLE ASSET MARKET VALUE STUDY

Source: Ocean Tomo, Intangible Asset Market Value Study

A key goal is to provide information that utilizes a broader perspective of resources and resource
contributors than under traditional financial accounting and reporting. Under mainstream generally
accepted accounting principles (GAAP), internally generated intangible value is not reported on thefinancial statements; yet by 2020, it grew to comprise more than 90% of market value (see Figure B-5:
Ocean Tomo Intangible Asset Market Value Study). A broad range of stakeholders, from management
to investors, look at this disparity between market value and book value and realize that the sourcesof this value need to be identified and managed not only to avoid impairment but also to leverage it
for additional future value creation. Otherwise, it can readily be wasted before an entity can realize it.
Management needs tools to understand how this value arises and its relationships with various resource
contributors, such as loyal customers, employees, vendors, long-term committed investors, and thecommunity who expect to benefit from their relationships with the entity.
Groups other than investors are relying on corporate information to understand how a reporting
entity’s transactions, operations, and activities impact external stakeholders, such as policy makers
that speak for communities—both local and global—and the people and natural resources that they
represent.
As with any type of corporate reporting, it is beneficial to identify the “user,” the shorthand term for the
professionals and organizations that will consume the information. By 2022, in the U.S., $8.4 trillion (12.6%)

21

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

of assets under management reflected sustainability investing (see 2022 Report on US Sustainable
Impact Investing Trends). As with mainstream financial reporting, much of the ESG information isdelivered to capital markets.
Within the ESG world, it has been recognized that not all users can be considered the same. Indeed,
there are short-term traders and investors (or even programmed investing) that aim for short-term
pricing disparities and help streamline the markets and keep them functioning. There are also plenty ofshort- and medium-term investors who aim to hold particular instruments for one to two years with theobjective of trading as conditions change. However, over the last 30 years, as investors began to rely on
401(k) and similar retirement vehicles, many asset managers have taken a longer-term view regarding
investee activities. Their asset owners—future pensioners and retirees who direct their own funds—often
hold underlying investments for decades. The use of index funds and exchange-traded funds (known asETFs), moreover, makes it challenging for long-term asset managers to trade out of companies that arepoor performers, slow decision makers, or fail to innovate. And these long-term asset managers, suchas State Street, Vanguard, BlackRock, and pension funds from California to New York and throughout
Europe, have been at the forefront of bringing about demands for corporate information regarding
climate risk and other sustainable business concerns.
As long-term, committed investors seek ESG information as part of their decision making, other users
along the information value chain have increased their demands for ESG information. For example,
stock exchanges in varied geographic regions, such as Johannesburg, Amsterdam, Singapore, and Hong
Kong, have all published guidelines on ESG reporting by listed companies, according to the Sustainable
Stock Exchanges Initiative. This list isn’t exclusive to the exchanges housed in developed economies,
such as NASDAQ. Exchanges in developing countries see ESG requirements as a means for ensuring
global investors that they are giving due attention to concerns about risk.
Rating agencies, data aggregators, data platforms, and similar investor service providers have grownin prominence in the ESG world. Partly because there is a lack of generally accepted reporting standards
and regulations, these companies’ business models depend on delivering ratings, rankings, andassessments of publicly listed companies. Many have developed their own proprietary models to create
these ratings. Perceiving a lack of uniform reporting by corporate entities under voluntary guidelines,
these data providers and financial services firms often seek to supplement their modeling by requesting
information via survey or questionnaire from individual companies. Examples of these surveys include
MSCI, S&P Dow Jones, and Morningstar Sustainalytics. CDP, a noncommercial organization, has also
served as a premier collector of corporate data related to GHG emissions, climate strategy, and water
management. CDP also has a system of awarding ratings that are widely used. While voluntary, many
corporations make submissions to these surveys a high priority because their data and ratings will appear
on the dashboards of many investors.
Interest in sustainable business information, however, is not limited to capital markets. It reflects therange of stakeholders interested in an organization’s use of valuable resources in a way that meetsdiversified performance expectations (see Figure B-6: Who Uses Sustainable Business Information?).
Policy makers are also demanding new types of corporate reporting around sustainability-related
issues. Many EH&S and occupational data points have been reported to regulators for decades, but now,
sustainable business and financial reporting are connecting to a greater extent than in the past. This isleading to the issuance of new and proposed regulations and standards around sustainable business
reporting.
Increasingly, customers—another category of stakeholders—are looking for sustainable businessinformation. Large commercial buyers are seeking internal information from their suppliers so that thebuyers, in turn, can tell consumers and their business buyers that the sourced goods and services are22

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKFIGURE B-6: WHO USES SUSTAINABLE BUSINESS INFORMATION?

Capital markets• Long-term investors(asset managers,
passive investments)• Stock exchanges• Data aggregators/
rating companies• Proxy advisors

Public policy entities• Governments• Regulators• Nongovernmentalorganizations

Board of directors
Senior management

Who Uses
Sustainable
Business
Information?
Customers

Suppliers• Commercial buyers• End users

Employees

Source: Authors/IMA

sustainable. The buyers are responding to their own stakeholders as they commit to overall reductions in
GHG emissions and waste, and avoidance of human rights issues, such as modern slavery or child labor.
Many employees also seem increasingly interested in their companies’ policies and practices regarding
major environmental and social issues. Some are refusing to work for a company with policies orpractices they find concerning.
An organization’s management as well as its board of directors are important users of sustainablebusiness information for internal decision-making purposes. Access to quality information for internaluse, as previously described, is critical to decision making. Additionally, information about tangible
and intangible resources and the stakeholders who contribute them is necessary for managing anorganization as a whole, ongoing enterprise.

23

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKRegulatory Bodies and Standard Setters that Oversee ESG Reporting
ESG reporting is moving from voluntary to mandatory. That is, increasingly, reporting regulations andstandards are being proposed by securities regulators, governments, and standard-setting bodies.
In the U.S., the SEC oversees the delivery of required information from publicly listed companies.
With respect to the financial statements of registrants, the SEC has designated the Financial AccountingStandards Board (FASB) to issue substantive generally accepted guidance, but the SEC can direct
or overrule the FASB’s work. Thus far, the FASB has largely taken the position that much of the ESG
information today relates to sections of an annual report (Form 10-K) outside of the financial statements
and notes, and, therefore, setting disclosure mandates is the SEC’s remit. However, as accounting for
ESG items evolves, it is likely that more items will indeed relate to the basic financial statements. This will
likely include accounting for environmental credits and offsets, impairment of tangible and intangible
assets due to physical and transitional climate-related risks, and financial instruments with links to ESG
metrics.
The SEC also has jurisdictional oversight of the PCAOB, which oversees audit firms that examine thefinancial statements of publicly held companies. To the extent that the SEC adopts new reporting around
ESG, the information reported in a filer’s Form 10-K, even if it’s within the unaudited sections, must be
consistent with information provided in the financial statements.
Outside the U.S., more than 140 jurisdictions have adopted the International Financial ReportingStandards (IFRS; see Who uses IFRS Accounting Standards?). Although IFRS is issued for global
use, the actual standards are adopted on a jurisdictional basis. For example, Canada, Japan, and theNetherlands have each adopted IFRS for reporting entities within their authority.
In 2021-2022, the IFRS Foundation, which oversees the International Accounting Standards Board(IASB) that issues IFRS, established the International Sustainability Standards Board (ISSB) to address
sustainable business reporting (see Figure B-7: Organization of the IFRS Foundation, IASB, and ISSB).
As its initial work, the ISSB released two proposed standards, IFRS S1, General Requirements forDisclosure of Sustainability-related Financial Information, and IFRS S2, Climate-related Disclosures.
These proposals incorporate existing voluntary standards, such as the GHG Protocol, the Sustainability
Accounting Standards Board (SASB) standards, and the Recommendations of the Task Force on
Climate-related Financial Disclosures (TCFD). These guidelines have been adopted, to some extent,
by many entities for voluntary external reporting. Importantly, although this standard setting seeksconnectivity between sustainable business and financial reporting as a priority, much of that connectivity
was vague or unexplained in the initial proposals. It is expected that the IASB and the ISSB will work
collaboratively in issuing standards so that the corresponding effects can be considered.
The first of the voluntary reporting standards were developed in the 1990s and issued by the Global
Reporting Initiative (GRI). Generally, the GRI states that its standards use a “multistakeholder” approach.
In recent years, GRI has clarified that this concept means an impact accounting approach that makes theeffects of an entity on external stakeholders its primary goal. GRI’s approach aligns well with the United
Nations Sustainable Development Goals (SDGs), which aim to operationalize national commitments tosustainable development and contributions to progress by individual organizations.

24

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKFIGURE B-7: ORGANIZATION OF THE
IFRS FOUNDATION, IASB, AND ISSBInternational Financial Reporting Standards (IFRS) Foundation

International Accounting Standards Board (IASB)International Sustainability Standards Board (ISSB)
Value Reporting
Foundation (VRF)International Integrated
Reporting Council (IIRC)

Climate DisclosureStandards Board (CDSB)

Sustainability AccountingStandards Board (SASB)

Source: IMA
Note: SASB merged with the IIRC in 2021 to become the VRF. Subsequently, in 2022, the IFRS Foundation acquired the VRF, along with the
CDSB, as it organized the new ISSB.

The European Commission adopted its Non-Financial Reporting Directive (NFRD) in 2014. The
NFRD required member states to transpose new ESG-related disclosure requirements into nationallaw by 2016. Taking a step further in 2019, the European Green Deal was introduced. This sweeping
initiative provides a set of interrelated climate, energy, transport, and taxation policies to reduce GHG
emissions and, in turn, strengthen the European economy.3 Following from the initiatives, the European
Commission aimed to update the NFRD with a more comprehensive Corporate Sustainability Reporting
Directive (CSRD) and designated its European Financial Reporting Advisory Group (EFRAG) to issue
standards to operationalize the proposal.4 These European authorities are seeking to incorporate an
impact accounting approach under the CSRD.
In its December 2021 report, the G7 Impact Taskforce, which is advising the G7 leaders on ways
to increase the mobilization of capital to address climate change and other global environmental andsocial issues, including enhancing the transparency and integrity of reported ESG information, strongly
supported the mission of the ISSB to create a common global baseline for reporting sustainability
information and further urged the rapid development of standardized methodologies on impact
valuation that would enable reporting of impacts in monetary terms. To that end, in July 2022, theInternational Foundation for Valuing Impacts (IFVI) was established to bring together existing impact
valuation initiatives by the Harvard Impact-Weighted Accounts Project and the Value Balancing
Alliance and to coordinate with other efforts in this area such as that of the Capitals Coalition.

ESG: Types of Sustainable Business Information
In the 1990s, John Elkington, considered by some as the father of modern sustainable business
reporting, coined the term “triple bottom line,” which is also referred to as the “3 P’s”: people, planet,and profit. His metaphor suggests the interrelationship of financial, environmental, and social concerns.
As part of the European Green Deal, the European Commission adopted the European Union Taxonomy Regulation (Taxonomy), which provides classification rules for the labeling of activities and investments as “sustainable.” Related to this, under the Sustainable Finance Disclosure Regulation (SFDR),
certain entities (primarily financial institutions) must disclose information regarding their operations and portfolios in alignment with the Taxonomy.
4
In 2001, when the IFRS Foundation and IASB were founded, the European Union, working with the business community, established EFRAG toprovide it technical advice on accounting and reporting matters.
325

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

Similarly, and regardless of the particular framework employed, sustainable business information
generally falls into one of three categories: environmental, social (human resources), and governance(see Table B-1: ESG Topics).
• Environmental information includes considerations of GHG emissions, the use of water, the release ofwaste, and the use of other natural resources such as forests. It addresses not only the use of energy
and physical resources but also the transformation of the economy and value chain. The movement of
economic actors from fossil fuel-dependent assets, operations, and investments to those with low orzero emissions creates risks (and opportunities) to existing value. For example, companies that produce
diesel fuel trucks (and their input parts) need to consider potential impairment risks to their assets andexpected value (that is, both tangible and intangible, even if unrecognized) as their customers andcompetitors look to electric vehicles.
• Social refers to resources or value contributed through relationships with humans. There are many ESG
data points, metrics, indicators, and disclosures that relate to human resources (or synonymously “humancapital” or “human capital resources”). These include information about employee turnover, diversity,and training. It can also include the protection of personal data that an organization collects. In 2020,
the SEC adopted new regulations that require disclosures concerning human capital resources that arematerial to an understanding of a registrant’s business (see Release No. 33-10825, Modernization ofRegulation S-K Items 101, 103, and 105). For example, healthcare, financial services, and technology
entities are highly dependent on access to skilled professionals with expertise. For certain sectors, suchas pharmaceuticals, it also includes human-related outcomes and risks from product safety. The “S”
category also includes the organization’s role and influence in areas such as human rights.
• Governance refers to how an organization executes its transactions and manages its business.
This includes business ethics, such as anti-bribery and anti-corruption. Some would also categorize
compliance with data security and privacy protection as part of this category. In addition, an
organization’s established processes for internal and external audits demonstrate a commitment togood governance and oversight and that activities are conducted responsibly.
Of course, these are not bright-line classifications. Some sustainability items can be classified in
multiple categories. For example, anti-bribery and anti-corruption can represent a “social” issue, ameans for promoting equitable access to resources and opportunities; at the same time, it might beconsidered a governance issue for board and audit committee oversight.

Delivery of ESG Reporting
As noted previously, companies are releasing sustainable business information to multiple parties, in
multiple formats, via multiple channels.
Certain information may be released in annual reports, such as on Form 10-K or Form 20-F (for nonU.S. filers). In fact, many disclosures that can be classified as sustainable business information overlap
with current disclosure requirements. For example, Commission Guidance Regarding Disclosure
Related to Climate Change states that information relating to the effects of climate change is subject toreporting on Form 10-K.
A great many reporting entities elect to issue sustainable business information pursuant to the United
Nations SDGs, SASB, TCFD, GRI, and the Integrated Reporting Framework of the former International
Integrated Reporting Council (IIRC) separately from their regulatory filings and annual financial reports.
Companies electronically post their sustainable business reports on their websites. Many also submit to
CDP. Data aggregators and rating agencies strip information from these reports and make it available via
complex investor platforms, such as Bloomberg or Refinitiv. However, much of the information issued bydifferent reporting entities is not directly comparable for multiple reasons, including the lack of uniform,

26

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKTABLE B-1: ESG TOPICS
Environmental

SocialGovernance

Biodiversity

Community relations

Anti-bribery and anti-corruption

Climate change

Data privacy

Anti-fraud

Deforestation

Diversity, equity, and inclusion

Corporate board, structure

Energy use

Education and training

Data protection

Extreme weather

Employee compensation and benefits

Executive compensation policies

GHG emissions

Employee engagement

Regulatory compliance

Landfill

Health and safety, product use

Shareholder rights and engagement

OceansHealth and safety, production

Transparency, disclosure

Recycling

Human rights

Whistleblower policy

Soil healthModern slavery

Transportation

Opportunities for meaningful work

Water management

Union rights

global standards. At the same time, companies today build business models that utilize unique strengths
and positions, and competition is unlike the days when products and services were more commoditizedthan they are today.
The gathering and aggregating of data (sometimes referred to as “scraping”), however, occurs
not only from annual reports and company websites. ESG information can show up on an investor’s
dashboard from a variety of sources, such as other regulatory filings, environmental reports, legal
databases, employee rating sites, and reports of nongovernmental (NGO) organizations.
Critically, a publicly held entity in the U.S. is subject to anti-fraud securities rules for all of theinformation that it releases, even if it is released for some other purpose than a securities filing. For
example, a healthcare company that misstates known dangers from a particular pharmaceutical or
medical device can be held responsible for investor losses even if the misstatement is in anotherregulatory report or part of a product release (Securities Exchange Act of 1934; SEC Rule 10b-5). This isimportant to remember when considering sustainable business reporting and internal controls.
By 2020, nearly every global company was issuing some form of external reporting on sustainability.
The Governance & Accountability Institute, which monitors the pervasiveness of ESG reporting bylarge public companies, reported that by 2021, 96% of the S&P 500 and 81% of the Russell 1000
published sustainability reports (see Figure B-8: 11-Year Track Record of S&P Reporters).

27

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKFIGURE B-8: 11-YEAR TRACK RECORD OF S&P REPORTERS
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021

20%
53%
72%
75%
81%
82%
85%
86%
90%
92%
96%

Source: 2022 Sustainability Reporting in Focus: Examining 2021 trends of companies on the S&P 500®+ Russell 1000 ®

Differences between Conventional Financial Reporting and Sustainable BusinessInformation
Although market demand for sustainable business information continues to rise steadily, internal
stakeholders (management, staff, and board members) as well as external stakeholders (asset managers,
asset owners, and policy makers) often do not have the same level of confidence in the reliability, utility,and quality of currently available information that they have in traditional financial data.
Some of these concerns follow from the somewhat different qualities of sustainable businessinformation and reporting. As demonstrated in Figure B-9: Three Attributes of ESG Reporting that
Differ from Financial Reporting, Douglas Hileman has summarized this into three categories: control vs.
influence; quantitative vs. qualitative; and historical vs. forward-looking. More specifically:• Control vs. influence: There are unresolved differences regarding the setting of organizational boundaries
between financial reporting and sustainability frameworks. Financial accounting principles define a“consolidated entity” and detail how to account for minority investees. Depending on the framework or
standards, however, sustainability reporting may be based on different concepts of “control” or “influence”(Principle 3 and Principle 12). As rules and standards evolve, alignment may follow.
• Quantitative vs. qualitative: Because the goal is to estimate and assess expectations of ongoingavailability of resources and stakeholder willingness to make these resources available, sustainability
information is inherently more qualitative than traditional financial reporting. The goal is to produce
information so that users may assess short-, medium-, and long-term future performance andexpectations that relate to an ultimate enterprise value (or going concern value).
• Historical vs. forward-looking: Sustainability information can be more forward-looking and long-term
than financial information as organizations set goals and targets. Traditionally, financial accounting restedon the summarization of past transactions and events. Over time, however, reporting evolved to reflecteconomic expectations and estimates of the future. At its heart, sustainability is about wise use andpreservation of resources over the long term. Long-term sustainability targets and goals inform businessobjectives. Further, communicating long-term goals and targets sets the stage for future reporting on theachievement of targets. The process of estimation is the same, but the time horizon is longer.

28

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKFIGURE B-9: THREE ATTRIBUTES OF ESG REPORTING THATDIFFER FROM FINANCIAL REPORTING

CONTROLQUANTITATIVEHISTORICAL

INFLUENCEQUALITATIVE/
NARRATIVE

FORWARDLOOKING

Boundaries

Judgment

Expectations andestimates

Courtesy Douglas Hileman Consulting, LLC

In addition to these inherent differences, the drivers around sustainable business information raise
additional challenges:• Voluntary reporting ecosystem: Even the companies that issue reports generally do not follow asingle set of uniform standards. Instead, they have been selecting aspects of different guidelines, suchas SASB, TCFD, GRI, and the SDGs. This fragmentation makes the development of information andreporting systems challenging.
• Acceleration toward regulation: Enacted and proposed legislation, regulation, and listing
requirements are coming to the forefront. In addition, regulatory authorities, such as the SEC, areincreasing their oversight of filings even under existing regulations. This movement brings a morestructured approach and the input of legal counsel and compliance professionals.
• Novel data streams: Much of the information that a company needs to gather for ESG reportingand management of sustainability initiatives has never been gathered, summarized, and analyzed.
Examples are numerous. Many companies did not gather information on GHG emissions, water use,
employee turnover, diversity, waste management, and energy sourcing and usage. Or, if they didgather this information, it was with the narrow objective of complying with local laws or regulations andnot for disclosure in securities filings.
• Talent availability and competence: Local operating units may not have the resources or competence
to support the gathering of new types of data. Alternatively, they may respond with apprehension
regarding new metrics of performance oversight. Members of remote teams may resist strongly if they
do not understand the purpose of these new demands for information or if the requests are seemingly
unsupported by management.
• Immature systems and unstructured data: Largely, the IT solutions for financial reporting are
mature. They incorporate information technology general controls (ITGC) and follow well-defined andconsistent processes with the goal of supporting an independent audit. Much of the data is structured.
It comes from systems that identify information from its source, through processing, and results indetailed reports on sales, receipts, purchases, payments, inventory, and plant assets. With respect tosustainable business information, at many companies, generally, comprehensive systems are not yet
in place and data comes from a variety of sources, including spreadsheets and email. It does not flow

29

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

from technology solutions that have built-in data controls. There is much hope that these will develop
in a way that produces information that is useful not only for ESG reporting but, as importantly, forinternal decision support.
• Proliferation of reporting platforms and software services: Along with new reporting demands,
commercial providers have been entering the space to provide reporting platforms and tools. However,some preparers find that these standardized approaches are inadequate for their organizations’ uniquedata and information streams. And, as professionals in the finance, internal audit, governance, risk, andcompliance functions become increasingly part of sustainability reporting teams (that is, the sustainablebusiness information value chain), they instill attention to data quality and internal controls. Many ofthese reporting professionals, however, have had disappointing results with some of these platforms.
Yet others are finding that some of the platforms incorporate many of the same desired features andfunctionalities as their financial and regulatory reporting systems and thereby can help instill good
controls and oversight systems, including documentation and review, by relying on the system’s ability
to track data. However, if poorly used, these platforms can create even more challenges.
• Sustainability reporting relies on third-party data: A good portion of sustainability accounting
relies on gathering, assessing, and reporting on information sourced from third parties. GHG Protocol
accounting, for example, calls for Scope 1, Scope 2, and Scope 3 accounting, depending on the sourceof emissions (see Figure B-10: Overview of GHG Protocol Scopes and Emissions across the Value
Chain).5 The impact accounting approach favored by certain sustainability advocates also depends on
information from external sources, including government and NGO statistics. This raises concerns frompreparers, compliance professionals, and auditors on the quality and reliability of externally sourced
data on which a reporting organization relies.
• Demands for external assurance: Users of sustainability information are seeking the comfort
that third-party independent assurance provides in the financial reporting arena. They want similar
assurance that the information that a company issues externally results from rigorous oversightsystems—both internal and independent—that they have come to rely upon from financial
reporting. Today, certain types of information that is now considered under the ESG umbrella, suchas environmental data, is audited before submission to agencies. However, as more sustainability
information is delivered via general corporate reporting such as Form 10-K, voices are becoming louder
in seeking independent assurance and moving from limited assurance to reasonable assurance (which
also provides opportunities for feedback on process effectiveness; see Principle 15, Principle 16, andPrinciple 17). This demand is being reflected in the proposed rules and regulations. For example, theSEC’s proposed rules regarding climate-related disclosures call for larger accelerated filers to obtain
limited assurance for Scope 1 and Scope 2 emissions disclosures within one year of adoption and an
additional two-year period to obtain reasonable assurance.
All of these items make the interpretation and application of ICIF-2013 a practical challenge forprofessionals who are now part of the sustainable business information value chain. These include
management, operational teams, financial reporting teams (preparers), internal audit, compliance teams,
and independent auditors. Yet taking steps to do so furthers the delivery of relevant, reliable, complete,and unbiased information so that management, investors, business advisors, and other stakeholders canmake informed decisions about the use of precious resources.

GHG Protocol; see Management Accountants’ Role in Sustainable Business Strategy: A Guide to Reducing a Carbon Footprint.

5

30

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKFIGURE B-10: OVERVIEW OF GHG PROTOCOL SCOPES AND
EMISSIONS ACROSS THE VALUE CHAIN

Source: GHG Protocol

Although new corporate ESG measures may seem novel, in many ways, they follow the traditional
information flows of other types of corporate information. These key differences between mainstream
financial reporting and sustainable business information, as addressed previously, highlight the needfor organizations to consider data strategy and data governance. ICIF-2013, particularly the Control
Environment component and the Information and Communication component, supports the means
for addressing these concerns (see Recommendations). While this represents a challenge, it also
represents an opportunity. •31

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

Applying the ICIF-2013 Principles
to Sustainability: Building
Internal Control over Sustainability
Reporting (ICSR)

I

n this section, each of the 17 principles in ICIF-2013 is explained and interpreted for application tosustainability. It follows the following format:• Each principle is cited directly from ICIF-2013. Then, it is explained and stated as it may apply tosustainability.
• Each point of focus is cited from ICIF-2013. Then, each is explained and stated as it may apply tosustainability.
• Insights bring forward information on how the principles are being considered and implemented,
either directly or indirectly, through new and proposed regulations, evolving professional standards,
and organizational practices. They reflect a review of authoritative and thought leadership materials
along with the authors’ extensive interviews with professionals with a variety of relevant backgrounds.
These points also reference selected,
publicly available ESG reports. In sum, theseinformational insights reflect the views of
the various stakeholders who affect how
Sustainability information isan organization responds to the drivers forincreasingly integrated into investor
sustainability by considering its processes.
decision making, along with
As illustrated in Figure P1-1: Innovating ICSR,
the components, principles, and points of focus
traditional financial data. This meansinterrelate. Therefore, certain explanations andsustainability information needs toinsights may relate to multiple principles in a way
be reliable and prepared withthat indicates overlap. This integration is part ofinternal control processes and board
the design of ICIF-2013.
governance and oversight, similar
The work begins with commitment, authority,
and accountability and continues throughout theto the processes used for financial
process as foundational themes. The organization
data.
considers objectives and reconsiders them on an
ongoing basis. From there, it considers risks to—Janine Guillot, former Special
meeting its objectives and how to counter themAdvisor to the Internationalwith systems and processes that are monitored
Sustainability Standards Boardfor effectiveness. This facilitates the fundamental
Chair; former CEO, Sustainability
goals of delivering complete, accurate,
Accounting Standards Board andreliable, and decision-useful information for all
Value Reporting Foundation
stakeholders.

32ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKFIGURE P1-1: INNOVATING ICSRCOMMITMENT, AUTHORITY, ACCOUNTABILITYOBJECTIVES

CO

D
E
U CIS
SE IO
FU N
L

Identifies and assesses risk

M
PL
ET
E
Selects and develops
control activities

AL

LY
ER

LY

U
CC

BL

N

A

RA
TE

M
O
ST

LI

CU

RE

PUBLICSEC

AL

N

I NT ER

Monitoreffectiveness

A

E

EXTER

Communicates
OPERATIONS|REPORTING

33|

COMPLIANCEACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

Component: Control Environment
1. Demonstrates commitment to integrity and ethical values
The organization demonstrates a commitment to integrity and ethical values. (ICIF-2013-1)
An organization furthers its objectives by demonstrating to its stakeholders that it is trustworthy and actsin the public interest. An entity demonstrates its commitment to acting sustainably.

POINTS OF FOCUS
 ets the tone at the top
S
An organization’s actors look to how seniorleadership behaves, speaks, acts, and directs
others to act.6 Senior leadership can prioritize
and facilitate the building of respect towardbuilding a sustainable business. Senior leaders
can influence conduct and performance by
behaving as role models.

 valuates adherence to standards of conduct
E
Organizations establish a system or processes toassess whether its actors are complying with its
established values and policies, including thosethat apply to values and policies that support
the organization’s efforts to act sustainably.
This means developing oversight processes,
including internal audit review, if appropriate.

 stablishes standards of conduct
E
Organizations establish standards of conduct
for their actors. Often, an organization, at its
highest levels, operationalizes its mission or
purpose through a values statement. These
values are then further operationalized withsustainable business programs and policies thatare communicated throughout the organization.

 ddresses deviations in a timely mannerA
An organization follows up when an actor(or group) diverges from its policies aroundsustainable business management andreporting. This is effectuated throughcommunications and follow-up with the
purpose of correcting course and supporting
improvement and development.

INSIGHTS
Purpose of a corporation: Today, thought leadership in management and business strategy isaddressing the concept of corporate purpose. In 2019, the Business Roundtable redefined the purposeof a corporation through the commitment of 181 CEOs to lead their companies for the benefit of all
stakeholders—customers, employees, suppliers, communities, and shareholders. This is an example ofthe concept of multistakeholderism, which addresses the preservation and optimization of value over the
short, medium, and long term for the benefit of all stakeholders that contribute resources.
This concept challenges the familiar maxim that the purpose of a business is the maximization of
profits for the benefit of equity holders. However, Leo E. Strine Jr., former chief justice of Delaware,observes that the maximization interpretation of fiduciary duties is inexact, and we can “better align our
corporate governance system with the interests of humanity in ensuring that in trying to build wealth, we

6
As used in this publication, the word “actor” refers to all of an organization’s personnel, including persons at subsidiaries, affiliates, and subdivisions.
It also includes part-time employees, independent contractors, and externally hired consultants who are working on behalf of the organization. In thecase of sustainable business, it also includes persons that are part of its value chain for which the organization may have responsibility, such as vendors
and buyers. An actor can also refer either to an individual or an entity.

34

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

do not destroy the planet, injure customers, or otherwise cause more harm than good.” In sum, adhering
to a culture of ethics and principles is the first step (Principle 1) in stablishing an effective system ofcontrols as foundational to trust. Expressing a corporate purpose helps the organization set specificobjectives (Principle 6).
Thought leaders in sustainable business view a binary construct of shareholder vs. stakeholder as
misguided. An organization cannot achieve its financial objectives, such as optimizing profits, without
considering its other stakeholder groups, such as customers, employees, suppliers, and communities.
Therefore, the culture that an organization creates is about discovering, prioritizing, and integrating
sustainable business issues.
Fostering genuine change on managing resources and processes: Because the Framework has beenutilized heavily for SOX compliance, there is a tendency to view it as narrowly focused on externalreporting. However, achieving any form of reporting—whether internal or external—requires effective,
enterprise-wide organizational elements that manage resources and processes. The Framework guides
the design and implementation of effective control and oversight systems for an organization to achieve
all of its objectives that align with its purpose (Principle 6).
United Nations Global Compact (UNGC): Organizations are demonstrating commitment to building
a more sustainable world by becoming members of the UNGC. By 2022, more than 15,000 companies
and 3,800 nonbusiness participants have become members of the UNGC. Among the requirements tojoin, an organization (1) commits to integrating the UNGC’s principles into its organizational culture anddecision-making processes, (2) issues a statement of commitment by its chief executive and board, and(3) agrees to make progress on the United Nations SDGs and regularly report on such progress. These
actions align with Principle 1, which speaks of setting the tone at the top.
Instilling trust in sustainable business information: All actors are instrumental in executing anorganization’s commitment to act ethically and toward stakeholders’ common purpose. Nevertheless,professional accountants—both internal and external—have a critical role to play (see IMA Statementof Position on Sustainable Business Information and Management). Trust, accountability, andtransparency are the cornerstones of professional accountancy. The global community is seeking athoughtful reconsideration of how all organizations use the planet’s limited and precious resources andfor businesses to deliver on sustainability with the same rigor, thoughtfulness, and energy used to deliveron traditional metrics of profits. At the same time, the information relied upon for decision making
around sustainability issues must be high-quality, reliable, and produced through processes that instill
this trust.
Benefit corporations and B Corps: Some companies are making commitments to sustainability as partof their organizational purpose. The requirements of becoming a benefit corporation or a B Corp are
distinct but overlap.
Many jurisdictions now permit companies to incorporate with a stakeholder governance system.
For example, in the U.S., a company can incorporate as a benefit corporation by stating, in its charter,
conventional responsibilities to its shareholders and, concurrently, to a public benefit aligned with its
business model, such as an educational or healthcare-related benefit.
A company also may elect to become a Certified B Corporation, which means that it has voluntarily
decided to commit to the achievement of sustainability-related objectives as facilitated by B Lab.

35

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

Research on trust: The Edelman Trust Barometer delivers ongoing studies on trust in institutions,
including business. Its 2022 global findings report that 81% of employees believe that CEOs should bepersonally visible in discussions of public policy with external stakeholders or the work the company has
done to benefit society. The study also reflected stakeholder awareness:• Customers: 58% buy or advocate for brands based on beliefs and values.
• Employees: 60% choose a place to work based on their beliefs and values.
• Investors: 64% invest based on their beliefs and values.
An organization’s commitment to integrity is fundamental to internal control. It speaks to all
stakeholders that their contributions of resources to the organization will be purposeful.
ICIF and reputational risks: Today, following up on commitments to act sustainably can be criticalfor an organization’s reputation and survival. Consider, in recent years, the front-page news aboutcompanies and their reported failures to act sustainably. These include, for example, the sourcingof palm oil, crude and pipeline accidents, slavery in the supply chain, the sale of addictive opioids,and permissiveness in response to discriminatory behavior. These revelations can have particularly
detrimental consequences with stakeholders if the organization has made public statements about
its dedication to sustainability issues; it can readily be accused of “greenwashing,” the term used todescribe unreliable or untrustworthy claims of sustainability. Further, employees’ perceptions that anorganization’s published values regarding sustainability and corporate social responsibility are hollow canresult in disengagement, which is inconsistent to effective controls. Establishing governance, policies,
and oversight by following ICIF can help an organization forestall detrimental and costly surprises.
Criticism of the business community: Reflecting cynicism and mistrust, there are voices that are criticalof business efforts toward sustainability as inadequate. For example, a recent opinion in The New YorkTimes asserted:
On the face of it, E.S.G. investing could be transformative, which is why it’s one of the hottest
trends in the world of investing. After all, allocating more capital to companies that do goodhelps them grow faster and lower their cost of capital, creating an incentive for all companies tobe more socially and environmentally conscious.
But the reality is less inspiring. Wall Street’s current system for E.S.G. investing is designed almost
entirely to maximize shareholder returns, falsely leading many investors to believe their portfolios
are doing good for the world.
For E.S.G. investing to achieve its potential, Wall Street players will have to change their system.
In fact, it coincides with polls in recent years that find younger generations have negative views ofcapitalism (for example, see “Eat the rich! Why millennials and generation Z have turned their backs
on capitalism” and “A majority of millennials now reject capitalism, poll shows”). Following ICIF-2013,
particularly beginning with Principle 1, gives an organization the power and tools to consider its activities
and statements to promote trust, transparency, and reliability.

36

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKCEO LETTERS
A widespread practice in setting the tone at the top and setting sustainable business priorities is
the CEO letter. For example, in its 2021 sustainability report, United States Steel President andCEO David B. Burritt states:
Steel is critical to a healthy manufacturing base, and it is incumbent upon companies like ours totake the necessary steps to remain economic engines that best support their employees, best
serve their customers, best enrich their communities, and best reward their stockholders. We
believe the key to achieving all of these things is making sustainability central to who we are andwhat we do.…our Best for All approach to sustainability…is making it possible for us to get toour future faster—a future where we are leading our industry in the development of innovative,
profitable, and sustainable steel solutions that are best for people and the planet.
Moving to put the message into practice, Burritt and the company’s board of directors appointed
a new chief strategy and sustainability officer, who has joined the senior management team. Thissends a message that sustainability is core to the company achieving its long-term strategy tofurther its mission.

CEO ANNOUNCEMENT: B CORPIn March 2022, The Vita Coco Company announced that it had become a Certified B Corporation. In
the announcement, Mike Kirban, founder and co-CEO, stated:
We’ve always been on a mission to create more equitable access to natural, better-for-you products
in a responsible way. Joining a network of like-minded organizations will create collective impact todemocratize health and wellness. We are honored to receive this distinction and become part of the
B Corp community.
This is indeed a control activity, because it announces to all stakeholders the company’s commitment
to its mission. From this, the company engages all stakeholders to contribute resources to reach its
objectives, which include positive impact on farming communities in the Philippines, Sri Lanka, andEcuador.

Sustainable business management is becoming more important for organizations,increasing the urgency for reliable ESG information for decision-making purposes.
The COSO ICIF model enables organizations to streamline their ESG strategy,
goals, risks, and thus ultimately the reporting on this topic. This supports
organizations in achieving their sustainability goals.
—Brigitte de Graaff, Assistant Professor, Researcher, and CMA Program Director, Vrije
Universiteit Amsterdam; Chair, IMA Sustainable Business Management Global Task Force

37

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

2. Exercises board of directors’ oversight responsibilities
The board of directors demonstrates independence from management and exercises oversight ofthe development and performance of internal control. (ICIF-2013-2)
Oversight by an independent board of directors serves as a check that management is acting inaccordance with the organization’s sustainable business objectives.

POINTS OF FOCUS
 stablishes oversight responsibilities
E
A board of directors executes its responsibilities
over sustainable business management
through a system of oversight that facilitates
the organization’s satisfaction of mandates andexpectations. Often, the organization’s boardof directors establishes structures, such as adesignated committee or subcommittee, tooversee the organization’s sustainable businessactivities and reporting. This may necessitate
amending existing organizational documents suchas the articles of incorporation, bylaws, or charters.

Operates independently
A board of directors operates independently
from management with respect to oversightand responsibilities for decision making onsustainable business issues. This point of focus
operates in the same way with respect tosustainable business activities as it does for allother organizational activities.

 pplies relevant expertiseA
A board of directors identifies requisite skills
and areas of expertise for its own membership.
Therefore, it ensures that board members
charged with oversight responsibilities regarding
sustainable business have the knowledge baseand skill set to be effective.

 rovides oversight for the system ofPinternal control
The board oversees an organization’s design,
implementation, and performance of controls,
systems, and processes related to sustainablebusiness activities and reporting. Often, this isa check on management and an oversight of
how the organization is utilizing its resources
and processes to achieve sustainablebusiness activities, such as programs aroundenergy, waste, GHG emissions, supply chain,cybersecurity, and diversity, equity, and inclusion.

INSIGHTS omments by Allison Herren Lee: In 2021, former SEC Commissioner Lee gave the keynote address
Cat the Society for Corporate Governance National Conference. Her remarks focused on the SEC’s
policy-making process, particularly around its attention to climate change and other ESG disclosures.
She noted that boards increasingly have oversight obligations related to the identification, assessment,
management, and disclosure of climate and other ESG risks. She further stated that these responsibilities“flow from both the federal securities laws and fiduciary duties rooted in state law,” and they are
fundamental to the success of companies, the markets, and the economy. Yet she observed that “there ismore work to be done” at the board level with more specific mandates and management engagement.
In her remarks, she encouraged boards to mitigate risks around ESG (Principle 7) by enhancing board
diversity, increasing board expertise, and inspiring management success.

38

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

Audit committee activities: Often, a board of directors has various committees that oversee different
aspects of sustainability activities. An organization may have an audit committee and a separate
committee that oversees sustainability activities. As the organization releases additional sustainablebusiness information to the markets and other external stakeholders, either to meet regulatory
requirements or to respond to market demands, it may seek enhanced audit committee oversight. These
circumstances bring about actions such as:• Revising charters to include oversight of external reporting of sustainability information.
• Revising charters to include oversight of disclosures regarding the effectiveness of the organization’s
system of ICSR.
• Conducting educational sessions on recent developments regarding sustainable business.
• Overseeing the internal audit function and review of sustainable business information.
• Developing processes to operationalize oversight of external reporting, such as determining:• The frameworks, standards, and guidelines to follow for external ESG reporting.
• The means for delivering ESG information externally.
• A proposed timeline for review and delivery of ESG reports.
• The person(s) who will be responsible for the process.
• Processes that will be utilized to review disclosure prior to release.
• Evaluating the effectiveness of the reporting process as designed.
• Reviewing external ESG reports before issuance.
• Determining the extent to which ESG information is subject to independent assurance or verification.
• Determining the appropriate outside firm to perform independent assurance or verification. In somecases, an organization may look to the same firm that performs the audit of its financial statements. In
other cases, it may be more appropriate to look to other specialist firms.
 ontrol of sustainable business activities and reporting by internal audit: As Figure P2-1: IIA
CThree Lines Model demonstrates, the IIA has developed the Three Lines Model that is a means for an
organization to implement segregation of responsibilities so that critical groups, including the governing
body—typically the board of directors or the audit committee, providing oversight—as well as executive
management (the first line), the risk management team (the second line), and the internal audit function(the third line) serve as checks and balances to guide the organization toward meeting its objectives(Principle 3 and Principle 6). Following this model, the internal audit function takes on the critical roleof providing objective assurance, independent from management, over the effectiveness of sustainablebusiness risk management, reporting, and related regulatory compliance. As a means of responding torisks, the internal audit function can use an enterprise-wide perspective to highlight the extent to whichsustainable business activities are following policies and procedures (Principle 12) and documented
throughout the business.

39

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKFIGURE P2-1: IIA THREE LINES MODEL

Source: The IIA’s Three Lines Model

40

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKCASE IN POINT: BOARD OF DIRECTORS COMMITTEES’ OVERSIGHT
OF SUSTAINABLE BUSINESSA publicly held company subject to the SEC’s regulations has announced a commitment to several sustainable businessobjectives, including net-zero GHG emissions by 2030. As a result of these commitments and objectives, its board of
directors has divided and assigned aspects of oversight to multiple committees:• Sustainable business committee: oversight of the organization’s assessment of transition risks related to climatechange.
• Audit committee: oversight of the organization’s external sustainability reporting of its progress toward emissions
targets and financial effects, the internal audit function, and interaction with independent auditors.
• Nominating committee: recruitment and appointment of members with familiarity with sustainable business.
• Compensation committee: oversight of incorporating new metrics related to the achievement of certain
sustainability goals and targets into the compensation scheme for the company’s CEO and senior management.
The company has reflected these board activities into its annual proxy statement in accordance with the requirements
under SEC rules (see Part 240, General Rules and Regulations, Securities Exchange Act of 1934, Regulation 14A).

OVERSIGHT OF SUSTAINABLE BUSINESS ACTIVITIES BY DIFFERENTBOARD COMMITTEESAs part of its publicly available information on corporate governance, Travelers describes the roles of its various boardof directors-level committees, as follows:
With respect to oversight of ESG-related risks and opportunities, each committee is assigned responsibility foroversight of matters most applicable to its charter responsibilities. We believe that allocating responsibility to
a committee with relevant knowledge and experience improves the effectiveness of the Board’s oversight. For
example, as indicated above, the Audit Committee oversees risks related to regulatory and compliance matters;
the Compensation Committee oversees implementation of our pay-for-performance philosophy and practices
designed to ensure equitable pay across the organization; the Nominating and Governance Committee oversees
our workforce diversity and inclusion efforts, public policy initiatives and community relations; and the Risk
Committee oversees strategies pertaining to management of catastrophe exposure, changing climate conditions
and information technology, including cybersecurity.
With a focus on continually improving the ability of the Board to provide informed oversight, the Nominating andGovernance Committee oversees educational sessions for directors on matters relevant to our company, businessstrategy and risk profile. For example, topics of those sessions have focused on the role that corporate culture andboard oversight played in publicized lapses in corporate governance at other firms.
The Board and each of its committees evaluate and discuss the allocation of oversight responsibility every year,
along with their respective performance and effectiveness.
In addition, our Chief Sustainability Officer and our ESG Management Committee – a multidisciplinary committee
consisting of senior company executives that meets at least quarterly – drive the prioritization and management of,and reporting on, sustainability issues. We also regularly engage with our investors, our customers, our employees,
our agents and brokers, regulators, rating agencies and other stakeholders on business issues and the ESG topics
of interest to them.

.

41

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

3. Establishes structures, authority, and responsibilities
Management establishes, with board oversight, structures, reporting lines, and appropriate
authorities and responsibilities in the pursuit of objectives. (ICIF-2013-3)
As it endeavors to meet its sustainable business objectives, an organization’s management, withthe oversight of the board of directors, establishes internal structures that set out authority andresponsibilities.

POINTS OF FOCUS
 onsiders all structures of the entityC
A board of directors and management consider
organizational structures to support sustainablebusiness activities and information systems.
These structures include the establishment
and interaction of operating units, affiliates,
subsidiaries, divisions, geographic regions, andthird-party providers.

components for the flow of information
regarding sustainable business activities.
 efines, assigns, and limits authorities andD
responsibilities
A board of directors and management authorize
and delegate responsibilities over sustainablebusiness activities and information. Thisauthorization and delegation incorporate theestablishment of processes, including the useof technology. Together, management andthe board determine the responsibilities andexpected interaction among all actors.

 stablishes reporting lines
E
Management designs the means of oversightover each of the organization’s structuralcomponents. This includes designating
responsibilities among these organizational

INSIGHTS
Considering affiliates and investees in establishing structures: Principle 3 speaks to establishingorganizational structures, an oversight system that will facilitate the organization achieving its
objectives, including its sustainable business objectives (Principle 6). Implementing this guidelinemeans considering equity investments, subsidiaries, joint ventures, and other third parties with whom
an organization has relationships. Applicable ESG reporting regulations and standards may require areconsideration of boundaries. Management, considering its sustainable business objectives, also may
look beyond equity investees based on ownership to other parties that it can control or influence. This isa key difference between traditional financial reporting and sustainable business management.
For example, U.S. GAAP or IFRS may not require a franchisor to account for a franchisee organization.
Yet the franchisor may have significant influence over a franchisee’s sustainable business practices, suchas its human resources policies, inventory purchases, and use of facilities. Information based on thisability to influence may be includable for sustainable business management and reporting standards. For
example, in the accounting for emissions under the GHG Protocol (see Background), which appears tobe generally accepted, an organization reports emissions not only from its own activities (Scope 1) but
also indirect emissions from energy sourced from outside its business (Scope 2) and from the activities oforganizations in its value chain. Depending on the approach taken by the company, Scope 3 requires thesourcing of information related to 15 categories of activities from assets not owned or controlled by thereporting organization.

42

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKThe issue, however, is more than the ability tocontrol or influence another organization, suchas a franchisee’s sustainability practices. It relates
In terms of governance over ESG reporting,to the practical consequences of a franchisee’s
there isn’t a one-size-fits-all approach—it’sactions on the reputation and relationships of the
franchisor. The activities of persons and entities
most often a cross-functional team that has toaffiliated or controlled by an organization cancollaborate to build and manage the processpose risks to reputation and similar components ofto oversee improvements in reporting quality,
intangible value.
consistency, and breadth.
The analysis of boundaries is important forunderstanding and potentially implementing—Marc Siegel, Assurance Partner, Corporate
current proposals to make aspects of sustainable
and ESG Reporting Thought Leader, Ernst &business reporting mandatory. For example, theYoung LLP
SEC and ISSB proposals point to the adoptionof the same reporting entity as currently used forfinancial reporting. Yet these same proposals look to adopt language from other guidelines, such as the
GHG Protocol, which may call for or permit different boundaries than those used for financial reporting.
An organization uses care, therefore, to ensure that it can interact and oversee other entities for which
it may have some responsibility regarding sustainable business information. As Principle 3 indicates,
regardless of the boundaries used for external reporting, it is beneficial for management to understand,from a strategic standpoint, the affiliates, subsidiaries, and other organizations and investees that it cancontrol or influence to help it achieve its sustainable business objectives. An investee may be immaterial
from a financial reporting standpoint but be highly relevant to decision making around sustainabilityrelated risks, operations, and objectives.
Cross-disciplinary approach to sustainable business management: At many companies, the road towardsustainable business activities begins with a management committee or task force that is assigned primary
oversight of the organization’s varied activities, such as setting objectives (Principle 6), overseeing processes,
and reviewing reports. After initiation in somewhat ad hoc fashion, the group may become formalized by awritten charter, assignment of responsibilities (Principle 3), and specified policies (Principle 12).
These cross-disciplinary groups include not only members of finance and accounting, internal audit, andsustainable business teams, but also, typically, participants from legal and policy, treasury, communications,human resources, investor relations, facilities, and operations. As Principle 3 instructs, this partnering
becomes effective if the structures are considered and roles and responsibilities are defined.
The IMA report CFO as Value Creator: Finance Function Partnering for the Integration of
Sustainability in Business utilizes a nine-step framework (see Figure P3-1: Finance Partnering Framework)
developed jointly by IMA and the Association of Chartered Certified Accountants (ACCA) to describe theconsiderations of building internal, cross-disciplinary sustainable business teams with the leadership ofthe finance function. Regardless of the structure, it is beneficial for the organization to have the ability toarticulate its oversight system to both internal (Principle 14) and external users (Principle 15).
ESG controller: Some organizations are creating a new functional role, “sustainability CFO” or “ESG
controller,” to oversee sustainable business information processes, manage sustainable business activities,
and produce external ESG reporting. At some organizations, a specific aspect of sustainability may be more
relevant than others, and it may prove beneficial to appoint a controller with responsibility for that one area.
For example, a company with heavy manufacturing that is concerned about GHG emissions may create

43

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

a specialized position called “GHG controller.” The person in this role may be assigned the responsibilityof evaluating and communicating current risks (Principle 6), keeping up to date on trends (Principle 7),
proposing and managing policies (Principle 12), and coordinating data management (Principle 10).

YT

9.
Change thefinancemindset7.
Createeffective
structures

6.
Sort the
data

B:

FI

X T

CR

EA

2.
Securebuy-inBETTERFINANCE
BUSINESSPARTNERING

5.
Simplifythetechnology
landscapeHE IN ORM
F

3.
Know
your proof
points

ANDAT E

8.
Plan forcapabilities
that matter1.
Drive therightcultureEM

C: DEPLO

A:

TH

HE

AL

T
EN

TE

T

FIGURE P3-1: FINANCE PARTNERING FRAMEWORK

4.
Measurewhatmatters

IO
AT

N

Source: CFO as Value Creator,
Finance Function Partnering for the
Integration of Sustainability in Business

DISCLOSURE OF MANAGEMENT OVERSIGHT STRUCTURES
Whirlpool Corporation releases comprehensive ESG disclosures, including a report that follows the TCFD
recommendations. As part of this reporting, Whirlpool details how its management team functions to set
and meet its sustainable business objectives. For example, its TCFD report for 2021 states:
Management
At the management level, our ESG efforts are led by our Executive Committee and guided by our
ESG Councils—one covering Environmental Sustainability, one covering Social and Governancetopics. Our ESG Councils are composed of regional business leaders and senior leaders from our key
operational and corporate functions. The ESG Councils evaluate our strategic priorities on relevant
ESG issues based on results of our ESG Materiality Assessment and input from our ESG Task Force,a cross-functional team that embeds individuals and leaders from all core functions of the business.
To further strengthen our ESG governance structure and integration into our business, we nameda Senior Vice President, Communications, Public Affairs and Sustainability to join the Executive
Leadership team and report directly to our Chairman and CEO. Whirlpool Corporation’s Corporate
Controller and Principal Accounting Officer is accountable for reporting to the EC and the Board of
Directors on ESG matters, including climate change-related issues and financial impacts.

44

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

4. Demonstrates commitment to competent human resources
The organization demonstrates a commitment to attract, develop, and retain competent
individuals in alignment with objectives. (ICIF-2013-4)
To meet its sustainable business objectives, an organization depends on its human resources.

POINTS OF FOCUS
 stablishes policies and practices
E
The organization develops and implements
policies and practices that communicate
expectations regarding its actors’ competencewith sustainable business management andinformation. For example, the organization
formalizes position descriptions and job
responsibilities regarding its sustainablebusiness activities and keeps these up to date.

They also work to address shortcomings in theirteams’ knowledge regarding sustainability.
 ttracts, develops, and retains individualsA
The organization engages in activities to attract
people who are competent regarding businesssustainability. It provides mentoring and training
regarding sustainability to meet its objectives.
It engages in activities to retain competentpersonnel and service providers who arecompetent in sustainability.

 valuates competence and addressesEshortcomings
Working together, the board of directors andmanagement evaluate the competence of
personnel and service providers regarding
sustainable business management andinformation. This includes assessing abilities
against policies and practices aroundcompetency, that is, benchmark expectations.

 lans and prepares for successionP
The organization, through its board of directors
and management, develops plans of succession
regarding those persons, both internal andexternal service providers that are part of its
system of controls and oversight of sustainablebusiness activities and information.

INSIGHTS
Talent to meet sustainable business objectives: An organization may find that its sustainablebusiness team is woefully understaffed. This creates risks that the organization will be unable to meetits sustainable business objectives (Principle 6). It also leads to a suboptimal segregation of duties thatserves as an internal check (Principle 10). From a strategic standpoint, understaffing sustainable businessteams can deter synergistic innovation and leave an organization weak at seizing opportunities andimplementing strategies rooted in sustainable business management.
Sustainable business activities and reporting also typically necessitate cross-functional collaboration
between members from finance, legal, investor relations, health and safety, operations, facilities, humanresources, and procurement teams (Principle 3). These professionals need to appreciate different
perspectives and different terminology to meet an organization’s sustainable business objectives.
Therefore, in hiring and adding personnel, it is helpful for an organization to consider not only a person’s
specific skill set but, as importantly, the person’s abilities to adapt, innovate, and consider the longterm as well as the short term.
Further, organizations are finding it challenging to find people who have an adequate, combined
understanding of sustainable business and financial reporting so that it can meet its various reporting

45

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

objectives. Because it is a new discipline, mostmid- to senior-level business professionals neverreceive training or exposure to sustainable
The greater integration of climate andbusiness concepts and practices in their studies
or early career. Only professionals from among
financial information and their supporting
the most recent graduates have had this directprocesses and systems under the
exposure. Therefore, in practice, financial
stewardship of finance teams andfunction professionals are teaching sustainableaccountants should lead to better reporting
business teams about regulatory mandates,in the years to come.
information quality, internal controls, governancesystems, and the assurance process. At the—Kevin Dancey, CEO, Internationalsame time, sustainable business teams, with theFederation of Accountants
help of investor relations, are teaching financefunction professionals about the diverse types of
information requested by the market, rating agencies, NGOs, and other stakeholders.
Professionals in corporate finance functions (including management accountants with expertise inoperations), along with their counterparts in internal and external audit, already have the fundamental
skills to consider objectives, risks, structures, policies, and processes relating to sustainable business.
It is primarily a matter of refocusing this existing talent toward new areas. Cross-training that includes
finance function members can help promote good data collection practices, controls, and reporting
infrastructure. Similarly, the sustainability teams can help train the finance team on the detailed subject
matters related to various aspects of sustainable business management and ESG reporting in a way thatconsiders the business model and strategic direction.

CASE IN POINT: SUSTAINABLE BUSINESS TALENT
Gary Industries, a privately held company (fictional), makes specialized packaging and cardboard cartons.7 Many ofGary’s customers sell to big-box retailers and e-commerce companies that are public companies with concerns about
competition and reputation. Several of its customers have made public commitments to sustainability, and Gary views its
own ability to provide information regarding its own sustainability as a critical strategic advantage in working with thesecustomers. However, Gary’s operations, facilities, human resources, and finance and accounting teams do not feel thatthey have the requisite understanding to further the company’s sustainable business objectives. Looking to Principle 4,
the company undertakes a series of steps to improve its talent capabilities to meet them. These steps include:• Identifying its needs to understand various sustainability subject matters.
• Conducting training for management, full- and part-time employees, consultants, and independent contractors.
• Incorporating needs for people with sustainability knowledge into its hiring plans, including plans for its operations,finance, accounting, and internal audit functions.
• Integrating information about the company’s sustainable business objectives into its onboarding materials.
• Supporting all members of the organization in obtaining training and certifications.
•H iring new, experienced employees, or, in some cases, consultants, to instruct the teams toward the design andimplementation of new processes for sustainable business initiatives.
• Conducting joint training or sessions with customers to understand their needs regarding sustainability.

7

See Management Accountants’ Role In Sustainable Business Strategy: A Guide to Reducing a Carbon Footprint.

46

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

5. Enforces accountability
The organization holds individuals accountable for their internal control responsibilities in the
pursuit of objectives. (ICIF-2013-5)
To meet its sustainable business objectives, an organization needs to establish and implement
meaningful ways to support its human resources and, at the same time, monitor performance.

POINTS OF FOCUS
 nforces accountability through structures,Eauthorities, and responsibilities
An organization’s board of directors andmanagement, working together, establish means
to direct behavior of employees and otheractors with respect to upholding establishedstandards and processes regarding sustainablebusiness activities and information, and holdthem accountable. To do so, an organization
may incorporate aspects of its sustainablebusiness activities, as appropriate, into job
descriptions and performance evaluations.
 stablishes performance measures,E
incentives, and rewards
An organization’s board of directors andmanagement establish meaningful ways tomeasure progress on sustainability. This includes
setting performance targets along with incentives
and rewards for achieving these targets. The
organization may establish compensation that is
linked to meeting not only short-term objectives
but also long-term sustainability-related indicators.

they reevaluate them periodically to ensure thatthey remain relevant (see Principle 16 regarding
ongoing evaluation).
Considers
excessive pressures
In setting targets, it is beneficial for the board
and management to consider conditions that
could drive performance that is ineffective,
contrary to achieving objectives, or detrimental
to the organization. In establishing sustainablebusiness performance metrics and aligningincentives and rewards, management andthe board of directors consider ways to avoid
imposing undue pressure on the company’s
actors (see Principle 8 regarding fraud).
 valuates performance and rewards orE
disciplines individuals
A board of directors and management, working
together, assess how well individuals are
performing their responsibilities regarding
sustainable business activities. This meansthat actors are adhering to the organization’s
established processes to achieve establishedobjectives. In cases of noncompliance,
appropriate measures are established andperformed to improve performance.

 valuates performance measures, incentives,E
and rewards for ongoing relevance
Once a board of directors and management
set performance targets and a reward system,

INSIGHTS
Prioritizing organizational commitment: In initiating new systems for gathering and reporting onsustainable business activities, an organization’s existing managers and personnel may push back byclaiming that requisite sustainable business information is “unavailable” or “unnecessary.” It may be
important for the organization to educate these employees (Principle 4) on the importance of the data
to meeting its sustainable business objectives and other objectives.

47

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKCASE IN POINT: ESG-LINKED COMPENSATION
In its proxy statement filed and released under the SEC’s rules, a heavy manufacturing company
discloses the details of a new incentive compensation program for three key executives. Under the
program, 10% of these executives’ compensation will be based on a health and safety metric; 10%will be based on a climate action metric; and 10% will be based on a diversity and inclusion measure.
That is, executives will receive a substantial portion of their variable compensation (30%) only if thecompany meets specified objectives during the vesting period.

As an additional challenge, some personnel may
be a great distance and time zones away from
corporate headquarters and sustainable businessobjectives are not prioritized. Principle 5 speaks
to the importance of emphasizing organizational
needs by instituting “accountability throughstructures, authorities, and responsibilities.”
Importantly, this means budgeting properly
to provide resources for these structures tofunction effectively and nonwastefully. These
control and oversight activities help ensure thatthe organization meets its sustainable businessobjectives.

ESG reporting is complex, requiring
the ingestion, capture, management,
and reporting of financial and nonfinancial data from many disparate
sources. As companies move toward
investor-grade ESG reporting, thediscipline of establishing soundinternal controls over sustainability
reporting becomes increasingly
important. This supplemental COSO
guidance provides organizations afamiliar and established frameworkfor delivering assurance-readydisclosures.

Considering excessive pressures: Management,
at every level, can feel pressure from the board of
directors, senior executives, employees, investors,
competitors, customers, and other stakeholders
to establish ambitious sustainable businesstargets. Achieving targets, however, requiresorganization, structure, resource commitments,
and controls to monitor progress. Undue emphasison targets can heighten risks to meeting otherbusiness objectives (Principle 6) by diverting
resources. It can also create undue pressure toreport incomplete or inaccurate data to meet
expectations and therefore create the risk ofgreenwashing or fraud (Principle 8).

—Marty Vanderploeg, Nonexecutive
Chair, Workiva

48

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKFIGURE P5-1: SHORT-TERM AND LONG-TERM ESG-BASEDINCENTIVES BY REGION
18%■ Short-term incentive

16%■ Long-term incentive■ Either short-term or

14%

long-term incentive

12%
10%
8%
6%
4%
2%
0%
EuropeU.S. andCanadaAfrica andMiddle East

Asia-Pacific

Latin America
and Caribbean

Source: Real ESG Accountability: Tying Your Company’s ESG Performance to Leadership Compensation

Incentive compensation tied to sustainable business objectives: Research reveals that incentive
compensation tied to sustainable business performance has remained fairly limited, but attention is growing.
Importantly, research is also showing that this incentive compensation remains largely tied to short-term
rather than long-term metrics (see Figure P5-1: Short-Term and Long-Term ESG-Based Incentives by
Region).
PwC’s Maria Castañón Moats, Governance Insights Center leader, observes, “Targets and metrics
in executive compensation plans are premium real estate—and space for new metrics is limited.
Compensation committees are wise to avoid overburdening those plans with too many different goals. This
keeps the organization’s main priorities front and center, and makes expectations clear.”
Following Principle 5 can help bring meaningful balance to an organization considering sustainablebusiness incentives. This principle guides an organization to find an appropriate formula by aligning its
incentive compensation to its sustainable business and other business objectives (Principle 6).

49

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

Component: Risk Assessment
6. Specifies suitable objectives
The organization specifies objectives with sufficient clarity to enable the identification andassessment of risks relating to objectives. (ICIF-2013-6)
With clarity, an organization expresses its sustainable business objectives. These objectives are a means
to tie the organization’s purpose or mission, values, and corporate social responsibility goals to strategy.
An organization’s sustainable business objectives follow from its commitment to integrity and ethicalvalues and are integrally linked to its operations objectives, external financial reporting objectives,
external nonfinancial reporting objectives, internal reporting objectives, and compliance objectives.
Explicit expression of these objectives is a predicate to considering risks, that is, the likelihood thatevents will occur that may be detrimental to the organization’s ability to satisfy them.

POINTS OF FOCUS
Operations Objectives

External Financial Reporting Objectives

Reflects management’s choices
An organization’s management directs its
sustainable business activities, which may
be driven by sector or industry. In doing so,
management considers the risks inherent in thecompany’s business model and operations.

 omplies with applicable accounting standards
C
The organization applies financial accounting andreporting standards that are suitable to express
its activities and transactions. This includes
consideration of the connectivity between
financial and sustainable business information,that is, how sustainable business activities affectfinancial performance, condition, and cash flows
as defined under generally accepted accounting
and reporting standards.

 onsiders tolerances for risk
CManagement determines how much risk fromthe achievement of its sustainable businessobjectives it will deem acceptable.

 onsiders materiality
C“Materiality” has been defined by regulationand legal precedent. Traditionally, it speaks to
the decision usefulness of reported information
to lenders and equity investors. In setting
external financial reporting objectives, theorganization considers the materiality ofsustainable business items on the financial
statements, notes to the financial statements,
and disclosures required by regulation.

Includes operations and financial
performance goals
Management considers sustainable businessrisks in terms of the potential effects on
the company’s operational and financial
performance.
 orms a basis for committing resourcesF
After consideration of its business sector andindustry, tolerance for risk, and operational andperformance objectives, management allocates
resources necessary to meet its sustainablebusiness goals.

 eflects entity activities
R
A principle of financial reporting is fairpresentation, which means that financial
reporting reflects the organization’s activities
and transactions. Certain sustainable businessactivities affect its financial reporting.

50

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

External Nonfinancial Reporting Objectives

Considers
the required level of precision
Information can be useful to management
decision making even if there is imprecisionbecause the information is based onassumptions, estimates, and judgment.
Management uses judgment to determine theprecision with which information is needed fororganizational decision making.

 omplies with externally establishedC
standards and frameworks
Senior management has an oversight role indetermining how an organization will deliver
sustainable business information to external users.
This includes the standards to apply, the surveys
to complete, and the means for publication.
 onsiders the required level of precisionC
Not all reported information can be 100%
precise because it is based on assumptions,estimates, and judgment. Management uses
judgment and determines the precision withwhich information is reported to external users.


Reflects
entity activities
For sustainable business information to be
useful for management’s internal decision
making, it faithfully represents underlying
transactions, events, and expectations.
Compliance Objectives

Reflects entity activities
For sustainable business information to be
useful, it faithfully represents what it purports
to represent.

 eflects external laws and regulations
R
An entity’s objective is to conduct its activities ina manner that complies with applicable statutes,
regulations, and court-determined precedent.
This includes not only mandatory disclosures
under securities regulations but also compliancein a range of ESG areas around energy, waste,
health and safety, equal opportunity, anticorruption, and anti-slavery.

Internal Reporting Objectives
 eflects management’s choices
R
Management decides what information it
needs, internally, for decision making tomanage the business. This includes data
sourcing, analyses, dashboards, reports, andpresentations.

 onsiders tolerance for riskC
In establishing internal processes, anorganization’s management determines theextent to which it will perform oversight ofpotential deviations from laws and regulations.

INSIGHTSInterrelationship among ICIF-2013 Principle 6 objectives: ICIF-2013 provides five categories ofobjectives: operations, external financial reporting, external nonfinancial reporting, internal reporting,and compliance. Although described separately, in practice, these objectives work together so thatthe organization is accountable for meeting its ultimate purpose (Principle 1), including its sustainablebusiness objectives. That is, in setting sustainable business objectives, an organization looks to ensure
consistency among all objectives regardless of category. A siloed approach with a lack of consistency
among objectives creates unnecessary, additional risk and contributes to wastefulness of human andother resources that may be working toward inconsistent goals.

51

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKWith respect to external reporting, the issuance of financial reports and separate sustainability
information by different teams with different objectives raises specific risks of inconsistent disclosures.
Moreover, unlike financial reporting subject to regulation, the agenda for voluntary reporting often
includes subcomponents and points of disclosure from multiple frameworks and guidelines, such as the
GHG Protocol, TCFD, GRI, SASB, and the SDGs (see Background). ICIF-2013 Principle 6 tells us that anorganization’s oversight system functions well when the reporting objectives are considered along withthe organization’s other objectives, including its internal and operating objectives. This promotes thedevelopment of an effective system and enterprise-wide engagement.
Materiality and the debate over impact accounting: Principle 6 addresses how “materiality” isconsidered in setting and carrying out objectives.
In many jurisdictions, the word “materiality” has a legally defined meaning. For example, in the U.S.,“materiality” has been defined by the U.S. Supreme Court, and the SEC incorporates this definition
throughout its regulatory scheme.8 Materiality establishes legal responsibilities and potential liability.
Generally, ESG information can be considered material, under its legal definition, to traditional capital
market investors as well as decision useful for other stakeholders, as the organization aims to report oncomponents that help assess enterprise value.
However, in the world of sustainability, some interpret the term “material” by advocating for a “double
materiality” approach, which some refer to as “impact accounting” (see Figure P6-1: Impact Accounting
Model). In this line of thinking, an organization delivers not only ESG information that reflects how it isconducting its operations but also how its operations affect external parties. For example, the SDGs
and GRI aim for organizations to deliver information on the external effects of their operations andactivities on the commons, such as water resources, GHG emissions, waste disposal, human health, andcommunity well-being.
Global efforts to harmonize the various sustainability reporting frameworks resulted in a concept called“dynamic materiality.” Figure P6-2: Dynamic Materiality uses a building blocks approach to demonstrate
how these different perspectives of materiality may be considered cohesively.

8

See Basic, Inc. v. Levinson, 485 U.S. 224 (1988); TSC Industries, Inc. v. Northway, Inc., 426 U.S. 438 (1976).

52

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKFIGURE P6-1: IMPACT ACCOUNTING MODEL

Source: Guidelines on reporting climate-related information

FIGURE P6-2: DYNAMIC MATERIALITY

Dynamic
materiality:
sustainability
topics canmove—either
gradually orvery quickly

Reporting on matters that reflect theorganisation’s significant impacts on theeconomy, environment and people

To various users withvarious objectives whowant to understand theenterprise’s positive andnegative contributions tosustainable development

Reporting on the sub-set ofsustainability topics thatare material for enterprisevalue creation

Specifically to the sub-setof those users whose
primary objective isto improve economic
decisions

Reporting that is alreadyreflected in the financial
accounts**Including assumptions and cash flow projections

53

Source: Statement ofintent to work together
towards comprehensive
corporate reporting

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

Materiality based on industry: The SASB standards (now part of the ISSB portfolio) were developedwith the goal of identifying the points of disclosure that are most likely material based on an organization’s
industry. Importantly, the initial development of these 77 industry-based standards was to enhance existing
Form 10-K disclosures for sustainability-related information by applying the legal definition of materiality.
Many preparers, when they initiate sustainable business reporting, look to the SASB standards to informthem on the initial areas for potential disclosure. The suggested KPIs and related disclosures can help anorganization target and carry out decision-useful sustainable business objectives.
Definition of faithful representation: The ISSB, in its S1 Exposure Draft, General Requirements
for Disclosure of Sustainability-related Financial Information (see Background), defines “faithfulrepresentation” with respect to sustainable business information (¶¶ C9-C10). The ISSB notes thatsustainability-related financial information represents actual, real-world phenomena in words andnumbers. Therefore, for information to be useful, it must faithfully represent “the substance of thephenomena that it purports to represent.” The ISSB further states that for information to be a faithfulDISCLOSURES BASED ON IMPACT ACCOUNTING
Some organizations are issuing a new form of financial statement based on the concepts of impact
accounting or multicapital accounting. For example, Natura &Co, a multinational beauty company, hastaken steps to measure and report the impacts generated by its business in the “social, environmental
and human spheres, by launching its Integrated P&L, called IP&L.” The company describes its IP&L
as an integrated management tool that allows the accounting for the impact of the company’s
performance in the environmental, social, and human dimensions, in addition to its financial results.
The company concludes, based on this model, that for every U.S. dollar of Natura revenue, the brandgenerated a net return of $1.50 in benefits for society.

SETTING OBJECTIVES: COMMITMENTS TO GHG
REDUCTIONS
Companies are making public commitments to reduce their GHG emissions with target dates (seeScience Based Targets). This is an expression of commitment to act sustainably (Principle 1). For
example, in its Form 10-K for 2021, Whirlpool describes both its commitment and the risks to failingto meet its expressed targets (Principle 7):
We have set rigorous science-based targets for greenhouse gas reductions and related
sustainability goals, including a “net-zero” emissions target in our plants and operations that wasannounced in 2021. Any failure to achieve our sustainability goals or reduce our impact on theenvironment, any changes in the scientific or governmental metrics utilized to objectively measuresuccess, or the perception that we have failed to act responsibly regarding climate change could
result in negative publicity and adversely affect our business and reputation.
Financial institutions have additional challenging practicalities regarding climate and other sustainablebusiness risks. They need to set targets not only for their own operations but also within their portfolios.
Their borrowers, insureds, and investees carry risks, and these risks can be less than transparent.

54

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

representation, it would be “complete, neutral and free from error.” This accords with Principle 6. Anorganization sets objectives that ensure that its information for decision making represents underlying
circumstances, transactions, and expectations.
SEC Division of Corporation Finance (CorpFin), consistency of disclosures: In 2021, signaling that
the SEC would scrutinize corporate filings regarding compliance with Commission Guidance Regarding
Disclosure Related to Climate Change, CorpFin released a sample comment letter that it anticipatedissuing to companies regarding climate change disclosures. Among the items that CorpFin indicated it
would address in its review of SEC filings were disparities between disclosures in a company’s corporatesocial responsibility (or similar) reports via websites and the information provided in their SEC filings(Form 10-K). This supports the concept in ICIF-2013 that setting objectives must be consistent andcohesive throughout an organization and that sustainability matters are integral to a comprehensive
oversight system.
Benefits and risks of benchmarking to set goals: Even if an item does not appear material from afinancial reporting perspective, it may be useful because of the criteria that analysts use to determine
the company’s ESG ratings. As a result, many companies look to commercial data and ratings to set
sustainable business objectives. Looking to organizations in a similar industry or with a similar businessmodel can be informative.
However, it is valuable to use care when considering benchmarking data to set sustainable businessobjectives. A company’s finance function and investor relations teams find that they benefit from adetailed understanding of how the company is rated to set its sustainable business reporting agenda.
With respect to ESG, commercial data and ratings can lack comparability or consistency. In fact, someorganizations find it beneficial to use consultants or to reach out directly to data aggregators and rating
agencies to understand their scoring methodologies.
Sticking to objectives to set control systems: At the outset of SOX, many companies felt obliged to
specify controls for everything, identifying many as “key controls.” This caused the level of effort for(internal and external) assurance to skyrocket. Parties subsequently realized that not all controls werenecessarily key controls. They learned this lesson the hard way. As Debbie Biddle-Castillo, managing
director of KPMG’s Advisory Services, Internal Audit practice, observes, as companies embark on
formalizing internal controls for ESG reporting, they can apply these lessons to prioritize controls for
ESG reporting.

CASE IN POINT: UNDERSTANDING RATINGS
An agriculture company based in the European Union operates plant-based farmland. The company
did not monitor or report on animal welfare or deforestation because it was not part of its operations.
After receiving low scores from leading ESG analysts, the company pursued discussions to find out
why and how to improve them. At least one firm had assigned the company to a sector in theirtaxonomy that included parameters the company was not reporting. The company had the choice topersuade the analyst to consider the company in a more appropriate sector classification or to provide
data on the missing parameters.

55

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

7. Identifies and analyzes risks to meeting sustainable business objectives
The organization identifies risks to the achievement of its objectives across the entity and analyzes
risks as a basis for determining how the risks should be managed. (ICIF-2013-7)
After setting its sustainable business objectives, the organization identifies the various circumstances that may
occur and that may prevent its ability to meet these objectives either partly or completely. The purpose of thisassessment is to develop and implement means to respond to these risks.

POINTS OF FOCUS
Includes entity, subsidiary, division,
operating unit, and functional levels
Performing a robust and effective risk
analysis requires the consideration of all of anorganization’s subunits, including subsidiaries,
divisions, and operating units.

assessing sustainable business risks. Therefore,
in identifying and assessing sustainable businessrisks, the organization relies on multiple levelsof management and cross-departmental
communication.
Estimates
significance of risks identified
In identifying and assessing risks, the organization
estimates the potential effects of various scenarios
on its sustainable business objectives. This
process includes both qualitative identification
and, as appropriate, quantitative assessment thatmonetizes the potential effects of the risks.

Analyzesinternal and external factors
Performing a robust and effective risk assessment
means the analysis of external and internal
factors. In assessing sustainable business risks, theorganization considers scenarios that may resultin impairment or loss of value to both tangible(recognized) assets and intangible (unrecognized)
assets that may result from expectations ofstakeholders.


Determines
how to respond to risks
After the identification and assessment of the risks
to meeting its sustainable business objectives,
management determines the appropriate
response including accepting the risk, avoiding
the risk, reducing the risk, or sharing the risk.

Involves
appropriate levels of management
An organization’s actors have information andperspective to contribute to identifying and

INSIGHTS
Risks from immature information processes: As noted throughout, particularly in Principle 11, on
the road to ICSR, immature processes and systems can increase the risks by providing unreliable or
misstated information needed for decision making. Controls can help organizations respond to theseinformational risks.
“Risks” and “opportunities”: In its proposed regulations regarding climate change (see Background),the SEC speaks in terms of mandatory disclosures around “risk,” and permissive disclosure of related“opportunities.” Other proposed regulations, such as issued by the ISSB, would require disclosure ofboth “risks and opportunities.”

56

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKDISCLOSURE OF RISKS AND OPPORTUNITIESIn its TCFD report for 2021, Travelers explains processes that help its insured customers mitigate climate
risks. While this is part of the company’s product offering, it also sets up a process by which the company
can identify, assess, and mitigate climate risks in its portfolio, as described in Principle 7. Further, thecompany looks to this process as a means to fulfill its overall purpose (Principle 1) and objectives(Principle 6) by identifying opportunities:
Travelers Risk Control employs a network of safety and loss prevention professionals who provide
assessment and consulting services to our customers and our Business Insurance domestic andinternational operations. Our network of more than 500 Risk Control consultants and our self-service
website for Business Insurance customers provide a comprehensive framework and numerous
planning resources, including individualized planning, to help businesses of all types plan for natural
disasters, with a focus on safety and preserving business operations.
Climate trends, which manifest over long periods of time, provide a long-term opportunity for
the Travelers Risk Control department to offer and develop services to help current and potential
customers mitigate the risks associated with changing climate conditions. For example, to help
mitigate and minimize property losses caused by weather-related events, Travelers Risk Control has
developed a comprehensive framework of technical planning resources to assist customers with
conducting business impact analyses to prioritize and implement risk management action plans andphysical improvements.

COSO ERM Framework: In 2017, COSO issued the most recent version of Enterprise Risk Management—
Integrating with Strategy and Performance (ERM Framework), which promotes a strategic approach to risk
management that includes governance, oversight, and processes for identifying, assessing, and managing
risks across an organization. One particular challenge is whether to consider a sustainable business risk(such as physical risks related to weather events) as a stand-alone item or as an item integrated with othersustainable business items (such as diversity, equity, and inclusion). This concern also corresponds to
Principle 3 in establishing structures and responsibilities for particular sustainable business items.
Because it is comprehensive, the COSO ERM Framework provides useful guidelines andrecommendations for aligning sustainable business strategy, performance, and risks with an organization’s
overarching strategy. It can help direct the best structures for identifying and responding to risks. Like ICIF2013, the ERM Framework is readily applicable to sustainable business matters (see Background).
Risks related to estimates, expectations, and predicting the future: One of the key challenges
regarding sustainable business information is that it is often based on estimations and expectations.
Sustainability metrics are set by considering the connection between the item measured and its ability
to effectuate decision making that considers the use of valuable resources over the short, medium, andlong term. Consider:• Estimation may be used because primary activity data based on direct measurement of an activity
is unavailable or prohibitively costly to accumulate. The organization instead uses secondary data
based on assumptions and estimations. For example, energy usage for a particular division may bebased on assumptions of proportional usage of a shared facility. As technology improves, new meansof measurement are likely to develop. For example, with respect to environmental information, newtechniques will generate data related to the usage and condition of specific assets (such as plants andrefineries) based on both ground-level data and geospatial (satellite) data.

57

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKOBJECTIVES AND RISK: COMPLEMENTARY BENEFITS OF
ICIF AND THE ERM FRAMEWORKThe COSO ICIF and the COSO ERM Framework address objectives and risk. However, the twoframeworks address different but harmonized aspects of both (see ICIF-2013, Appendix G,
Comparison with COSO Enterprise Risk Management—Integrated Framework).
As a general concept, the ERM Framework helps an organization take a deeper dive into assessing
various risks and setting objectives. In the sustainability arena, this may be expanded to consider new
areas, such as a commitment to ethics and purpose. As stated, the ERM Framework helps an entity“develop and apply their enterprise risk management activities,” such as assessing risk appetite andtolerance. Enterprise risk management is broader than internal controls and focuses more directly on
risk. The ICIF is the means for carrying out objectives throughout an organization. It is an integral yet
narrower part of enterprise risk management.

• Estimation may be used to develop expectations about the future. Developing information forsustainable business inherently requires assumptions about the future, such as the useful life of existing
facilities and equipment based on both physical and transitional (economic) risks related to climatechange.
The techniques and processes required to deliver information in accordance with an organization’ssustainable business objectives do not differ from those used to meet its other objectives (Principle 6).
Professionals in the finance function, particularly those in the area of financial planning and analysis(FP&A), are skilled in financial estimation based on assumptions about the future to assess risks withan eye toward performance optimization over the short, medium, and long term. This is an instrumental
component of management accountants’ competencies.
Identifying risks, by looking to Principle 7 as part of the full ICIF, can facilitate an organization’s
response in managing these risks and promoting the integrity of the process of producing estimations
and forward-looking expectations. One of the most important and helpful means of control andoversight is documentation of data sources and rationales. This documentation not only serves
as a means of tracking information and assumptions but also serves as a means of confirming thereasonableness of the estimation process to improve the quality of the estimates so that at some point, it
can be subject to assurance examinations (Principle 16).
Due diligence, risks related to third-party information: A key difference between sustainability
reporting and financial reporting is boundaries (Principle 3). As a general proposition, sustainability
reporting uses boundaries based on the concepts of “control” or “influence.” It also includes gathering
information from a full value chain that includes an organization, its suppliers (inputs), and its customers.
For example, GHG Protocol accounting for Scope 2 necessitates data from energy companies, andScope 3 accounting, depending on an organization’s business model, requires data from suppliers andcustomers. Sustainable business management and reporting, therefore, depend on the availability andquality of third-party information.
This reliance on third-party data is a key concern among business professionals because accessing
and relying on data from these external parties raises risks. Following ICIF-2013 can facilitate the criticalmindset toward resolving an organization’s concerns. Oversight and control activities to respond to58

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

these risks (Principle 10) requires the attention ofcompetent professionals (Principle 4). They call fordue diligence processes to assess and validate the“One problem, organizationally, isaccuracy and completeness of the information andwhether it is representationally faithful (Principle 6).
that risk is in one place, and ESG is in
Similar concerns were raised when the U.S.
another. There is an interrelationshipenacted the Dodd-Frank Wall Street Reform andbetween risk management andConsumer Protection Act in 2010, and the SEC
strategy, and you can’t separate
followed with regulations regarding the use of
9them.
conflict minerals. In the final rule, the SEC
indicated that downstream companies could—Edward Olson, Partner, National
adopt nationally or internationally recognized
Leader, Environmental, Social, andstandards and identified the OECD Due Diligence
Governance, MNP LLP
Guidance for Responsible Supply Chain of
Minerals from Conflict-Affected and High-Risk
Areas as a widely accepted standard.
Similarly, the SASB standards for certain industries include human rights-related disclosure topics. One
such accounting metric is the “percentage of Tier 1 supplier facilities audited in the RBA [Responsible
Business Alliance] Validated Audit Process (VAP) or equivalent, by (a) all facilities and (b) high-risk
facilities.“10 The prevalence of new laws and regulations over human rights, such as the U.S. Uyghur
Forced Labor Prevention Act and the United Kingdom Modern Slavery Act, calls on reportingorganizations to address risks regarding human rights concerns throughout their supply chains.
In sum, a widely accepted, existing standard for due diligence around sourcing can become a control
activity (Principle 10) to respond to the risks. In addition, reporting on these activities to external
stakeholders can provide useful information that engenders trust (Principle 1).
Risks related to providing information to customers: Mirroring the risks of sourcing sustainability
data from suppliers, issuing sustainability information to customers poses risks. As more organizations
follow the GHG Protocol (or regulations with similar frameworks) and begin to report on Scope 3
emissions, they may demand information from suppliers or reward suppliers that provide it. Beyond GHG
accounting, similar risks apply to other types of sustainable business information. Without an effective
oversight system, an organization may provide unreliable information to its customers. Further, given thepressure to close transactions, actors may respond by knowingly providing information that is incomplete
or inaccurate (Principle 8). Principle 7, along with the full Framework, directs an organization to develop
and implement oversight activities to respond to these risks (Principle 10).

9
“Conflict minerals” refers to the sourcing of certain elements from specified geographic regions that have suffered from dangerous conflicts. Essentially, the underlying purpose is to bring transparency to the possible funding of warlords.
10 
See, for example, SASB Standards for the Technology & Communications sector, Hardware industry.

59

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKDISCLOSURE OF SUPPLY CHAIN SOURCING
Applying Principle 7 can raise risks regarding the accuracy and validity of claims regarding sustainably
sourced inputs. To respond to these risks, companies can develop policies and procedures that
address interaction with suppliers and the reliability of their information. For example, the GUESS
2020-2021 sustainability report details operational risks around sourcing sustainable materials for the
production of its products, as follows:
Our products feature various natural and manmade materials. The three materials used mostfor GUESS apparel and accessories are: 1. Cotton, which is in denim and our logo tees 60.2%
2. Synthetics, such as polyester, nylon and spandex 28.3% 3. Manmade cellulosics, such as
viscose/rayon, modal, and lyocell 9.8% The ability to consistently and reliably source thesematerials could be affected by certain external factors. Cotton production relies on water, which
can be adversely affected by climate change impacts. Human rights concerns at the farm level
could also affect cotton availability. Since polyester is oil-based, we could face challenges meeting
our Scope 3 science-based emission targets or negative public perception associated with plastics
and microfibers. Our increased use of recycled polyester could help to mitigate these risks. To
address potential risks associated with manmade cellulosics, we have been working with millsin the GUESS supply chain to determine the source of the tree pulp, increasing our sourcing
from verified companies like Lenzing and Birla, and partnering with Canopy to avoid materials
sourced from Ancient and Endangered Forests and in any manner that could be harmful to local
indigenous communities. Risks are further detailed in the GUESS Form 10-K.
This disclosure and the additional details provided in the remainder of the sustainability reportdisclosures demonstrate the process of identifying risks that could prevent the company frommeeting its sustainable business objectives. The act of specifying these risks, as Principle 7 directs, is asignificant means of establishing oversight to facilitate progress toward the company’s objectives.

60

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

8. Assesses fraud risk
The organization considers the potential for fraud in assessing risks to the achievement ofobjectives. (ICIF-2013-8)
In identifying and assessing the risks to achieving its sustainable business objectives and developing aneffective response, an organization considers the risk that actors will engage in fraudulent activities suchas intentional misstatements or misappropriation of valuable resources.

POINTS OF FOCUS
 onsiders various types of fraudC
As part of its risk assessment activities, theorganization identifies the means by which
actors may intentionally harm the organizationin satisfying its sustainable business objectives.
This includes the risks of using technology
to knowingly misstate information or
misappropriate resources. As part of the risk
assessment process, the organization conducts
brainstorming sessions to consider scenariosthat could result in fraudulent activities.

Assesses opportunities
In its risk assessment, an organization considers
the means by which illegal activity, fraud, andother malfeasance related to its sustainablebusiness management might occur. Examples
include the modification of records, making
misstatements or omissions to the market
and other stakeholders, and misappropriating
resources meant for the organization’s use.
 ssesses attitudes and rationalizations
A
An organization’s risk assessment processincludes obtaining an understanding of attitudes
and reasons actors might rationalize illegal,
fraudulent, or wrongful behavior regarding theorganization’s sustainable business activities.


Assesses
incentives and pressures
As part of its sustainable business management,
an organization assesses its risks as a target ofillegal activity, fraud, and other malfeasance.
The organization considers pressures on
management, employees, and other actors tomeet certain sustainability-related targets or
achieve certain outcomes.

INSIGHTS
Pressures and opportunity for fraud: Employees often face ambitious deadlines for sustainable businessperformance and ESG reporting. There may also be lofty expectations for “good news” on meetingtargets and delivering encouraging messages to the community. Unidentified risks and limited resources
to satisfy stated objectives contribute to these pressures. The desire to meet expectations can encourage
malfeasance, including incomplete or inaccurate reporting to capital markets, particularly investors with
ESG-related criteria such as screened funds and ESG lending instruments. These risks can be reduced withimproved governance, risk assessment, and control and monitoring activities.
Employee attitude: Employees may view sustainability as trivial rather than integral to an organizationachieving its objectives (Principle 6). This creates risks that the organization’s policies and system of oversightare less than effective because actors lack incentives to carry out assigned responsibilities with respect
to sustainability. Worse, these circumstances can incentivize intentional activities that are counter to61

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

the organization’s commitment to integrity andobjectives. Considering the 17 principles in ICIF2013, including tone at the top (Principle 1) andaccountability (Principle 5), can initiate control
activities to respond, manage, and mitigate theserisks.
Similarly, in some cases, members of corporate
responsibility or sustainable business functions,along with colleagues in other departments
involved in the process, may be unfamiliar with
controls and oversight systems. This could makethem less aware of the potential for fraudulent
activities and reporting.

Companies are entering the green bondmarket. Many of these offerings have been
oversubscribed, indicating the demand.
The issuers of these bonds are increasingly
requiring some form of assurance or
attestation over ESG-related data anddisclosures as a condition of issuing andmaintaining green bonds.
—Kristen Sullivan, Partner, Global Audit andAssurance Sustainability & Climate Services
Leader, Deloitte

Anti-fraud rule and potential litigation: In the
U.S., all publicly held entities subject to the SEC’s
jurisdiction are subject to the anti-fraud provisionsof the Securities Exchange Act of 1934 and related regulations (Section 10(b); SEC Rule 10b-5). Manystates have similar anti-fraud provisions related to securities and other commercial transactions. Under
these laws, a company or its directors and officers can be held legally liable for intentional material
misstatements (or the omission of material information) regardless of whether the information is partof a regulatory filing or otherwise disseminated to the market. Therefore, even if sustainable businessinformation is not part of a regulatory filing but appears voluntarily on a company’s website, press
releases, product information, or other materials, if it is fraudulent, it can result in liability.

CASE IN POINT: SECURITIES FRAUD ALLEGATIONS BASEDON PRODUCT INFORMATION
In 2021, a class-action lawsuit was filed against Rayna Scientific (fictional), a company that specializes
in bio-based substitutes for plastic products such as drinking straws, packaging, and shopping bags.
The company’s product information, used to secure contracts with large retailers, convenience stores,
and cafés, touted its products as biodegradable, renewable, and sustainable. An investigative reportpublished by a major financial news service asserted that Rayna’s products were not biodegradable asclaimed. Following this report, the market price of Rayna’s stock dropped 35%. As a result, a lawsuit
claiming securities fraud was filed against the company and three of its senior officers.

Green lending, incentives for misstatements: Financial institutions are offering various types of lending
arrangements based on ESG metrics. These arrangements, which are generally referred to as “green
bonds,” “ESG-linked bonds,” or “GHG-reduction bonds,” are becoming prevalent, particularly outside
the U.S. Although they may be called different titles or terms, they require that a borrower confirm ordeliver ESG information to the lender to secure benefits. For example, an arrangement may specify
that the borrowed funds are used for specific sustainable business projects, or the arrangement may
have interest rate terms that adjust downward if the borrower hits specified ESG or emissions-reduction
targets. These arrangements can create incentives for misstating either the use of borrowed funds or

62

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

the achievement of specified metrics in the lending agreement. These are risks that a company’s control
and oversight system aim to mitigate. Internal or external audits are a means for confirming compliance(Principle 16 and Principle 17).
Responding to fraud risks related to sustainable business activities: All actors, both within andoutside an organization, may engage in fraudulent activities. This includes management, full-timeand part-time employees, freelancers, and consultants. It also includes suppliers, contractors, andsimilar third parties. In the arena of sustainable business, it is particularly important to consider the
representations and reliability of these third parties. Today, for example, companies are taking a numberof steps, including:• Looking to outside solutions to assist in the data collection, analysis, and reporting of sustainablebusiness information.
• Relying on external certifications, such as product compliance.
• Hiring consultants or specialists to perform or lead in certain sustainable business activities.
Engaging other professionals and organizations in the process of integrating sustainable businessactivities can be valuable. However, it also may raise concerns around fraud risk. Quality oversightsystems, as explained in ICIF-2013 (see Component: Control Activities), can help the organizationachieve its sustainable business objectives and mitigate fraud risks.
Internal audit procedures for fraud: Internal audit authoritative guidance states that an internal auditor
must consider the probability of significant errors and fraud in developing engagement objectives (seethe IIA’s International Professional Practices Framework, Section 2210.A2). This work incorporates
procedures for considering, preventing, and detecting fraud not only relating to financial reporting but
also to satisfying sustainable business objectives.
External auditors, responsibilities regarding fraud and sustainable business reporting: As a generalmatter, auditors of financial statements must consider the risk of fraud and respond with appropriate
audit procedures for detection. Some externally reported ESG information is reflected in the financial
statements, including the notes specifically covered by an audit, and, in such cases, the auditors’ work
would extend to this sustainable business information. However, many ESG disclosures are delivered
outside of the basic financial statements and notes, and, therefore, auditors’ responsibility with respect
to the information follows other rules (see Principle 15 for discussion).
Association of Certified Fraud Examiners (ACFE)/Grant Thornton materials on ESG and fraud
risk: A publication by the ACFE and Grant Thornton, Managing Fraud Risks in an Evolving ESG
Environment, leverages the ACFE’s materials into an ESG Fraud Taxonomy. This report illustrates
how existing concepts and models apply to sustainable business activities and provides examples
of sustainable business risks related to fraud, including corruption, misappropriation of assets, andmisleading disclosures (see Figure P8-1: Grant Thornton’s ESG Fraud Taxonomy).

63

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKFIGURE P8-1: GRANT THORNTON’S ESG FRAUD TAXONOMY

Source: Managing Fraud Risks in an Evolving ESG Environment64

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

9. Identifies and analyzes significant changes and emerging trends
The organization identifies and assesses changes that could significantly impact the system ofinternal control. (ICIF-2013-9)
As part of identifying and assessing risks to the achievement of its sustainable business objectives, anorganization considers emerging trends. Sustainability-related risks are evaluated in an ongoing manneror periodically to respond to regulatory trends and economic drivers.

POINTS OF FOCUS
 ssesses changes in the externalA
environment
As it conducts its risk assessment process, theorganization considers external factors that canaffect its sustainable business activities. These
include regulatory proposals, economic trends,
and physical risks.

is ongoing so that it can respond to changes
and trends that may affect its business model,
strategy, and, in turn, oversight processes.

 ssesses changes in the business modelA
An organization’s assessment of trends insustainable business management and reporting ssesses changes in leadershipA
To respond to changes and trends insustainability, the organization reconsiders
the structures, authorities, and responsibilities
of its actors to ensure that it can respond to
new risks.

INSIGHTS
Operational assessments uncover sustainable business opportunities: A key tenet of effective
management, including the management of control and oversight systems, is continuous improvement(Principle 16 and Principle 17). It is effective practice for an organization to perform operational reviewsof its sustainable business efforts and evaluate them against best or leading practices, as these evolveand mature. Some management accounting professionals view this as akin to the adage “the best
defense is a good offense.” It involves looking at opportunities and evaluating the risk of missing out onthem (Principle 7).
Reassessing materiality and decision usefulness: As conditions change, the metrics or assessmentsof what information is material (under regulatory definitions) or decision useful for management andother stakeholders will change. It is critical for an organization to consider all factors—both internal andexternal—in setting guideposts.
Keeping up with regulatory movement and mandates: Regulatory mandates for sustainable businessinformation are accelerating. Many organizations rely on their legal and policy professionals to deliver
timely information about these changing requirements. Ensuring that legal counsel and policy teams
identify and communicate new and pending mandates is a control activity (Principle 3). However, it isalso helpful for other actors to keep up with the accelerating pace of change in jurisdictions around theworld. Some of these may be accessible through specialized legal databases and commercial platforms.
In addition, publicly available websites that monitor regulatory instruments may be helpful.

65

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

Keeping ahead of new reporting regulations: Actors throughout the sustainable business ecosystem,
such as preparers, assurance providers, and consultants, are anticipating new regulations and standards
from the SEC, ISSB, European Commission/EFRAG, and other authorities such as stock exchanges. Even
before these regulations and standards become mandatory, companies are considering their governanceand risk management structures, information systems, and talent capabilities to meet these expecteddemands. Responding to these new regulatory demands before they are enacted or finalized may
demonstrate an effective internal control function. Further, competitors’ decisions to provide disclosures
to the market is often a strong driver for action, even before regulatory adoption.
In sum, waiting until final regulations are adopted can be less than an effective means of meeting anorganization’s interrelated categories of objectives (Principle 6).

DISCLOSURES REGARDING FORWARD-LOOKING
INFORMATIONAs noted in Principle 6, sustainable business information is, to a substantial extent, forward-looking
and based on expectations, assumptions, and estimates. Inherently, the underlying data upon whichsuch forward-looking assessments are based change. In the U.S., securities regulations provide asafe harbor for forward-looking statements, and some companies have begun to provide disclosures
regarding the applicability of this safe harbor to ESG disclosures. These safe harbor-related
disclosures can be extensive. As an example, the Salesforce Form 10-K for year ending January 2021
explains risks to meeting its ESG objectives:
Our aspirations and disclosures related to environmental, social and governance (“ESG”)
matters expose us to risks that could adversely affect our reputation and performance.
We have established and publicly announced ESG goals, including our commitment to advancing
racial equality and justice and reducing greenhouse gas emissions. These statements reflect
our current plans and aspirations and are not guarantees that we will be able to achieve them.
Our failure to accomplish or accurately track and report on these goals on a timely basis, or atall, could adversely affect our reputation, financial performance and growth, and expose us toincreased scrutiny from the investment community as well as enforcement authorities.
Our ability to achieve any ESG objective is subject to numerous risks, many of which are outsideof our control. Examples of such risks include:• the availability and cost of low- or non-carbon-based energy sources;• the evolving regulatory requirements affecting ESG standards or disclosures;• the availability of suppliers that can meet our sustainability, diversity and other ESG standards;• our ability to recruit, develop and retain diverse talent in our labor markets; and• the success of our organic growth and acquisitions or dispositions of businesses or operations.
… If our ESG practices do not meet evolving investor or other stakeholder expectations andstandards, then our reputation, our ability to attract or retain employees, and our attractivenessas an investment, business partner, acquiror or service provider could be negatively impacted.
Further, our failure or perceived failure to pursue or fulfill our goals and objectives or to satisfy
various reporting standards on a timely basis, or at all, could have similar negative impacts or
expose us to government enforcement actions and private litigation.

66

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKMonitoring the maturation of sustainability
issues: Over time, matters that now fall under
the category of sustainability received growing
recognition. At one time, these matters wereconsidered niche or localized issues, but
circumstances brought the issues to the agendas
of NGOs or other stakeholder groups. Awarenessspread. Examples of these issues include GHG
emissions, climate-related risks, conflict minerals,
and workplace safety. As these issues mature, newdemands for transparency may arise that resultin voluntary reporting or mandatory disclosurerules. Not all sustainability matters fully mature
along this continuum. However, organizations canbenefit from identifying mid- to longer-term issues
by tracking public filings, academic studies andreports, NGO activities, and social media trends.
By following the maturation of these issues,organizations can prepare for the risks thesechanges may bring about, or they may innovate
their own strategies to seize the opportunities
from emerging issues.

It’s imperative to understand yourcustomers and their ESG goals. Evensmaller and/or private companies may
face increased risk by virtue of a moreconcentrated customer base. Whencustomers send a questionnaire, they
expect a timely and accurate
response. Even if you are notresponsible for climate reporting to
the SEC next year, you may still needto collect and report data to yourcustomers to protect your revenue
and reputation.
—Christopher McClure, Partner, ESG
Services Leader, Crowe LLP

Competitor business models and products: Competitors serve as an important external driver forchange. Competitors’ actions can prompt an organization to act, not only with respect to reporting
but also, more broadly, with respect to its business model. For example, consider companies that
produce flooring for offices and commercial properties, equipment components for fuel pumps, or
furniture for retailers. As the changing marketplace drives more competitors to manufacture productsthat meet sustainability criteria, an organization that fails to innovate may be subject to significant
risks. Following the ICIF-2013 principles, competition can drive an organization to reconsider its
purpose (Principle 1) and its objectives (Principle 6) and embrace changes that can create valuable
opportunities and competitive advantages.
Changing internal dynamics: Often, drivers for movement toward sustainable business activities comefrom within an organization.
Today, employees serve as a key stakeholder voice for innovation and change. This is not only
about environmental issues but also, as importantly, about human resources (or human capital) issues,
the “S” in ESG, such as diversity, pay equity, hiring and promotion criteria, recognition for well-doneaccomplishments, and satisfaction for contributing to the organization and the global community(Principle 4).
Organizational events can also trigger change. Sales or business development teams may execute amajor contract. Product lines or entire divisions may wind down. The organization may be approachedabout a merger, divestiture, or spin-off. These changes can affect how the talent resources feel about
their commitment and engagement. As Principle 9 instructs, all these events alter risks and the plannedmeans for response and management. They may bring about the development or modification ofcontrols to ensure that the organization continues to achieve its sustainable business objectives.

67

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKThe role of the CFO has evolved as 21st Century companies now operate in aworld where working in silos is unproductive and, instead, business issues aremanaged cross-functionally. Today, CFOs are in a unique position to see acrossthe enterprise and connect those dots, to build trusted relationships, achievebusiness goals, drive connectivity, and meet stakeholder demands. That’s why
having a bird’s-eye view is essential to maintain agility, whether embracing new
trends or pivoting to meet new regulations, such as developments around SEC
climate disclosures.
When I speak to other CFOs, many are accepting this new normal andimplementing an ESG strategy. In 2020, ESG became an intentional part of ourorganizational culture and business objectives. It’s cross-functional, and it touches
supply chain, social aspects, governance, and more. So, a holistic view is criticalto the success of the business.
Good governance and data collection play key roles in balancing purpose andprofit. As they say, you can’t manage what you don’t measure. We know firsthandthat having data from integrated systems in one place enables tracking andreporting. Cross-functionality is more important than ever to be auditable andtraceable, and with new regulations emerging, staying ahead of change isnonnegotiable.
—Gina Mastantuono, CFO, ServiceNow

68

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

Component: Control Activities
10. Selects and develops control activities
The organization selects and develops control activities that contribute to the mitigation of risks
to the achievement of objectives to acceptable levels. (ICIF-2013-10)
Once an organization has identified and assessed risks to achieving its sustainable business objectives, it
designs, develops, and implements means to counter these risks, partly or completely. This helps ensure thatoversight activities are responsive to sustainable business objectives, including reporting, and related risks.

POINTS OF FOCUS
Integrates with risk assessment
The selection and development of oversightactivities regarding an organization’s sustainablebusiness activities flow from its risk assessment
processes.

business objectives, an organization carefully
considers the nature of the risk and the types ofindividual actions or combination of actions thatwill be effective in responding to these risks.
 onsiders at what level activities are appliedC
Effective responses to risks on meeting anorganization’s sustainable business objectives
require the assignment of activities at different
levels within the organization.

 onsiders entity-specific factors
C
There are no one-size-fits-all means to develop
and implement oversight activities that respondto identified and assessed risks regarding anorganization’s sustainable business activities,
which may reflect its specialized or uniquebusiness model and strategy.

 ddresses segregation of duties
A
The concept of “segregation of duties” means
processes are designed for internal checks andbalances that help ensure the veracity, accuracy,
and completeness of sustainable businessinformation. This means evaluating howtransactions that affect the organization’s ability
to meet its sustainable business objectives are
initiated, approved, processed, reported, andreconciled to other financial and sustainablebusiness information.

 etermines relevant business processesDAn organization considers the structures,
policies, procedures, and assigned authorities
and responsibilities over its sustainable businessactivities to respond to identified and assessedrisks to meeting its sustainable businessobjectives.
 valuates a mix of control activity types
E
To respond to the risks of meeting sustainable

INSIGHTS
Performing a readiness assessment: Internal audit and external professional service firms, acting as
consultants, have significant expertise in considering risks and assessing system effectiveness, sometimes
called “readiness assessments.” These assessments can bring forward the steps that an organization may
take to improve its systems in a way that parallels the techniques used for mainstream financial reporting.
The Center for Audit Quality observes that a readiness assessment of sustainable business activities

69

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

may give an organization an independent viewof various interrelated activities, such as selecting
a reporting framework, evaluating reporting
processes, designing and implementing internal
controls, identifying available information, andrecommending governance structures. Further, areadiness assessment may provide a basis for an
attestation engagement at the desired level ofassurance (Principle 16).

For ESG, a rigorous control
environment has often not yet
been established. In many
instances, the organization may
not have engaged compliance andinternal audit in ESG reporting.
There are many ESG-related
activities, but they are notharnessed within the same type ofcontrol environment as financial
reporting. The existing (often
informal) procedures will need tobe reviewed and potentiallyredesigned. Companies often
already utilize platforms forfinancial reporting, vendor andsupplier management, and otheractivities that have embedded
controls. It is possible these can beleveraged for ESG.

Third-party certifications as a control activity: A
key risk relating to sustainable business informationis the reliance on third parties (Principle 7). As
a control activity, organizations may look tocertifications (other than the reports of independent
auditors on the financial statements). This includes
third-party verification of supplier operations andrepresentations. In doing so, however, it is important
for the organization to consider and ensure thatthe confirmation mechanisms of the information
provider are reliable. An organization will benefit
from understanding the underlying methodologies
and criteria for certification and whether they alignwith its own policies and objectives.

Balancing centralized vs. decentralized data
flow: Today, meaningful sustainable businessinformation comes from both centralized anddecentralized data flows. For example, humanresources may have centralized data regarding
full-time and part-time personnel and independent
contractors by using a commercial platform. On—Christopher McClure, Partner, ESG Services
the other hand, if the organization operates at
Leader, Crowe LLP
multiple locations, its facilities management may
be decentralized. Decentralization, however, has
benefits to how an organization operates, and it is not necessarily an indicator of poor management. For
sustainable business activities and reporting, it is beneficial to understand, document, and communicate how
existing systems will be leveraged and the new systems that have become necessary to meeting sustainablebusiness goals. This data also needs to be reviewed for accuracy, relevance, and reliability.
In designing control and oversight activities, looking at the balance of centralized vs. decentralized
information streams, as Principle 10 suggests, provides necessary observations toward building an effective,
integrated oversight plan that reduces risks (Principle 7) in meeting organizational goals (Principle 6).
The need to design and implement control activities around prioritized sustainable businessactivities: The design and implementation of oversight systems and controls around sustainable businessactivities and information need to be prioritized. Invariably, a new area, such as sustainable business, can70ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

accelerate and raise practical challenges for organizations
in responding to emerging and changing risks(Principle 7 and Principle 9). Nevertheless, as sustainability
grows in importance, organizations are responding by stating
a purpose (Principle 1) and objectives (Principle 6), andfollowing up with structures (Principle 3) and procedures.
The overarching goal is decision-useful information thatfacilitates setting strategy to achieve performance goals andpreserve and create value.
For example, professionals have observed that today’sorganizational controls around sustainable businessactivities and information flow may be improved andrespond to identified risks by:•A ssigning responsibilities with specificity(Principle 3).
• Communicating duties to employees (and outside
actors) with clarity and adequate background information(Principle 4 and Principle 14).
• Providing informal knowledge-sharing opportunities orformal training to familiarize employees (and other actors)
with sustainable business concepts (Principle 4).
• Establishing roles and internal organizational structures thatare aimed at meeting specified objectives(Principle 6).
• Evaluating information sources for reliability with internal
control techniques such as inquiry, walk-through, document
inspection, recalculation, and reconciliation (Principle 10).
• Managing data from outside parties, such as vendors(Principle 7 and Principle 12).
• Leveraging existing technology (Principle 11).
• Modernizing and investing in innovative technology
solutions (Principle 11).
•F ormalizing existing ad hoc processes(Principle 12).
• Documenting and simplifying a myriad of processes(Principle 12 and Principle 13).
• Enhancing cross-disciplinary communications among
departments (Principle 3 and Principle 14).
• Working with internal audit to reevaluate and respond torisks (Principle 7 and Principle 14).
• Utilizing insights raised by external auditors(Principle 15).
• Considering insights raised by external stakeholders
regarding the organization’s effectiveness in achieving its
purpose in a responsible manner (Principle 15).

71

There are internal controls relating
to governance, competence,
policies, data, communications,and fraud, among other areas.
Companies need sustainabilityrelated internal controls in all ofthese areas, notably as it pertains
to sustainability information
disclosed to capital markets.
Processes and data are, in manycases, currently accepted at facevalue. Processes should bedesigned, implemented, andtested to the same extent as forfinancial reporting. In addition,members of senior leadershipincreasingly are being asked tocertify sustainability data, whether
for inclusion in public filings or for
financial institutions, insurance
carriers, or other business
partners. Leaders are asking those
responsible for the data if they
can sign these certifications, andthe answers they get often are
not reassuring, since in manycases, the accuracy of the data
has not been assessed.
—Michael Littenberg, Partner and Global
Head of ESG, CSR, and Business andHuman Rights, Ropes & Gray LLPACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

11. Selects and develops general controls over technology
The organization selects and develops general control activities over technology to support theachievement of objectives. (ICIF-2013-11)
An organization designs its control activities to respond to risks to achieving its sustainable businessobjectives. In doing so, it considers the extent to which it will rely on technology. This includes
leveraging existing IT systems to the collection, processing, reporting, and security of sustainablebusiness information, such as GHG emissions, energy usage, water usage, waste management, supply
chain management, and diversity.

POINTS OF FOCUS
 etermines dependency between the useDof technology in business processes andtechnology general controls
In designing an oversight system to assess andmanage identified sustainable business risks, anorganization determines the extent to which it
will rely on technology-based solutions.

 stablishes relevant security management
E
process control activities
In its use of technology as part of its responses
to managing risks, an organization determines
the nature of necessary controls to ensure thereliability and integrity of sustainable businessinformation as it is processed from source toultimate user.

 stablishes relevant technology
Einfrastructure control activities
Management oversees the design anddevelopment of technology to effectuate
control activities. These control activities overtechnology infrastructure help ensure that
requisite sustainable business information iscomplete and accurate.

 stablishes relevant technology acquisition,Edevelopment, and maintenance processes
control activities
To effectuate its use of technology as a meansof oversight of sustainable business information,an organization sets up and maintains oversightactivities that include acquisitions, retirements,and maintenance activities.

INSIGHTS
Defining information technology general controls (ITGC): ICIF-2013 provides additional insight
into control activities over IT. It describes ITGC to include controls over infrastructure, security
management, acquisition, development, and maintenance. It states that these guidelines apply to allof an organization’s technology, including mainframe, desktop, portable, and mobile, as well as to bothmanual and automated activities. Further, depending on a range of factors such as complexity and risk ofunderlying processes, ITGC will vary among organizations.
Structured/unstructured data; excessive reliance on spreadsheets, outside systems of control andoversight: In typical data processing, output from one system becomes the input into another system.
Mature financial reporting systems align the flows and interfaces between input, throughput, and output
across various systems. This system-to-system data flow calls for structured data, that is, formattingthat permits the systems to communicate (see Figure P11-1: Regulatory Reporting and Compliance—A
Fragmented Ecosystem).

72

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

If the systems are unaligned, manual intervention by skilled professionals is required to ensure thatthe output of one system is reprocessed in the necessary format for submission to the next system.
For example, in order to meet documentary and data formats for regulatory filings, the data from ERP
software is compiled and repackaged.

FIGURE P11-1: REGULATORY REPORTING ANDCOMPLIANCE—A FRAGMENTED ECOSYSTEM

Source: A Digital Transformation Brief: Business Reporting in the Fourth Industrial Revolution

One of the most significant concerns regarding oversight processes of sustainable businessinformation is the lack of sophisticated technology systems compared to the infrastructure available formainstream financial reporting. At many companies, teams have relied upon spreadsheets and email
to gather information in a way that fails to capture the data sourcing and the information trail. Control
activities, such as described in Principle 11, include the appropriate use of technology to preserve andensure the integrity of information as it flows from the original source, through categorizing, sorting, andanalyzing, until it reaches the ultimate user.
Commercial platforms dedicated to producing and delivering sustainable business information:
Sustainable business reporting, for both internal and external users, typically relies on information thatcomes from multiple internal systems, including, for example, human resources systems, facilities,

73

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

operations, and procurement (Principle 10).
As an organization matures in its sustainablebusiness activities, it can standardize more of its
processes for gathering information through its
Companies that recognize the
ERP and financial reporting systems. This facilitates
strategic importance of ESG embed
not only the processing of information, but also
allows for the organization to apply automaticthese issues into their long-term
checks and preserve it to enhance integrity.
performance goals. This is especially
Consultants and commercial software providers
true with technology. Although
are offering platform solutions for gathering,
categorizing, sorting, analyzing, and reporting
technology is always advancing,sustainable business information via dashboards
organizations should take stock offor internal decision making and into reports forexternal users. These systems, which structure
existing systems to understand how
information that comes from various sources
they can be leveraged to collectwithin an organization, can be an efficient andinstrumental part of an organization’s design ofrelevant information for analysis.
control activities over its sustainable business
Likewise, if a company is alreadyinformation processes because they containundergoing digital transformation,
built-in audit trails that capture the steps inprocessing the information. This trail helps ensure
ESG should be part of that
information completeness, accuracy, and integrity.
conversation to ensure that new
In addition, this information can serve as a basis
for improving the system itself (Principle 16). In
technology systems are ready toshort, the technology turns unstructured data into
incorporate ESG. A lasting ESG
structured data so that it can be integrated andtracked, eventually for reporting on management
approach should draw the samedashboards, annual reports, and regulatory filings.
levels of investment as other coreAt the same time, however, some organizations
business workflows, including
are finding existing platforms for ESG reporting
too inflexible for their companies’ individualautomation, blockchain, AI, andneeds. They have developed, over a few years, andata analytics.
individualized reporting agenda and selected KPIs,
and the spreadsheets are suited to their needs.
—Maura Hodge, IMPACT Audit Leader, KPMG
In addition, some preparers report that they have
tried accounting solutions in the past that failed
Source: ”The ESG Reporting Journey Take the first steps … before it’s too late”
to meet their needs. For example, commercial
solutions became available when U.S. GAAP
and IFRS changed the accounting for leases, but preparers found many inadequate. As a result, they
may be reluctant to consider commercialized IT for new sustainable business information and reporting
demands.
Use of tagging technology toward interoperable reporting: A Digital Transformation Brief: Business
Reporting in the Fourth Industrial Revolution, which looked at studies on the cost of compliance,
showed that the expenses of producing multiple reports for multiple users, both internal and external,
and for multiple jurisdictions is staggering and wasteful. The current cut-and-paste approach from report

74

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

to report, even at some of the largest global companies, has been a financial reporting challenge even
without the additional demands of sustainable business information and reporting. Technology can serve
as a critical means to improve corporate reporting along the information ecosystem from data source toultimate user. Looking closely at the flow of information, two moments really matter: the moment of data
creation and the moment a piece of data (or a summary of data) is used.
Government agencies and regulatory authorities often seek to reduce the costs of businesscompliance. The technological processes around these two moments are referred to as “RegTech”
for regulatory technology and “SupTech” for supervisory technology (see Figure P11-2: Regulatory
Data—from Source to User). More specifically, RegTech means the enhanced management of regulatory
reporting and compliance processes through technology. Following this definition, the term “RegData”
refers to the individual data points that an entity submits to a regulatory agency to comply withdisclosure requirements. Many regulated entities must retain unique capabilities to satisfy obligations
for a multitude of regulatory formats and bodies. SupTech means tech-enabled supervision, review ofinspections, and data analysis by regulatory agencies. Regulatory authorities incur costs for publishing,administering, monitoring, and enforcing regulations. Meanwhile, regulated entities incur costs tocomply with regulatory and information obligations or to have information readily available for inspection
upon request by a regulatory examiner. This fragmented and divergent regulatory ecosystem is a core
issue associated with existing compliance and statutory reporting costs and risks.

FIGURE P11-2: REGULATORY DATA—FROM SOURCE TO USER

Source: A Digital Transformation Brief: Business Reporting in the Fourth Industrial Revolution

This digital transformation process is changing the means of reporting from a periodic document
to the delivery of data sets. Nevertheless, although taxonomies exist for financial reports, they are
the beginning stage for sustainable business information. Regulators in most of the world’s capital
markets are mandating the use of XBRL (eXtensible Business Reporting Language) or similar tagging
technology, and standard setters such as the FASB, IASB, and SASB (now part of the ISSB) are working
to deliver well-designed taxonomies so that reports issued in compliance with the respective standards
are readily deliverable in machine-readable form. In addition, with the collective support of regulatorylevel authorities, such as through the International Organization of Securities Commissioners (IOSCO),

75

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

standard-setting organizations are working toward
a common taxonomy and interoperable standards.
Using tagging technology can certainly enhancereporting efficiency. Further, it can be an effectivemeans of control over the information produced,
as indicated in Principle 11, as these systems
rely on metadata and can capture the flow of
information through processing and into a report.

In our work, we do look to the
COSO world. For example,
when we are considering
Scope 2 emissions arising frompurchased electricity, we needto consider how we monitor
subservice providers. Certain
service providers, such as ADP,
can provide a SOC 1 report for
payroll. If it’s a third-party
provider that cannot provide
this, we want to look atmonitoring procedures ingreater detail.

Ensuring oversight of outsourced, third-party
service providers: Because sustainable businessactivities and information processes are new,many organizations look to outside consultants
and service providers. In some cases, these
service providers only deliver technology, andimplementation and ongoing usage of the systemremain in the hands of the organization. In othercases, the organization looks to the external
provider as a consultant or to serve as the primarymeans of gathering and processing information.
Outsourcing does not remove accountability
from the organization, regardless of the size,
sophistication, innovativeness, or reputation of thevendor. The organization is still responsible for the—Kevin O’Connell, ESG Trust Solutions
controls and for the completeness, accuracy, andPractice and Global Asset & Wealthreliability of the data. Depending on information
Management ESG Leader, PwC
from external parties can raise risks that could
undermine the organization’s objectives(Principle 6 and Principle 7). However, when designed and implemented with care, including thecrafting and communication of policies and procedures (Principle 12), outsourcing can help further theorganization’s control and oversight over sustainable business information.
The AICPA has established a suite of services, System and Organization Controls (SOC), for CPAs toprovide information on the system-level controls of a service organization or entity-level controls of otherorganizations. These engagements yield reports on a subject organization’s control systems with thegoal of communicating on system management, effectiveness, and risks. The suite is comprised of three
categories of engagements: SOC for Service Organizations, SOC for Cybersecurity, and SOC for Supply
Chain. SOC for Service Organizations is further subdivided into “SOC 1,” “SOC 2,” and “SOC 3” basedon the purpose of the engagement and the auditing guidelines that are applied (see Table P11-1: AICPA
Trust Services Principles—Summary).11
Following from the concepts that underlie the SOC system, an organization can help ensure thatsustainable business information and processes of third-party providers are adequately controlled tocounter identified risks (Principle 7). Regarding its sustainable business information processes, theseIn addition, auditors of public companies in the U.S. must comply with PCAOB Auditing Standard (AS) 2601, Consideration of an Entity’s Use of aService Organization, which generally aligns with the AICPA guidelines.
11

76

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

steps can include:• Selecting service providers with competencies in internal control.
• Evaluating service providers against control policies and procedures and following up on deviations(Principle 16).
• Monitoring the sourcing of data within the organization.
• Testing information, on a selected basis, such as through recalculation or reconciliation.
• Obtaining and assessing a SOC or similar report.
• Taking any appropriate follow-up actions for noted deficiencies (Principle 17).

TABLE P11-1: AICPA TRUST SERVICES PRINCIPLES—SUMMARY

Professional standards
and interpretive
publications

SOC 1 Reports

SOC 2 Reports

SOC 3 Reports

AT-C Section 320, Reportingon an Examination of Controls
at a Service Organization
Relevant to User Entities’
Internal Control Over
Financial Reporting

AT-C Section 205, AssertionBased Examination
Engagements

AT-C Section 205,
Assertion-Based Examination
Engagements

AICPA Guide Reporting on an
Examination of Controls at aService Organization Relevant
to User Entities’ Internal
Control Over Financial
Reporting (SOC 1®)

AICPA Guide SOC 2 ®
Reporting on an Examination
at a Service Organization
Relevant to Security,
Availability, Processing
Integrity, Confidentiality, orPrivacy

What is the subject
matter of theengagement?

Controls at a service
organization relevant to user
entities’ internal control overfinancial reporting

Controls at a service
organization relevant
to security, availability,
processing integrity,
confidentiality, or privacy

Controls at a service
organization relevant
to security, availability,
processing integrity,
confidentiality, or privacy

What is the purpose of
the report?

To provide management of
the service organization,user entities, and the
independent auditors of user
entities’ financial statementswith information and aservice auditor’s opinion
about controls at a service
organization that are likely tobe relevant to user entities’
ICFR. A SOC 1 report enables
the user/auditor to perform
risk assessment procedures
and, if a type 2 report isprovided, to use the report as
audit evidence that controls
at the service organization are
operating effectively.

To provide management ofa service organization, user
entities, and other specified
parties with information
and a service auditor’sopinion about controls at theservice organization relevant
to security, availability,
processing integrity,
confidentiality, or privacy.

To provide interested parties
with a service auditor’sopinion about controls at theservice organization relevant
to security, availability,
processing integrity,
confidentiality, or privacy.

Source: AICPA Trust Services Principles and Criteria

77

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

12. Deploys oversight through policies and procedures
The organization deploys control activities through policies that establish what is expected andprocedures that put policies into action. (ICIF-2013-12)
An organization uses various means of oversight to direct its sustainable business objectives. Primaryamong these means is established policies and procedures. These policies and procedures promoteclarity in how the organization will meet its sustainable business objectives.

POINTS OF FOCUS
 stablishes policies and procedures toEsupport deployment of management’s
directives
To fulfill its sustainable business objectives,
an organization creates policies that facilitate
management’s decision making on how it utilizes
the control environment to respond to risks.
This includes not only creating new policies
and procedures regarding sustainable businessactivities but also modifying and adapting
existing policies to meet these objectives.

 akes corrective action
T
Engaging in sustainable business activities
can raise risks around ineffective planning,
miscalculation, and error. However, in afunctioning and effective oversight system,
this is expected, and the processes aredesigned so that an organization’s actors, undermanagement’s leadership, can respond to resetcourse. This also means that the organization
may revisit its existing policies for enhanced
effectiveness.

 stablishes responsibility and accountabilityEfor executing policies and procedures
An organization establishes structures andestablishes policies and procedures so that actors
can respond to identified and assessed risks andsatisfy its sustainable business objectives.

 erforms using competent personnelP
For an effective control and oversight system,an organization puts into place people whoare competent and knowledgeable aboutsustainable business and how processes canbest function. This includes reassessment for
additional training.

Performs in a timely manner
Carrying out control processes supports anorganization’s meeting its objectives provided
that they are performed in a timely manner.
The organization can benefit from considering
the goals and needs of its sustainable businessteam members before their concerns become
problematic.

 eassesses policies and proceduresR
The oversight of the sustainable businessactivities that an organization implements
through policies and procedures is revisited
to respond to changing circumstances,
objectives, and risks.

INSIGHTS
Consideration of oversight and reporting boundaries in setting policies and procedures: As
addressed in Principle 3, the boundaries used for sustainability management and ESG reporting may
differ from those used for financial reporting. As a result, it is important for an organization to consider
affiliates, investees, and other organizations for which it has control or influence in setting policies andprocedures regarding sustainable business activities.

78

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

Importantly, there are standards that organizations leverage for voluntary reporting, such as the GHG
Protocol and similar standards, that call for boundaries and measurements that are not specified withclarity, which results in variation in practical application. Over time, standards likely will be enhanced withclarification and implementation guidance, but, today, interpretations can result in inconsistencies absent
formal internal documentation and clarity around external requirements. Today, at many organizations,this remains a challenge.
Further, under voluntary reporting, processes of continuous improvement regarding the availability ortransparency of data have been deemed acceptable, and strict adherence to ESG reporting standards
may not have been exercised. As we move to a regulated reporting environment that includes assurance,internal policies and procedures will need to be enhanced, formalized, followed, and documented.
Timeline for reporting: A key part of policies and procedures for financial reporting and sustainablebusiness reporting is timing. Many companies have an established timeline for the preparation, review,audit, and release of their financial reports. The sustainable business reporting team may have its own
timeline that is driven by other needs, such as personnel availability, data availability, and requests fromrating agencies, and, typically, these sustainability reports are released well after the filing of Form 10-K
or Form 20-F (in the U.S.) or similar statutory reports in non-U.S. jurisdictions. Bringing these timelines
into alignment presents a practical challenge for many companies. However, as an organization’s
objectives begin to overlap and disclosure represents connectivity of sustainable business and financial
information (Principle 6), establishing and communicating meaningful and collaborative timelines serves
as an important oversight and control mechanism.

ORGANIZATIONAL SUSTAINABILITY POLICIES
Principle 1, Principle 6, and Principle 12 direct an organization to establish policies and procedures
to express and operationalize its goals and oversight systems regarding business sustainability. Manyorganizations have begun to disclose these policies in their sustainability reports or similar materials(Principle 15). For example, the Bank of America Corporation Environmental and Social Risk Policy(ESRP) Framework provides detailed communication for both internal and external parties that aligns
with ICIF-2013, as follows:
As a financial institution, risk is inherent in all of our business activities. At Bank of America, theprinciples of sound risk management are embodied in our values, operating principles and Codeof Conduct, which all employees are expected to follow. Our Risk Framework describes our risk
management approach and provides for the clear ownership of and accountability for managing
risk well across the company. Key to this philosophy is that all employees are accountable for
identifying, escalating and debating risks facing the company.
We have established this Environmental and Social Risk Policy (ESRP) Framework to provide
additional clarity and transparency about how we approach environmental and social risks, which
touch almost every aspect of our business. Like all risks, environmental and social risks require
coordinated governance, clearly defined roles and responsibilities, and well-developed processes
to ensure they are identified, measured, monitored and controlled appropriately and in a timely
manner.

79

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKCONTROL AND OVERSIGHT OF SUPPLY CHAIN SOURCING
Applying Principle 7 can raise risks regarding the accuracy and validity of claims regarding sustainably
sourced inputs. To respond to these risks, companies can develop policies and procedures that
address interaction with suppliers and the reliability of their information. For example, as describedin its 2021 Sustainability Report, Whirlpool Corporation has developed a detailed, three-category
approach to ethical compliance that includes a supplier code of conduct, third-party due diligence,and compliance with U.S. conflict mineral rules. The company describes its Responsible Sourcing
programs as follows:
Our Responsible Sourcing programs help us look at what we purchase beyond the more
traditional aspects of cost, quality and delivery. This means we consider ethics, labor rights
and social and environmental issues when sourcing products and services across all purchasing
categories and regions. Our goal is to minimize negative impacts and make a positive contribution
to the businesses, people and communities we support through ethical purchasing practices.
This program is managed by a team of global procurement professionals working in collaboration
with our ESG Task Force, legal, ethics and compliance, sustainability, global product organizationand inclusion and diversity teams.
Whirlpool provides further description of its policy, including 12 tenets of its supplier code of conductthat includes child labor, forced labor, health and safety, women’s rights, and nondiscrimination. It alsodetails its approach to supplier audits and remedial action. These activities, following from Principle 12,
demonstrate how organizations can apply oversight to control sustainability risks from suppliers.

Management-sponsored audits, consortia approach: As a management control, an organization
may initiate audits of entities along the value chain. These audits can serve as mechanisms to build
confidence, for example, that suppliers are meeting specific requirements, including criteria that alignwith the organization’s code of conduct or procurement policies. At the same time, suppliers may
become inundated with multiple customers’ demands for audits that are only slightly differentiated. As a
response, organizations in the same industry may form consortia to establish consistent audit approaches
and oversight. This approach, which also relates to obtaining and using relevant data (Principle 13),has been applied in the areas of hazardous waste treatment and disposal sites and for the sourcing ofconflict minerals. These steps represent valuable control activities.
Internal audit’s role in supplier audits: In some cases, a full supplier assessment, in accordance withan organization’s set policies and led by an internal audit team, is not possible because criteria havenot been clearly articulated or the data is inadequate. However, as Aaron Gagnon, partner and chief
audit officer at McKinsey & Company, relays, there is value in internal audit addressing the situation withan advisory or consulting engagement. In this way, he says, “The functional areas involved in supplier
responsibility activities could learn about controls and can take steps to formalize and mature theirprograms.”

80

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKDIVERSITY, EQUITY, AND INCLUSION POLICIESEmbracing the value of diversity, equity, and inclusion, organizations are revisiting existing policies
and setting new internal guidelines. These initiatives are within the umbrella of sustainable businessactivities, as they are often categorized under the “S” for “social” in ESG. Fifth Third’s 2021 ESG
report, for example, addresses the company’s various policies around this aspect of human capital,
including enhanced paid leave for military service, a detailed disability accommodations policy,
multicultural recruitment policies, and a supplier diversity program. These programs, along withother relevant metrics of progress, are detailed in the company’s report. Specifying expectations andtargets, along with instituting procedures to accomplish them, are indeed part of an effective internal
control system.

81

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

Component: Information and Communication
13. Uses relevant information
The organization obtains or generates and uses relevant, quality information to support thefunctioning of internal control. (ICIF-2013-13)
An organization needs quality data that informs whether its processes are facilitating its ability to meet its
sustainable business objectives.

POINTS OF FOCUS
Identifies information requirements
A critical purpose of an internal control systemis the delivery of reliable, decision-usefulsustainable business information. This means
not only substantive data but, as importantly,
information on how the systems themselves arefunctioning.

information and, as a next step, employs tools
for summarizing and analyzing the data into
decision-useful information.
 aintains quality throughout processingM
An effective system of controls preserves thereliability and integrity of information as it
flows through various processes from source todecision maker.

 aptures internal and external sourcesCof data
An effective oversight system of anorganization’s sustainable business activities
depends upon the capture of requisite datafrom internal and external sources.

 onsiders costs and benefitsC
In designing oversight and control systems,
an organization considers the risks of decision
making on imperfect or potentially unreliable
information along with the resources that would
need to be expended to reduce the risk to an
acceptable level.

 rocesses relevant data into informationP
An effective control and oversight systemgathers important sustainable business

INSIGHTS
Leveraging existing finance, IT, and internal audit competencies: The governance of sustainablebusiness information and ESG reporting relies on the competencies of corporate professionals in thefinance, IT, and internal audit functions (Principle 4). The professionals in these functions have a trained
mindset and specific skills that, when employed, can help ensure that organizational decisions are basedon information that is valid, reliable, and relevant. From the perspective of compliance with externalreporting standards, the role of the CFO is sometimes referred to as the steward of the “one version of
the truth.” This can apply meaningfully not only to financial data but also to sustainable business data.
Additionally, and importantly, financial reporting can be more retrospective than the data fromoperational or engineering systems. Although financial reporting considers data based on estimates andexpectations, it is generally a high-level summary of what has already happened over a period of time.
Conversely, engineering and operating system data supports real-time intervention to correct problems.
For this reason, operational data is a critical source of decision-useful data that supports sustainable82

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKBLOCKCHAIN AND SIMILAR TECHNOLOGIES FORSUSTAINABILITY DATA
A key risk in connection with sustainable business information is the reliance on third parties,
particularly as it relates to components from suppliers (Principle 7). Today, the use of powerful digitaltechnology, such as blockchain, may help a company track inventory from the source throughout
its movement around the globe. At the same time, it preserves data as the goods physically move.
This creates a traceable audit trail. For example, SAP is using its GreenToken blockchain technology
to provide Unilever a system to trace the source of palm oil. This technology is an effective way toimplement controls that support an organization’s sustainable business activities.

business activities and progress toward initiatives.
Moreover, an effective internal audit function
can provide internal assurance independent ofmanagement over sustainable business informationand ESG reports. Working inside an organization
but reporting directly to an independent audit
committee of the board of directors (Principle 2),
an effective internal audit function can ensure theintegrity of information.

Do due diligence with the data that’s
available (including your accountability
system) before setting goals.
—Tim Mohin, Partner and Director, Boston
Consulting Group; former CEO, Global
Reporting Initiative

Balancing financial and operational
information to business decision making
around sustainability: It is generally contended by some professionals that sustainable business datais less reliable than financial data for decision making. However, it is important to remember that as anorganization considers and builds processes over sustainable business information, the systems andprocesses regarding financial information may also benefit from improvement, particularly around decisionusefulness (Principle 16 and Principle 17). In fact, the building of information systems around sustainablebusiness data can rekindle attention to existing systems and whether the output is decision useful.
Creating a traceable audit trail: One of the fundamentals of good oversight and control is maintaining
information and documentation about the process itself. This means that an organization retains dataso that it can trace the review and approval process over sustainable business activities and information.
This demonstrates that professionals with adequate knowledge and training participate in the process(Principle 4). It documents the steps that they take, which may include full, partial, or selective validationof the information or sample recalculations. It also helps ensure that the information is presented in a
way that is meaningful and represents the organization’s actual underlying activities. To some extent,
planning and implementing appropriate technology can facilitate the documentation and review process(Principle 11). Software solutions can preserve the traceability of information and the processes used tomove data from source to user.
Modernizing internal audit programs to cover sustainable business processes: After determining
areas of risk (Principle 7), it can be valuable for an organization to look to its existing internal auditing
plans in a way that considers its sustainable business objectives (Principle 6). This can lead to revisiting
and modernizing processes and procedures over specific areas, such as technology, safety, procurement,

83

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKINTERNAL CONTROL ASSESSMENTS OVER CYBERSECURITY
Cybersecurity and privacy of customer information is an important aspect of good sustainablebusiness management. It speaks to an organization’s responsibility for its clients’ data. Assessing
whether an organization’s security and privacy policies are functioning and effective provides insighton whether the organization is meeting its system objectives. For example, in its 2022 ESG report,
FedEx describes its oversight process regarding its cybersecurity and customer information policy,
including the role of internal audit:
We recognize the importance of protecting the privacy of our customers, vendors, and teammembers, and we deliver on this commitment by proactively ensuring a safe and secure online
environment. With the increasing presence and sophistication of online threats, we must ensure
continuous improvement to protect our business and our customers.
The Cyber and Technology Oversight Committee of the FedEx Board is responsible for reviewing
the management and mitigation of our cyber and technology-related risks and discussing these
initiatives with leadership. Our Global Privacy Office regularly reviews our practices and policies toensure we maintain compliance with all relevant regulations across our operating companies. Our
Internal Audit team also conducts periodic audits of our Privacy Compliance Program to ensure
our controls are working effectively.
The FedEx description exemplifies multiple aspects of ICIF-2013, including board oversight(Principle 2), risks, including technology risks (Principle 7 and Principle 9), established policies andprocedures (Principle 12), and the gathering of information, led by internal audit, to determine theeffectiveness of the system itself.

privacy, talent, and the environment. In sum,looking to existing audit programs can accelerate
the organization’s meeting its objectives. These
audit programs can reflect existing enterprise-wideknowledge: staff who know the organization, its
business, operations, and policies and processes.
Internal audit may then evaluate competencies
and gaps to redirect resources to address
sustainable business activities and information.

Visualization tools enable highlighting of themost important combinations of data through
KPIs and metrics. This approach to telling thestory behind the data makes sustainablebusiness information accessible and ready for
analysis in a user-friendly way.

Data visualization and sustainable business—Loreal Jiles, Vice President, Research andinformation: Sustainable business information
Thought Leadership and Global Head ofoften must be collected from multiple sources,
DE&I, Institute of Management Accountants
aggregated into a single repository, analyzed,
and reported to internal and external users in ameaningful way to inform business decisions. Based on the largely unstructured nature of sustainablebusiness information today, the use of digital technology is critical to organizations’ successful
implementation of viable solutions that address initial challenges around information.
Specifically, data visualization tools such as Tableau or Power BI can be leveraged in sustainablebusiness management efforts by facilitating the tracking and presentation of KPIs as well as monitoring
ESG-related performance metrics that inform progress toward sustainable business objectives. Throughautomatic data feeds and use of dashboards for digestible presentation, these tools can aid in the84

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

aggregation and analysis of sustainable business information, and, ultimately, support strategic decision
making and reporting.
The output of data visualization tools, by nature, is typically highly customizable. That is, end users
are often able to modify configuration, calculations, and visuals in dashboards, offering less control than
traditional finance applications that customarily include robust built-in access restrictions. However,as FP&A teams around the globe have begun utilizing these tools to monitor and present financial
performance to key stakeholders, teams inheriting sustainable business management responsibilities
could also reap the benefits of data visualizers. In adoption and use of these tools, it is advised thatteams take caution with respect to controls and end-user computing to confirm data transformation isappropriate and is aligned with established data integrity, measurement, and reporting principles.
Considering data availability when setting objectives: The setting of sustainable business objectives(Principle 6) typically leads to the establishment of new activities and information streams. Conversely,
however, considering the availability of data from existing systems can inform how an organization
sets its initial sustainable business objectives. That is, the organization establishes goals that it canmeet readily with existing information and systems. This begins a learning curve on how to set targets
and improve. As an organization matures, it can then use the information that it collects for moresophisticated data modeling and analytics. A lack of sophistication does not mean that an organization
avoids getting started on its sustainable business journey (Principle 1).

85

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

14. Communicates internally
The organization internally communicates information, including objectives and responsibilities forinternal control, necessary to support the functioning of internal control. (ICIF-2013-14)
Once an organization establishes oversight structures and expresses policies and procedures, it
communicates these structures and policies throughout the organization. This communication facilitates
the understanding of all actors regarding their responsibilities for meeting the organization’s sustainablebusiness objectives.

POINTS OF FOCUS
 ommunicates internal control information
CAn effective system of control informs thosewith responsibilities for carrying out anorganization’s sustainable business activities
about expectations regarding the process.
That is, the organization not only
communicates substantive information
regarding transactions, events, andexpectations but also information about thefunctioning of the system itself.

Informal communication with senior leaders
was often more effective than formal audits. It
built trust and changed behavior—and itemphasized the importance of controls.
—Aaron Gagnon, Partner and Chief Audit
Officer, McKinsey & Company

 ommunicates with the board of directors
C
An organization’s systems bring decision-useful
information to its board of directors so that theboard can carry out oversight responsibilitiesof the organization’s sustainable business activities.

Providesseparate communication lines
Alternative communication channels (thatis, outside regular reporting lines) allow for
the delivery of information about system
functionality directly to decision makers andthose with responsibility without dilution orinterference.

 elects relevant methods of communication
S
An organization has various means ofcommunicating the effectiveness of its oversightsystems regarding its sustainable businessactivities. Different means of communication
are effective in facilitating a responsible andmeaningful response. For example, somecompanies use an intranet platform, and others
may announce objectives and progress via
town halls.

INSIGHTS
Value of internal communications around sustainability performance: It is valuable for an
organization to have means to communicate sustainability objectives, targets, and performance. Thiscan be particularly impactful with respect to factors that the organization can control through theactions of management and employees in the areas of operations, facilities, procurement, and customer
information.

86

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

Employee perspectives as a resource: People in different areas of an organization may have uniqueand important perspectives on drivers, direction, and pace of change in areas that relate to theorganization’s sustainable business objectives. Open channels for inbound communications provide one
mechanism for organizations to see what is out there and what may be on the horizon. It is beneficial forthe team to be open and prepared to act with agility on new information (Principle 4 and Principle 5).
Ethics and integrity programs: Many organizations have company-wide ethics and integrity programs
that promote employees and other key stakeholders (contractors) to embrace a speak-up culture. These
have evolved from the days of the suggestion box in the company cafeteria. Today, mechanisms can
include one-on-one meetings with management, dedicated email addresses, and dedicated hotlines. A
grievance process may be required by regulations or collective bargaining agreements. These internal
communication controls can be effective and efficient in achieving sustainable business objectives
including assessing workplace harassment, diversity and inclusion, and full payment of wages.

87ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKCASE IN POINT: COMMUNICATING EMPLOYEE EXPECTATIONSThe CEO of an international transportation and shipping company realizes the importance of communicating thecompany’s commitment to sustainable business to all of its employees. Looking to Principle 14, she determines that all
employees are part of the achievement of these objectives in a way that promotes positive engagement. She directs
the company’s internal communications team to develop a company-wide promotional campaign that ultimately
includes:• In-person and virtual learning sessions sponsored by the sustainability team that work as a book club with a particulartheme;• Monitors around the main corporate office that rotationally display sustainability facts, the company’s purpose, and values;• Invitations for employees to submit ideas on how to improve the company’s sustainability efforts;• New facts and material routinely displayed on the company’s intranet;• Stylized content for posting on LinkedIn delivered to leaders to share sustainability news;• Alerts at town halls or through email blasts when the company publishes sustainability reports;• Posters hung in shared areas that explain ways that employees can act to achieve objectives;• Periodic messaging on the company’s purpose and values on the company’s messaging system;• Encouragement for employees to submit ideas on how to improve the company’s functionality to deliver onsustainability; and• A game application as an incentive for knowledge sharing on the company’s corporate intranet and publicizing inlunchrooms and via company-wide computer systems, such as screensavers.
Although these actions are not punitive but positive, they are important control features as they emphasize theimportance of the company’s sustainable business objectives and the responsibility of all employees for achieving them.

SUSTAINABILITYKNOWLEDGE SHARING
Launch: Waste Watchers
Going Live | March 1, 11 a.m. ET
Share your knowledge of how
Gary Industries—with your help—is exceeding
triple bottom line expectations

People, Planet, Profit
Answer a daily question on GaryNet.
Winners over three-month period
will receive valuable gift cards and lunch
meeting with Nathaniel Alan, CEO

88

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

15. Communicates externally
The organization communicates with external parties regarding matters affecting the functioningof internal control. (ICIF-2013-15)
Once an organization establishes oversight structures and expresses policies and procedures, it
communicates these structures and processes to external parties, such as debt and equity investors andother stakeholders, that are relying on these processes for the delivery of reliable sustainable businessinformation.

POINTS OF FOCUS
 ommunicates to external partiesC
An organization informs its external regulators,
investors, and other stakeholders about its
oversight systems regarding sustainable businessactivities and the effectiveness of these systems.

 rovides separate communication linesP
An organization establishes means ofcommunication so that frank feedback may be
acted upon. It also requires consideration of
information from outside actors that interact
with the organization and develop viewpoints
that build (or diminish) reputation and value.

 nables inbound communications
E
An effective oversight system includes meansfor communications from external parties thatare interested in the organization’s sustainablebusiness management and ESG reporting.

 elects relevant methods of communication
S
An organization has various means tocommunicate its trustworthiness and its
oversight systems that support representations
about its trustworthiness. Board members,senior management, and certain functions, suchas investor relations and public relations, havespecific roles and responsibilities in delivering
information externally and, in some instances,delivering information to external users pursuant
to law.

 ommunicates with the board of directors
C
An organization delivers information to its boardof directors so that the board can effectively
perform responsibilities over the delivery ofsustainable business information to external
parties.

INSIGHTS
Reporting on control effectiveness: In the U.S., under SOX and related SEC regulations, a CEO and
CFO of a publicly held company must issue a report on the effectiveness of an organization’s control
systems over financial reporting. This includes the financial information reported both within the financial
statements and notes in periodic reports to the SEC (see Background regarding SOX Section 404). In
addition, a registered, independent accounting firm must issue an opinion on management’s report.
Therefore, any ESG disclosure processes that overlap with financial reporting requirements, such as
annual reports, are subject to SOX Section 404.
Jurisdictions outside of the U.S., generally, do not have similar requirements to SOX Section 404 that
require the disclosure of internal control assessments. However, other reporting mechanisms support
the disclosure of sustainable business control and oversight systems. One prominent means for insight
into these control systems is the TCFD recommendations, which several jurisdictions around the world
appear to be in the process of adopting in some form. The TCFD recommendations, as issued, raised
11 points of disclosure that cover governance, risk, strategy, and measurements. In designing and89

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

implementing systems to support making these disclosures, particularly around governance and risk,
an organization benefits from applying ICIF-2013. The Framework allows for consideration, insight, andassessment of whether an organization’s system itself is capable of providing financial-related disclosuresaround climate and other ESG risks.
These requirements reflect the heart of Principle 15, external reporting on an organization’s system ofinternal control. To satisfy these requirements, almost all filers look to ICIF-2013.
Responsibilities of external audit or assurance providers: Determining auditors’ responsibilities for
ESG disclosures can be complex. The nature of responsibilities depends on:• What rules are applicable in a jurisdiction.
• Whether the auditor has been engaged to provide assurance on specific ESG-related disclosures.
• How the ESG information is delivered to users (that is, via regulatory filing, annual report, or elsewhere,
such as a website).
In the U.S., auditors of the financial statements of public companies follow the rules and guidelines of
the PCAOB. Auditors of private entities follow the generally accepted auditing guidance of the AICPA.
In many jurisdictions outside the U.S., auditors follow the standards issued by the International Auditing
and Assurance Standards Board (IAASB).
If the information is outside of the basic financial statements, auditors’ responsibilities depend onwhether the company has provided specific assurance on particular items of disclosure. To provide thisassurance, specific standards are followed. The IAASB has issued a number of interpretive releases on
conducting assurance engagements for sustainable business information. In addition, the IAASB islooking to revise International Standard on Assurance Engagements (ISAE) 3000 (Revised),
Assurance Engagements Other than Audits or Reviews of Historical Financial Information andrelated standards to address the increased demand for clarity on how to conduct engagements forassurance of sustainable business information. One step further, the IAASB standard-setting agenda
includes contemplation of a separate, stand-alone assurance standard for sustainability. Other
commonly used standards, internationally, for assuring sustainability information include the AA1000
Assurance Standard (issued by AccountAbility) and ISO 14064-3:2019, Greenhouse gases—Part 3:
Specification with guidance for the verification and validation of greenhouse gas statements.
In the U.S., the PCAOB is revisiting its existing attestation standards, which have been labeled as“interim” and have remained generally unamended since 2003 when the PCAOB took over oversightfrom the AICPA. The PCAOB observes that capital market developments and changes in auditing
are driving reassessment of this standard, and it is surmised that this may include how a registeredaccounting firm performs attestation engagements on ESG disclosures and control assessments. Some
contend, however, that the PCAOB does not have the authority to set rules regarding the attestation of
information that is outside of financial statement audits.
The area that requires careful consideration and interpretation of existing rules are ESG disclosuresthat are not subject to specific attestation procedures and are outside of the basic financial statements.
Sometimes, these disclosures accompany an annual report, such as a management commentary section
or in the management discussion and analysis section of a Form 10-K. In such cases, auditors are looking
to existing rules regarding information that accompanies a set of financial statements(see Table P15-1: Standards Related to Information that Accompanies Audited Financial Statements)
to consider the extent of responsibilities for ESG information.

90

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKTABLE P15-1: STANDARDS RELATED TO INFORMATION THATACCOMPANIES AUDITED FINANCIAL STATEMENTSPCAOB, AS 2710, Other
Information in Documents
Containing Audited Financial
Statements

AICPA AU-C
Section 720,
The Auditor’s Responsibilities
Relating to Other Information
Included in Annual Reports

IAASB, ISA 720 (Revised), The
Auditor’s Responsibilities Relating
to Other Information

Anti-fraud rules: Regardless of how ESG information is delivered to the market, an issuer must comply withthe law that prohibits misrepresentation or fraudulent disclosures, such as SEC Rule 10b-5 (Principle 8). This
includes information provided in the financial statements, other parts of an annual report, websites, and press
releases.
State of Play—assurance over ESG information: Regardless of jurisdiction, a certified or charteredaccountant issues reports on underlying information that either provides “reasonable assurance” or“limited assurance.” A reasonable assurance engagement is described as providing “audit-level”
assurance. This means that the practitioner can express a conclusion about whether the subject report orinformation is in compliance with specific regulations or standards. On the other hand, limited assurance
is often described as “review-level” assurance. This means that the practitioner has collected lessevidence than what would be gathered and examined for a reasonable assurance engagement and can
express a conclusion about whether any matter has come to the practitioner’s attention that the subject
information is materially misstated.
Following from this demand, a 2022 report titled The State of Play in Reporting and Assuranceof Sustainability Information: Update 2019-2020 Data & Analysis provides a global study on theprevalence of assurance on external sustainability disclosures. In summary, the study found:• About 58% of companies evaluated in the study were publishing sustainability information with at least
some assurance;• Among the companies that did obtain assurance, a little under two-thirds (61%) used audit or auditaffiliated firms; and• The prevalence of obtaining assurance differed among jurisdictions.
The State of Play report also determined that 82% of all assurance engagements regarding sustainablebusiness reporting result in limited assurance reports rather than reasonable assurance. In sum, theresearch shows that reasonable assurance over sustainable business information may be a stakeholder
goal, but it has not yet been implemented.
This predominance of limited assurance, however, may change in the future (Principle 9). The exposure
drafts for new sustainability reporting regulations and standards speak to reasonable assurance—on
par with financial reporting—as a goal (see Background). For example, the proposed climate disclosure
regulations by the SEC expressly call for a phased-in approach; if adopted as exposed, it initially would
require limited assurance with a stated plan to move toward reasonable assurance within two years as
systems of oversight mature. At the same time, the ISSB’s proposed S1 and S2 proposals seek feedback
on how to address assurance, and EFRAG is charged with developing standards to implement the CSRD,
which requires assurance. Stakeholders in the preparer and audit communities generally are expressingthat regulators and standard setters indeed consider the state of internal systems and use a phased-in
approach (rather than an all-at-once approach) regarding new ESG disclosures.

91

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

Selective disclosure of ESG information:
In responding to requests for sustainability
information, publicly held companies subject to
the SEC’s jurisdiction in the U.S. need to consider
Regulation Fair Disclosure, referred to as“Reg FD.” These rules aim to ensure that investors
have equitable access to company information.
This means that a publicly held company
cannot prefer certain financial institutions andindividual investors over others with informationthat could be used for trading advantages. As
more sustainable business information becomesintegrated or connected with financial reporting,organizations must use care to ensure compliance.
Applying ICIF-2013, with particular considerationof Principle 15 and how an organization
communicates externally about the effectivenessof its systems, can further this objective.

Phasing in these requirements
is sound policy—but it isimportant for stakeholders tounderstand the type ofassurance provided, including
the relative level of reliancethey can place on each type.
—Marie-Laure Delarue, EY Global
Vice Chair, Assurance
Source: The emerging sustainability information ecosystem

Whistleblowers on ESG: The SEC maintains a whistleblower program that allows for the confidential
reporting of a public company’s activities that indicate fraud (Principle 8). As the SEC and otherregulators mandate external reporting of sustainable business information as part of securities filings,
it will likely expand its program to include whistleblowers for this type of information. In 2021, the SEC
announced an enforcement task force on climate and ESG issues, and it is conducting enforcement
actions in connection with ESG disclosures. As a result, it is particularly important for an organization to
be transparent with its actors and engage them to help build the organization’s sustainability agenda.
Considering the influence of impact investors: The term “impact investing” means different things
to different people, but it generally can be defined as “directing capital to enterprises that generatesocial or environmental benefits” such as affordable housing, sustainable forests, and internet accessin developing countries. That is, impact investors aim to direct capital toward organizations that
demonstrate commitment and performance associated with specific sustainability topics. Impact
investors often go beyond scraping publicly available information and engage on an ongoing basis withinvestees. Appropriate controls can help organizations prioritize these requests and evaluate whether
they have accurate, reliable data that is truthful and responsive.

92

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

Component: Monitoring Activities
16. Conducts ongoing and/or separate evaluations
The organization selects, develops, and performs ongoing and/or separate evaluations toascertain whether the components of internal control are present and functioning. (ICIF-2013-16)
Once implemented, an organization revisits its oversight structures and processes to ensure that they are
effective in facilitating its ability to meet its objectives around sustainable business. These reassessments
may be scheduled and ongoing, or they may be performed as specific needs arise.

POINTS OF FOCUS
 onsiders a mix of ongoing and separateCevaluations
An organization conducts reviews of how wellits oversight systems regarding its sustainablebusiness activities are functioning. These
assessments may be regularly scheduled andongoing, or they may occur as circumstanceschange.

sustainable business to be effective and useful,persons who conduct them need to havethe requisite knowledge to understand theobjectives, processes, and control features.
Integrates with business processes
For either ongoing or ad hoc assessments ofan organization’s sustainable business activities
to be effective and useful, they must consider
the organization’s actual business, transactions,operations, processes, and expectations.

Considers rate of change
In monitoring an oversight system of its
sustainable business activities, an organizationconsiders how quickly demands and drivers for
additional change will emerge that may requirea reassessment of the effectiveness of existingprocesses.

 djusts scope and frequencyA
As time goes on and circumstances change,
an organization reassesses the timing of
its assessments and review of its processes
regarding its sustainable business activities.

 stablishes baseline understandingE
An understanding of an organization’s existingmeans for monitoring its systems regarding
sustainable business activities is necessary
before it can drive improvements and respondto new risks and opportunities.

 bjectively evaluatesO
To promote the effectiveness of anorganization’s system of oversight of its
sustainable business activities, periodic or
ad hoc oversight assessments are conductedobjectively and without undue bias. This also
demonstrates a commitment to transparency
and accountability.

 ses knowledgeable personnelU
For either ongoing or ad hoc assessments of anorganization’s systems of oversight regarding

93

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKINSIGHTS
Decision usefulness of an effective evaluation
We need to have controls inprocess: An organization benefits from engaging
competent professionals to assess its sustainability
place to support an audit.
performance processes and outcomes. This
helps ensure that its activities and processes—Mark LaMonte, Partner,
deliver information that reflects its operations
WilliamsMarston LLC
accurately and how the organization is using its
available resources. This allows for improved
processes and improved outcomes. Moreover, this evaluation process is highly beneficial regardlessof whether the organization uses its internal audit function or submits any of its disclosures to external
audit or assurance examinations or reviews. In the end, management has an ultimate role to playin understanding sustainable business objectives and designing and implementing processes andprocedures to see them carried out.
Internal audit’s evaluation role: An important responsibility of the internal audit function is to assess andmonitor the performance of an organization’s controls. This monitoring function applies to ICSR as well as
ICFR. It extends to any risks that could affect the organization achieving sustainable business objectives.
In planning and conducting an audit of financial statements, external auditors obtain an understandingof the internal audit function (see, for example, PCAOB AS 2605: Consideration of the Internal Audit
Function). An effective internal audit function provides assurance independent of management, and, withthe right competencies, it can provide assurance related to controls over sustainable business information.
Internal audit can also facilitate the work of external assurance providers, when engaged. Advisory (orconsulting) efforts to help management design, implement, and improve a broader range of controls
related to sustainable business objectives are also within the purview of an effective internal audit function.
Second-line audits of high-risk areas: Management may sponsor supplemental audits that serve
effectively as monitoring controls over high-risk areas, such as workers’ health and safety, product safety,
or cybersecurity. Many of these specific audits evolved with a targeted purpose, such as mitigationof regulatory enforcement risk. As sustainability issues become more prominent, the risks relating tothese issues have intensified or changed (Principle 9), but, in many cases, the audit programs may nothave followed. Nonetheless, internal audit professionals have the experience and skill sets that can be
redirected to improve controls by collaborating with operational teams (in the second line) to consider
these evolving risks.
Material weaknesses identified by independent auditors: In the context of financial reporting,auditors issue a report on the effectiveness of internal control systems (Principle 15), and their work canprovide valuable means for identifying material weaknesses in oversight systems. As part of the process,the auditor communicates, in writing, to management and the audit committee material weaknesses
identified during the audit. Their observations of identified weaknesses can provide a road map for
improvement, which can be enormously insightful in identifying and responding to new risks regarding
sustainable business activities and information. Although the application of auditor responsibilities
with respect to ESG reporting in accordance with attestation standards is unsettled, the concepts andprocesses around identifying control deficiencies could be applied by management to improve its
oversight systems around sustainable business information.

94

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

Material weaknesses identified by internal
auditors: The value of identifying and explaining
material weaknesses applies not only to external
auditors but also, as importantly, to internal
auditors. Their work can lead to a reassessmentof structures (Principle 3), risks (Principle 7,
Principle 8, and Principle 9), and thedevelopment of new processes and policies(Principle 12) in a way that supports thedevelopment of talent resources (Principle 4). In fact,
the work done internally to build functioning andefficient control systems over sustainable businessactivities and information is a predicate to the
execution of efficient audits.

The COSO Framework is
ideal and completely
applicable for wide use bycompanies in Europe as thebasis for controlling
sustainability information.
One notable aspect thatneeds to be continually
reinforced is the importanceof culture and integrated
thinking. It underscores that acontrol framework is only as
good as the understanding
people have of theimportance of reliable
information for decision
making. And assurance will
only work and be affordable
if we have a system of control
and digitized data; otherwise,
it will degenerate fast into a
box-ticking exercise based on
price point.

Verification by nonaccounting firms: Financial
reporting professionals and internal audit arefamiliar with the standards of assessing andreporting on internal controls.
However, due to the specialized nature of some
aspects of sustainable business, organizations may
look to other external providers for an external
assessment of controls over sustainable businessactivities and information. These nonaccountant
providers may have significant expertise in
relevant areas such as GHG emissions, energy
usage, water usage, human resources policies andmetrics, and IT. Their work can provide valuable
insights into an organization’s sustainability
practices and information that set a road map for
progress.
Yet the use of providers other than certified orchartered accountants for external assessments
has its critics. Detractors raise, for example, alack of clarity around independence and general
concerns around quality control. They also cite the—Charles Mario Abela, Seniorclarity in generally accepted auditing standards
Strategic Advisor, Value Balancing
between limited assurance and reasonable
Alliance
assurance that nonaccountants may not follow
and raise a lack of understanding and disruption
throughout the data and information chain.
The board and management evaluate the degree of needed assurance, relative competencies, andmarket and regulatory expectations in deciding how to best achieve Principle 15 and Principle 16 for an
organization.

95

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

17. Evaluates and communicates deficiencies
The organization evaluates and communicates internal control deficiencies in a timely manner tothose parties responsible for taking corrective action, including senior management and the boardof directors, as appropriate. (ICIF-2013-17)
As an organization reassesses its structures, policies, and procedures regarding its sustainable businessactivities, it communicates its findings so that actors better align their activities in accordance with theorganization’s sustainable business objectives.

POINTS OF FOCUS
 ssesses results
A
To promote the effectiveness of anorganization’s system of oversight of its
sustainable business activities, the results of its
periodic or ad hoc evaluations are assessed to
identify means for improvement and progress.

regarding its sustainable business activities, itfollows up to ascertain whether the upgrades
and improvements are working as expected
and enhancing its ability to meet its sustainablebusiness objectives.

 ommunicates deficiencies
C
To promote the effectiveness of anorganization’s system of oversight of its
sustainable business activities, the resultsof its periodic or ad hoc evaluations arecommunicated by management to appropriate
actors to facilitate improvement and progress.

Sustainability is a process and not an
outcome. We’re looking at newtechnology, new processes, and new
solutions to continue to reduce ourgreenhouse gas emissions. And it’s
our CFO team that serves as theconnectivity across all functions. The
accounting team brings the insights,
the analysis, and expertise inreporting—all grounded in a set of
ethics. We look to building processes
that are reliable and give high-quality
data subject to internal controls and arigorous review process. It’s necessary
to set roles and responsibilities andthen identify the gaps. It’s an excitingtime in that we’re going from concept
to action.

 onitors corrective actions
M
Once an organization develops and implements
means to improve its oversight systems

INSIGHTS
The value of reassessment: A meaningfulmonitoring system may lead to strategic
reassessment and an organizational reflection
on its commitment to carrying out its purpose(Principle 1) and objectives (Principle 6). Fromestablishing vision and goals, the organization candevelop meaningful risk assessments (Principle 7
and Principle 8) that are future-ready (Principle 9).
While all ICIF-2013 components are interrelated,the one ICIF-2013 area that is likely going tomature is control activities, as set out in the third
component. Here, documentation is key, as thefocus is not limited to the substance of sustainable—Patti Humble, Chief Accounting
Officer, UPS

96

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

business activities and reporting, but, as importantly, on the processes that help the organizationaccomplish its goals. Reassessment, therefore, is more than a means of oversight. It facilitates anorganization’s ability to evaluate, change, and continue to thrive.
In many ways, sustainable business reporting is still subject to evolution and innovation. As a result,it will be a process of continuous improvement.

ESG DISCLOSURES AND CONTROL PROCESSES
Heineken N.V.’s annual report, which includes extensive sustainability-related information, provides
an assurance report by Deloitte Accountants B.V. This assurance report, addressed to its annual
general meeting and other stakeholders of Heineken, concludes:
We have reviewed a selection of sustainability data as stated on page 125-165 of theaccompanying Annual Report for the year 2021 (“the sustainability data”) of Heineken N.V (“theCompany”), Amsterdam. A review is aimed at obtaining a limited level of assurance.
Based on our procedures performed nothing has come to our attention that causes us to believethat the sustainability data in scope for our review is not prepared in all material respects, inaccordance with the reporting criteria as included in the section ‘Reporting Basis and Governancefor non-financial indicators’.
The scope of Deloitte Accountants’ review was to provide limited assurance on specific metrics
and commitments that Heineken provided in the section of its report titled “Our Brew a Better
World 2030 commitments and progress in 2021.” These metrics include reduction of GHG
emissions, increases in the use of energy from renewable sources, the use of sustainable barleyand hops, the use of landfills, the representation of women and regional nationals in its leadershipteam, fair wages, and workplace safety.
These reflect the company’s stated purpose of brewing “togetherness” to inspire a better world
and its stated values: passion for consumers and customers; courage to dream and pioneer; carefor people and planet; and enjoyment of life.
Heineken’s reporting also reflects the ICIF-2013 principles. Starting with its purposes and values,
it sets objectives and targets (Principle 6). It speaks to setting company policies (Principle 12) andcontrols at the operating entity level and process level (Principle 10). Specifically, regarding
Principle 17, the report states, “Compliance with company policies is periodically assessed. Deviations
from the defined standards are included in the global monitoring and follow-up processes, supporting
management in addressing these deviations. Management is responsible for definition and timely
implementation of action plans to remediate any deficiency identified as part of these assessments.
The results are reported to the Executive Board.” These disclosures (Principle 15) describe internal
structures and communications (Principle 3 and Principle 14) and ultimate oversight by the company’sboard of directors (Principle 2).

97

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKPRINCIPLES IN ACTION:
ILLUSTRATIVE CASESThis section provides three illustrative examples. Although fictional, each is a composite that draws on
the real-world practices in the types of companies presented.
As with ICFR, it is critical that the application of ICSR is scalable to organizations of diverse sizes,
industries, and equity ownership. Moreover, the usefulness of ICIF-2013 to sustainability is not a onesize-fits-all perspective. The principles and points of focus help an organization to build effective controls
based on its own business model and operations.

98

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

Illustration: A publicly held organization subject to disclosure regulations
considers its reporting agenda
Sorrolti Industries (fictional) is an industrial company with an 80-year history of organic growth andacquisition to become one of the top 10 brands in a competitive sector. The company operates in many
regions and countries worldwide that have varying requirements and expectations for sustainability
performance, reporting, and risk. Sorrolti has significant operations and opportunities in the EU. Sorrolti’s
shares are publicly listed around the world, including equities markets in North America, Europe, South
Africa, and Asia.
Sorrolti’s sustainability programs have been ranked in the top quartile by various NGOs for morethan a decade. This has enhanced its reputation, and executives believe it has facilitated customer
engagement, employee engagement, and growth (Principle 1). Nonetheless, Sorrolti needs to comply
with new and proposed disclosure mandates in multiple jurisdictions. To do so, company management
must monitor changes in external requirements and expectations, and, importantly, it must continue toimprove its system of oversight and controls.
First, the company considers its reporting agenda. The company has already looked to several global
standards and frameworks as inputs to its sustainability programs and objectives, as well as the overall
objectives of the company (Principle 6). The UNGC is a significant strategic driver for all the standards
and frameworks. The company has used this to inform its high-level strategy, responsible attitude, andtone at the top (Principle 1). The company has reported information in accordance with GRI. It hasmonitored sector standards issued by SASB and initiated reporting on applicable parameters. The strong
internal controls have served as an excellent foundation to meet additional changes in the last five years(Principle 9). The company has used and augmented its system of controls to prepare for disclosuresaccording to TCFD. The company has already performed a readiness assessment that identified gaps,
and it is modifying its system controls to prepare for the broader regulation, specifically, the CSRD andthe standards proposed by EFRAG.
Sorrolti developed an IT system to manage sustainability data, with initial scope targeted for externallyreported information (Principle 11). Over the last decade, the company has continued to refine thesystem by linking it effectively to other systems that house data. This enables internal management andreporting on sustainability topics, including health and safety, environmental, and human resources. The
company has also linked its systems to those used for financial management and reporting. The internal
system has controls to avoid duplication of input and reduce risk of errors (Principle 11). Sorrolti’s
management and IT leadership have considered new offerings from commercial software providers. Theinternal team has concluded that all would require considerable adaptation and duplicate efforts thecompany has already invested into its in-house system.
Sorrolti’s core internal team gathered data and information that was readily available (Principle 4). As
employees and business partners recognized the intent and outcome of sustainability reporting, more
expressed willingness to contribute, and the company established formal structures and processes(Principle 10). The compliance function assumed initial responsibility for verifying data. The company
engaged an external auditor to perform verification in accordance with criteria indicated in the guidanceissued by the IAASB.
Sorrolti continued to improve controls to ensure complete, accurate, and reliable data and information(Principle 13), as well as to restrict access to appropriate parties (Principle 8). The network of controls is now
substantially equivalent to those followed for financial reporting. The final validation of ESG data included inexternal reports is under the responsibility of the CEO. The company implemented a robust set of internal
controls, similar to those for financial reporting, that provides the CEO with confidence in the data.

99

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

There are dedicated operating procedures—close to the shop floor and management—that outline
roles, responsibilities, definitions, and procedures to be used by these subunits to ensure adequate
management and reporting of nonfinancial data and information (Principle 12). With the primary focus
on business objectives and publicly stated sustainability targets, Sorrolti developed internal controls toprovide layers of assurance for nonfinancial information as it is gathered and summarized. The company
has a third-party verification process that it refers to as a “circling activity.” This reflects the concept ofsegregation of duties (Principle 10). Under this process, parties that are uninvolved in preparing topicalinformation review it. Participants include employees from different functional groups and external
consultants. Verification procedures can be a process walk-through, testing of data, or both. Functionaland operational leaders responsible for the nonfinancial information must sign an internal certification
statement, similar to that required for financial reporting. These are presented to the CEO and CFO forreview. They can review or ask questions about any of the documents in this upward flow of information
before it is submitted to the audit committee and board of directors (Principle 2) to ensure that it is fit
for purpose (Principle 1).

100

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

Illustration: A privately held supplier begins its sustainable business journey12
Fran Fabricators, Inc. (fictional) is a privately held company that engineers and manufactures multimaterial foam, rubber, and plastic components used in noise, vibration, acoustical management, waterand air sealing, and similar functional applications. The company’s 730 employees are spread among its
principal executive offices in Charlotte, N.C., and the engineering and production facilities in Concord,
Shelby, and Kannapolis, all in North Carolina.
The quality of the products has never been an issue, and the company’s adoption of Industry 4.0
concepts related to interconnectedness provides it with excellent operational and logistical capabilities.13
Adopting strong internal control fundamentals that align with ICIF has enabled the company to meetinternal, operational, and financial objectives (Principle 6). The company has a long history of organic
growth and last year reported revenues of just under $100 million, with margins in line with industry
sector averages. The company is committed to organic growth and relies on the lending markets forfinancing that growth (Principle 6).
Fran Fabricators’ customers are not limited to the U.S., as its products are used in the construction andremodeling of commercial and governmental buildings and facilities around the world by serving themarkets for appliance, water heater and heating, ventilation, and air conditioning (HVAC) equipment.
Sales are conducted directly to original equipment manufacturers (OEMs) of appliance, water heater, and
HVAC companies. Recognizing that many current and potential customers are generally not dependent
upon any one source for raw materials or purchased components essential to their business, Fran
Fabricators’ management sees continued organic growth as a path forward. It is imperative, however,that the company constantly respond to changing customer needs (Principle 9).
In this regard, several customers indicated a growing interest in having suppliers provide carbon
footprint information because they access capital from the public financial markets and are showing a
growing attention to proposed regulations regarding Scope 1, 2, and 3 emissions reporting. Because
Scope 3 includes all other indirect emissions occurring in a company’s value chain, management sees anopportunity to set itself apart from its competitors (Principle 1 and Principle 6). Fran Fabricators seeks topreserve and enhance its relationships with current and targeted OEMs, particularly those responding toan emerging culture of corporate responsibility and that are looking to their supply chains for sustainable
inputs and reliable data.
As a private company, Fran Fabricators was not subject to the delivery of mandatory financial
disclosures directly to the public capital markets, and management did not approach sustainability as
a compliance exercise. Instead, management turned its attention to the growing practice of suppliercode of conduct enforcement (Principle 7 and Principle 12). This gave the company an opportunity
to engage directly with customers and understand their risks and concerns. The interaction uncovered
direct opportunities with customers by providing information regarding emissions that were based onreliable and transparent processes. This made Fran Fabricators accountable to its customers, and it thenengaged its internal teams to deliver (Principle 3 and Principle 4).
Through its efforts to deliver emissions information to its large commercial customers, Fran Fabricators’
management discovered additional opportunities to track and deliver information about its sustainablebusiness practices, including its use of water, handling of waste, and employment and safety practices.
Management also discovered the potential benefits of borrowing through new ESG-related debt
arrangements with covenants that reduce interest rates for meeting ESG metrics.
12
13

Coauthored by Paul Juras, Babson College.
In a nutshell, Industry 4.0 means connecting automation and data exchange applications to manufacturing technologies.

101

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

There was the challenge, however, of management determining which sustainability factors were mostimportant to its business model and unique operating circumstances (Principle 6 and Principle 7). Whileit had a wide latitude for selecting, management wanted to adopt a structured approach that would
not be viewed as completely subjective. Management and the board looked to potential B Corporation
status to demonstrate high social and environmental performance, and they began working on a range
of factors that could improve the metrics used in determining an initial B Impact Assessment score. Aspart of this process, the team began to assess the most relevant factors for its business by engaging withvarious stakeholders, including employees and customers.
However, management understood that unlocking value through this process required stakeholder
trust as to the reliability of ESG information provided. It was readily apparent that the types of internal
controls relating to governance, competence, policies, data, and communications that Fran Fabricators
already employed to meet its financial objectives was applicable to build processes and oversight of its
sustainable business activities, including setting targets and building capabilities for delivering value.
Leveraging its existing systems, management looked to ICIF to achieve the company’s sustainablebusiness objectives in a cost-effective manner.

102

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

Illustration: A publicly held organization continues its evolution toward
reasonable assurance
Palimpia Inc.’s (fictional) approach to ESG reporting has evolved since embracing many of these topics
nearly 50 years ago and since its first report in 2008. Most recently, the company engaged its external
auditor to perform limited assurance on some parameters of GHG emissions, diversity and inclusion,
health and safety practices for its workforce, and product safety metrics.
Palimpia assigned primary responsibility to the director of global finance strategy and ESG. She leads aninternal cross-functional ESG task force to support and guide the company’s choices and investments madein the safety and well-being of employees, the environmental efficiency of its products and operations, thesupport of the communities the company calls home, and reporting and disclosure processes (Principle 3).
Palimpia publishes an ESG report containing more than 120 pages of content, intended for a broad
audience. While the company was already committed to data being believable and trustworthy,
reporting to investors called for a more rigorous approach. The company recognized additional
complexities arising from both the number of ESG standards and frameworks, as well as the complexityand variety of the topics to be reported (Principle 15).
Palimpia uses several processes to focus on what matters. The company conducts outreach to its
investors annually on ESG matters to gather input on important and emerging topics. This is a piece ofa materiality assessment that guides how the company will steer priorities and resources, and establish
metrics and gather data and information for reporting (Principle 6).
“The most recent evolution of our journey started with our investors,” said the director. Investors
initially focused on understanding the “alphabet soup” of ESG-related terminology, frameworks, andstandards with which they were interacting. They also sought to understand “how the company was
getting its information, where it was getting the information, and the level of confidence in its ESG
information” (Principle 7 and Principle 9).
The internal audit function provides strategic advice to the ESG team to help it understand how ICIF
can be applied to topics including occupational safety and GHG emissions. ICIF also formed a basis for
gap assessments for other ESG measures. The gap assessment revealed the need to focus on ESG data
integrity to help the company achieve comfort from the completeness and reliability of ESG measures.
The assessment also found that sometimes ESG data was sourced from internal teams that did not havea controls mindset. The exercise identified areas where ESG information involved estimates and how
ICIF can be used to define and document reasonable estimates suitable for reporting and assurance
readiness (Principle 10).
Similarly, the effort uncovered an inconsistent understanding of how to consider completeness forpurposes of ESG management and reporting. Some of the challenges are inherent in the reporting
standards and frameworks, notably existing and proposed climate disclosure standards. While thismight have resulted in confusion within the company and among stakeholders interested in disclosures,
ICIF and similar experience as the company formalized financial reporting offered a template fordocumentation and improvements (Principle 10).
Palimpia saw value in pursuing assurance on content in ESG reporting and disclosures. Given the
sheer number of topics, the company started with a few parameters. The effort began by focusing
on GHG emissions for which it achieved limited assurance on four metrics in 2020. The experienceenabled the company to expand the scope of limited assurance to 105 data points, drawn from Scope
1, 2, and 3, in 2021. The company leveraged internal audit to review internal controls, identify gaps,
and monitor improvements in anticipation of the external assurance. This effort also included a series

103

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKof communications between process owners, internal audit, the director of global finance strategy and
ESG, the executive committee, the senior leadership team, and the board (Principle 16).
The company has recognized that the application of ICIF can deliver value in several ways. The original
intent was to improve confidence in reporting and disclosures to investors. It has also improved thequality and consistency of reporting to a broader audience. Furthermore, the stronger internal controls
have enabled functional leaders to manage their responsibilities more effectively and efficiently. Palimpia
is currently improving internal controls using the Three Lines Model and continuing a journey toward
reasonable assurance. This will involve closing gaps discovered in prior assessments, building morerobust data systems, testing of transactional data, confirming support for narrative statements, andincorporating internal audit in roles similar to the support for ICFR (Principle 16 and Principle 17). •104

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKTOP 10 TAKEAWAYS

1

Be committed to ensuring your organization has
effective internal control over sustainability-related
matters, including operations, compliance, and various
types of reporting (external, internal, nonfinancial, andcompliance). Get involved. Apply your expertise to theefforts and to create the right control environment.
The end game is effective internal control
over key sustainability activities and reporting,however defined in terms of boundaries. Effective
internal control is achieved when the 17 principles
are present and functioning. This will differ tosome degree at each organization based on
maturity, industry, resources, and requirements.
Customization and adaptation are key.
• Start using the COSO ICIF-2013 now. There is noneed to wait for new regulations.
• Most, if not all, of the 17 principles apply tosustainability in a way that is comparable totraditional financial accounting and reporting.
• You may be able to leverage control activities anddocumentation from financial transactions andreporting areas.
• Risk assessment and determining materiality are
key activities to staying focused on what matters.
• Internal control over sustainability needs to
be on par with financial reporting and financialtransactions.
•D o not forget to address ITGC. And do notforget operations and compliance objectives, theresulting risks created, and the activities required
to achieve effective internal control in these areas.
• ICIF-2013 is designed to be used in essentiallyany area, function, location, or activity such as
payroll, safety, and sourcing. Use it for more thanjust financial reporting and sustainability.
Work with others to determine the bestorganizational structures, roles, andresponsibilities to create the desired results,
achieve appropriate internal and external
efficiencies, and achieve effective internal control.
This includes the board and board committees,

2

3

management, operations, compliance, and internal
audit. The Three Lines Model can be especiallyhelpful in delineating these responsibilities.
Educating yourself on new topics likesustainability is critical. Take advantage
of seminars, new publications, and certificate
programs. Collaborate and learn from sustainability
professionals, both those inside your organizationand outside consultants.
Take advantage of other relevant COSO
materials on subjects such as ERM and ESG,
cloud computing, and others (available atwww.coso.org).
Internal assurance and confidence insustainability reporting need to exist before
external assurance. Take advantage of your internal
audit function in this regard to provide objective
assurance and other advice.
ESG reporting, both internal and external, is
not an “annual and manual” activity. Help makeit automated, efficient, and continuous.
This is a fast-moving area, and there is boundto be lots of change over the next several
years. So, monitoring activities are key in terms ofevaluating progress and knowing when to makecorrections and enhancements.
COSO is not just for large, private-sector
publicly listed companies. All organizations,
including privately owned, not-for-profit, and publicsector entities need effective internal controls tomeet their objectives, manage risk, evolve, andsucceed in all areas of their business and activities.
Form a cross-functional team consistingof experts in sustainable business (suchas corporate social responsibility, integrated
reporting, legal, public relations, and humanresources) and in internal controls and reporting(finance and accounting). Remember, goodinternal controls are good for business and apply
well beyond compliance and mandatory external
disclosures. •

4
5

6
7
8

9

10

105

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKBIOGRAPHIES
Robert H. Herz
Robert H. Herz, CPA, FCA, was chairman of the
FASB from 2002 to 2010 and one of the original
members of the IASB. Prior to that, he was a partner
at PricewaterhouseCoopers (PwC), including serving
as audit partner on various major clients, heading
the Corporate Finance Advisory Services practice,leading the company’s technical accounting, auditing,
SEC, practice quality, and professional matters, andserving on its U.S. and global boards. Currently heserves on the boards of directors and chairs the audit
committees of Fannie Mae and Morgan Stanley andserves on the board and audit committee of Workiva.
He served for many years as a member of the SASB
and VRF boards of directors and currently serves on
the Transition Advisory Group that is advising the
IFRS Foundation Trustees and ISSB on the integrationof the VRF and the CDSB into the IFRS organization,on the board of the International Foundation for
Valuing Impacts, and was an expert adviser andmember of the 2021 G7 Impact Taskforce thatmade recommendations to the G7 leaders on ways
to accelerate the mobilization of capital to address
climate change and other global challenges. He
was the first chairman of the Transnational Auditors
Committee of the International Federation of
Accountants and chaired the AICPA’s SEC Regulations
Committee. For many years, he was an executive inresidence at Columbia Business School.
Robert B. Hirth Jr.
Robert B. Hirth Jr. is a senior managing directorof Protiviti, a global business consulting firm that
operates in more than 25 countries. Prior to that,
he was executive vice president, global internal
audit, and a member of the company’s six-person
executive management team for the first 10 years ofProtiviti’s development.
Bob was appointed to the standard-setting boardof SASB upon its formation in 2017 and served
as co-vice chair of the board until August 2022
when SASB was acquired by the IFRS Foundation.
He is a 2021 NACD Directorship 100 Governance
Professional honoree, a current member of the

PCAOB’s Standards and Emerging Issues Advisory
Group as well as the AICPA’s ASEC Sustainability
Assurance and Advisory Task Force.
Serving as COSO chair from June 2013 to
February 2018, Bob’s activities included leading
COSO’s project on revising its Enterprise Risk
Management—Integrated Framework, which was
released in September 2017, issuing COSO’s Fraud
Risk Management Guide, and actively promoting
COSO’s 2013 Internal Control—Integrated
Framework around the world and through themedia. Bob initiated COSO’s guidance on ERM/ESG
integration, which was issued in 2018.
Douglas Hileman
Douglas Hileman, FSA, CRMA, CPEA, PE, ispresident of Douglas Hileman Consulting, LLC and isrecognized as a leader in sustainability/ESG, providing
practical contributions to clients in many sectors
and functional areas. He brings more than four
decades of experience in operations and corporate
compliance, environmental and sustainability auditing,internal audit, and external assurance—four “lines ofdefense.” He is an effective translator for various ESG
topical and business functions to improve controls,
effectiveness, and reliability of ESG compliance andrisk management. He has provided ESG workshops
tailored to professional groups, industry sectors, andspecific topics. Doug has developed a model of sevendistinct channels for ESG reporting to help companies
achieve appropriate risk assessment, controls, andresults. He served on the Volkswagen Monitor
Team as the senior specialist in environmental
management and auditing. He has reviewed andcommented on numerous proposed rules andstandards, advocating for clarity, reasonableness, andease of implementation for preparers and users. Hiscomments on SEC disclosures have been cited andpublished, including in the SEC proposed climate
disclosure rule. Doug has consistently given backto the profession in board and volunteer roles. He
has been program chair, keynote speaker, presenter,panelist, emcee, and contributor to professional
guidance.

106

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

Shari Helaine Littan
Shari Helaine Littan, J.D., CPA, is director of
corporate reporting research and thought
leadership at IMA. She also serves as staff liaison to
the IMA Financial Reporting Committee and to the
IMA Sustainable Business Management Committee.
Her primary focus is thought leadership in the areasof financial reporting and sustainable businessinformation and management with a focus on therole of the finance and accounting function. She has
led the authorship of several IMA reports, articles,
and webinars on sustainable business, corporate
reporting, and diversifying talent in accountancy.
In 2015, she completed the Postgraduate
Certificate in Sustainable Business, withcommendation, from the University of Cambridge
Institute for Sustainability Leadership. Shari holds
a J.D. from Boston University School of Law anda B.S., magna cum laude, from the School ofManagement at Binghamton University. Earlier
in her career, she was a practicing litigator witha focus on matters that addressed corporate
governance and financial reporting. She began
this professional journey on the staff of two
international accounting firms.
Jeffrey C. Thomson
Jeffrey C. Thomson, CMA, CSCA, CAE, is president
and CEO of IMA, one of the largest and mostinfluential accounting associations in the world, withstrong growth in its CMA® (Certified Management
Accountant) program. IMA has a global network of
about 140,000 members in 150 countries and 350
professional and student chapters.
Jeff has been named to Accounting Today’s
Top 100 Most Influential People in Accounting
list for the past 14 years and was honored with
the Lifetime Achievement Award by Trust AcrossAmerica. He serves as the lead director on COSO
(a leader in advancing risk management andinternal controls), supporting COSO’s missionof providing thought leadership through thedevelopment of comprehensive frameworks andguidance to improve organizational performanceand governance and deter fraud in organizations.
Jeff also serves as IMA’s voting member on theInternational Federation of Accountants.
Jeff worked at AT&T for more than two decades,
starting as a data scientist and rising to the level of
CFO of an $18 billion business unit. He holds a B.A.
and M.A. in mathematical statistics from Montclair
State University.
Brad Joseph Monterio
Brad Joseph Monterio is global executive vicepresident, member competency and learning,
for The Institute of Internal Auditors (IIA). Prior
to this role, he was chief learning officer for the
California Society of CPAs (CalCPA and the
CalCPA Education Foundation) where he led similar
efforts for the largest state CPA society in the
U.S. (with more than 45,000 members). Brad waspreviously managing director of Colcomgroup,
Inc., a strategy, marketing, and advisory services
firm serving the accounting, auditing, and financesectors based in New York. He is also a former
commercial, investment, and private banker.
Brad has been working in the global
sustainability movement for more than 14 years.
He is the IIA voting representative to theIntegrated Reporting and Connectivity Council(IRCC), now part of the IFRS Foundation. Previously,
he was the IMA voting representative to the IRCC
predecessor, the IIRC.
Brad served on the IMA Global Board of
Directors for 12 years as well as the Casualty
Actuarial Society Board of Directors for six years.
He is currently a member of the IMA Sustainable
Business Management Global Task Force, amember of the ACCA Technology Global Forum,
and a member of the Thomson Reuters Foundation
Equity, Diversity and Inclusion Advisory Board. He
is a former organizational stakeholder of GRI and aprevious member of the Carbon Disclosure Project’s
XBRL Taxonomy Working Group. Brad also sits on
the UCLA Extension Internal Audit Advisory Board.
He received his bachelor’s degree from DartmouthCollege in 1988. •107

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKSOURCESABN AMRO, Value-creating topics 2020, assets.ctfassets
net/1u811bvgvthc/1IjyeIty3PJZnaOWfCNWbe/49eecd33f033947b0b35a612c7318179/ABN_AMRO_____Value-creating_topics_2020.pdf.
AccountAbility, AA1000 Assurance Standard, www.accountability.org/standards/aa1000-assurance-standard.
ACFE and Grant Thornton, Managing Fraud Risks in an Evolving ESG Environment, 2022, www.acfe.com/fraud-resources/
esg-report-gt-2022.
AICPA, System and Organization Controls: SOC Suite of Services, us.aicpa.org/interestareas/frc/assuranceadvisoryservices/
sorhome.html.
B Lab, www.bcorporation.net.
B Lab, B Impact Assessment, www.bcorporation.net/en-us/programs-and-tools/b-impact-assessment.
Bank of America, Bank of America Corporation Environmental and Social Risk Policy (ESRP) Framework, June 2022, about.
bankofamerica.com/en/our-company/environmental-social-risk-policy-framework.
David A. Bell and Ron C. Llewellyn, “Best Practices for Establishing ESG Disclosure Controls and Oversight,” Harvard Law
School Forum on Corporate Governance, February 3, 2022, corpgov.law.harvard.edu/2022/02/03/best-practices-forestablishing-esg-disclosure-controls-and-oversight.
Antony J. Blinken, “Implementation of the Uyghur Forced Labor Prevention Act,” U.S. Department of State, June 21, 2022,
www.state.gov/implementation-of-the-uyghur-forced-labor-prevention-act.
Kristine M. Brands and Shari Helaine Littan, CFO as Value Creator: Finance Function Partnering for the Integration of
Sustainability in Business, IMA, June 2020, www.imanet.org/insights-and-trends/the-future-of-management-accounting/cfo-as-value-creator.
Kristine M. Brands, Shari Helaine Littan, Brad J. Monterio, and Cornelis T. van der Lugt, CFO as Value Creator: FinanceFunction Leadership in the Integrated Enterprise, June 2020, IMA, www.imanet.org/insights-and-trends/the-future-ofmanagement-accounting/cfo-as-value-creator.
J. Robert Brown Jr., “It’s Not What You Look at that Matters: It’s What You See, Revealing ESG in Critical Audit Matters,”
PCAOB, pcaobus.org/news-events/speeches/speech-detail/it-s-not-what-you-look-at-that-matters-it-s-what-you-seerevealing-esg-in-critical-audit-matters.
Business Roundtable, Statement on the Purpose of a Corporation, s3.amazonaws.com/brt.org/2022.08.31-BRTStatemento
nthePurposeofaCorporationwithSignatures-compressed.pdf.
Capitals Coalition, capitalscoalition.org.

108

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKCenter for Audit Quality, The Role of Auditors in Company-Prepared ESG Information: A Deeper Dive on Assurance,
www.thecaq.org/wp-content/uploads/2021/03/caq_rota-esg-a-deeper-dive-on-assurance_2021-03.pdf.
Maria Castañón Moats, Leah Malone, and Christopher Hamilton, “The Evolving Role of ESG Metrics in Executive
Compensation Plans,” Harvard Law School Forum on Corporate Governance, March 19, 2022, corpgov.law.harvard.
edu/2022/03/19/the-evolving-role-of-esg-metrics-in-executive-compensation-plans.
COSO, www.coso.org.
COSO, Enterprise Risk Management—Integrating with Strategy and Performance, www.coso.org/SitePages/
Guidance-on-Enterprise-Risk-Management.aspx?web=1.
COSO, Internal Control—Integrated Framework, www.coso.org/sitepages/internal-control.aspx?web=1.org.
COSO and World Business Council for Sustainable Development, Enterprise Risk Management: Applying enterpriserisk management to environmental, social and governance-related risks, October 2018, www.wbcsd.org/Programs/
Redefining-Value/Making-stakeholder-capitalism-actionable/Enterprise-Risk-Management/Resources/ApplyingEnterprise-Risk-Management-to-Environmental-Social-and-Governance-related-Risks.
Douglas Hileman Consulting, LLC, 3 Attributes of ESG Reporting That Differ from Financial Reporting, March 2021,
www.douglashileman.com/wp-content/uploads/2022/03/3-Attributes-of-ESG-Reporting-March-2022-FIN.pdf.
Edelman, 2022 Edelman Trust Barometer, www.edelman.com/trust/2022-trust-barometer.
Max Ehrenfreund, “A majority of millennials now reject capitalism, poll shows,” The Washington Post, April 26, 2016,
www.washingtonpost.com/news/wonk/wp/2016/04/26/a-majority-of-millennials-now-reject-capitalism-poll-shows.
European Commission, A European Green Deal, commission.europa.eu/strategy-and-policy/priorities-2019-2024/
european-green-deal_en.
European Commission, Guidelines on reporting climate-related information, 2019, ec.europa.eu/finance/docs/
policy/190618-climate-related-information-reporting-guidelines_en.pdf.
EY, The emerging sustainability information ecosystem, July 2022, assets.ey.com/content/dam/ey-sites/ey-com/
en_gl/topics/public-policy/ey-global-sustainability-thought-leadership.pdf.
Craig Faris, Brian Gilbert, Brendan LeBlanc, Brian Ballou, and Dan L. Heitger, Demystifying Sustainability Risk:
Integrating the triple bottom line into an enterprise risk management program, COSO, May 2013, www.coso.org/
Shared%20Documents/COSO-ERM-Demystifying-Sustainability-Risk.pdf.
FASB, FASB Staff Education Paper: Intersection of Environmental, Social, and Governance Matters with Financial
Accounting Standards, March 19, 2021, www.fasb.org/Page/ShowPdf?path=FASB_Staff_ESG_Educational_
Paper_FINAL.pdf&title=FASB%20Staff%20Educational%20Paper-Intersection%20of%20Environmental.
FedEx, 2022 ESG Report, www.fedex.com/content/dam/fedex/us-united-states/sustainability/gcrs/FedEx_2022_
ESG_Report.pdf.

109

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

Fifth Third Bancorp, Environmental, Social and Governance Report 2021, 2022, s23.q4cdn.com/252949160/files/
doc_downloads/ESG/2022/09/2021-ESG-Report.pdf.
Gary E. Frank, “Vita Coco Makes a Compelling Case for Becoming a B Corp,” Triple Pundit, March 30, 2022,
www.triplepundit.com/story/2022/vita-coco-b-corp/739991.
Governance & Accountability Insititute, 2022 Sustainability Reporting in Focus: Examining 2021 trends of companies
on the S&P 500 ® + Russell 1000®, 2022, www.ga-institute.com/research/ga-research-directory/sustainabilityreporting-trends/2022-sustainability-reporting-in-focus.html.
Gov.uk, Modern slavery, May 20, 2022, www.gov.uk/government/collections/modern-slavery.
Greenhouse Gas Protocol, ghgprotocol.org.
GreenToken, www.green-token.io.
Guess? Inc., Vision: Guess Sustainability Report Fiscal Years, 2020-2021, 2021, sustainability.guess.com/reportsand-resources.
Harvard Business School, Impact-Weighted Accounts, www.hbs.edu/impact-weighted-accounts/Pages/default.aspx.
Heineken N.V., Annual Report 2021, 2022, www.theheinekencompany.com/sites/theheinekencompany/files/
Downloads/PDF/AR-2021/heineken-nv-annual-report-2021-25-02-2022.pdf.
Robert H. Herz, Brad J. Monterio, and Jeffrey C. Thomson, Leveraging the COSO Internal Control—Integrated
Framework to Improve Confidence in Sustainability Performance Data, September, 2017, www.imanet.org/insightsand-trends/external-reporting-and-disclosure-management/coso-framework-and-sustainability.
Maura Hodge, “The ESG Reporting Journey: Take the first steps … before it’s too late,” CPA Journal, November
2021, www.cpajournal.com/2021/11/05/the-esg-reporting-journey.
IAASB, ISAE 3000 (Revised), Assurance Engagements Other than Audits or Reviews of Historical Financial
Information, December 2013, www.iaasb.org/publications/non-authoritative-guidance-applying-isae-3000revised-extended-external-reporting-assurance.
IAASB, Sustainability Assurance, www.iaasb.org/focus-areas/sustainability-assurance.
IFRS, Who uses IFRS Accounting Standards? www.ifrs.org/use-around-the-world/use-of-ifrs-standards-by-jurisdiction.
IIA, Internal Audit’s Role in ESG Reporting: Independent assurance is critical to effective sustainability reporting, May
2021, www.theiia.org/globalassets/documents/communications/2021/june/white-paper-internal-audits-role-inesg-reporting.pdf.
IIA, Performance Standards, www.theiia.org/en/standards/what-are-the-standards/mandatory-guidance/
standards/performance-standards/#:~:text=2210.,%2C%20risk%20management%2C%20and%20controls.

110ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORKIIA, The IIA’s Three Lines Model, July 2020, www.theiia.org/globalassets/site/about-us/advocacy/three-linesmodel-updated.pdf.
IMA, Management Accounting Competencies, www.imanet.org/career-resources/management-accountingcompetencies.
IMA, Statement of Position on Sustainable Business Information and Management, www.imanet.org/-/
media/9354121b3db4442ea24abf805c167177.ashx?la=en.
Impact Management Project, Statement of intent to work together towards comprehensive corporate reporting,www.sasb.org/wp-content/uploads/2023/01/Statement-of-Intent-to-Work-Together-Towards-ComprehensiveCorporate-Reporting.pdf.
Impact Taskforce, www.impact-taskforce.com.
International Federation of Accountants and AICPA, The State of Play in Reporting and Assurance of Sustainability
Information: 2019-2020 Data & Analysis, July 28, 2022, www.ifac.org/knowledge-gateway/contributing-globaleconomy/publications/state-play-reporting-and-assurance-sustainability-information-update-2019-2020-dataanalysis.
International Foundation for Valuing Impacts, ifvi.org.
International Organization for Standardization, ISO 14064-3:2019, Greenhouse gases—Part 3: Specification withguidance for the verification and validation of greenhouse gas statements, 2019, www.iso.org/standard/66455.html.
ISSB, Exposure Draft IFRS S1, General Requirements for Disclosure of Sustainability-related Financial Information,
March 2022, www.ifrs.org/projects/work-plan/general-sustainability-related-disclosures/exposure-draft-andcomment-letters.
ISSB, Exposure Draft IFRS S2, Climate-related Disclosures, March 2022, www.ifrs.org/projects/work-plan/climaterelated-disclosures/exposure-draft-and-comment-letters.
Owen Jones, “Eat the rich! Why millennials and generation Z have turned their backs on capitalism,” The Guardian,
September 20, 2021, www.theguardian.com/politics/2021/sep/20/eat-the-rich-why-millennials-and-generationz-have-turned-their-backs-on-capitalism.
Kip Krumwiede, Lawrence Serven, and Robert Liou, Overcoming FP&A’s Biggest Challenge: Predicting the Future,
IMA, August 2021, www.imanet.org/insights-and-trends/planning-and-analysis/overcoming-fpanda-biggestchallenge-predicting-future.
Allison Herren Lee, “Climate, ESG, and the Board of Directors: ‘You Cannot Direct the Wind, But You Can AdjustYour Sails,’” SEC, www.sec.gov/news/speech/lee-climate-esg-board-of-directors.

111

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

Shari Helaine Littan, Arnaud Brohé, Kevin Fertig, Christine Khong, and Jaxie Friedman, Management Accountants’Role in Sustainable Business Strategy: A Guide to Reducing a Carbon Footprint, IMA, February 2022, www.imanet.
org/en/Research-Publications/Statements-on-Management-Accounting/Management-Accountants-Role-inSustainable-Business-Strategy-A-Guide-to-Reducing-a-Carbon-Footprint.
Morningstar Sustainalytics, Real ESG Accountability: Tying Your Company’s ESG Performance to Leadership
Compensation, 2022, www.sustainalytics.com/esg-research/resource/corporate-esg-blog/mapping-payperformance-esg-linked-executive-compensation-around-world.
Natura &Co., Management by Impact - IP&L (Integrated Profit and Loss), integrated management tool, May 2022,
ri.naturaeco.com/en/gestao-por-impacto-ipl.
Ocean Tomo, Intangible Asset Market Value Study, 2020, www.oceantomo.com/intangible-asset-market-value-study.
Organisation for Economic Co-operation and Development, OECD Due Diligence Guidance for Responsible Supply
Chains of Minerals from Conflict-Affected and High-Risk Areas, www.oecd.org/corporate/mne/mining.htm.
Vivek Pandit and Toshan Tamhane, “A closer look at impact investing,” McKinsey Quarterly, February 28, 2018,www.mckinsey.com/industries/private-equity-and-principal-investors/our-insights/a-closer-look-at-impactinvesting.
Part 240, General Rules and Regulations, Securities Exchange Act of 1934, www.ecfr.gov/current/title-17/chapterII/part-240#240.14a-1.
PCAOB, AS 2601: Consideration of an Entity’s Use of a Service Organization, pcaobus.org/oversight/standards/
auditing-standards/details/AS2601.
PCAOB, AS 2605: Consideration of the Internal Audit Function, pcaobus.org/oversight/standards/auditingstandards/details/as-2605-consideration-of-the-internal-audit-function_1528.
PCAOB, Attestation Standards, pcaobus.org/oversight/standards/attestation-standards.
PCAOB, Standards, pcaobus.org/oversight/standards.
Protiviti, Protiviti Insights, www.protiviti.com/us-en/insights.
Salesforce, FY22 Annual Report: The Power of Together, 2022, www.annualreports.com/HostedData/
AnnualReports/PDF/NYSE_CRM_2022.pdf.
SASB, Standards Overview, www.sasb.org/standards.
Science Based Targets, sciencebasedtargets.org.
SEC, “Disclosing the Use of Conflict Minerals,” March 14, 2017, www.sec.gov/opa/Article/2012-2012-163htm--related-materials.html.

112

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

SEC, Release No. 33-7881, Final Rule: Selective Disclosure and Insider Trading, 17 CFR 243.100-243.103, 2000,
www.sec.gov/rules/final/33-7881.htm.
SEC, Release No. 33-8238, Final Rule: Management’s Report on Internal Control Over Financial Reporting andCertification of Disclosure in Exchange Act Periodic Reports, www.sec.gov/rules/final/33-8238.htm.
SEC, Release No. 33-9106, Commission Guidance Regarding Disclosure Related to Climate Change, 2010,www.sec.gov/rules/interp/2010/33-9106.pdf.
SEC, Release No. 33-10825, Modernization of Regulation S-K Items 101, 103, and 105,
www.sec.gov/rules/final/2020/33-10825.pdf.
SEC, “Sample Letter to Companies Regarding Climate Change Disclosures,” September 22, 2021,
www.sec.gov/corpfin/sample-letter-climate-change-disclosures.
SEC, “SEC Announces Enforcement Task Force Focused on Climate and ESG Issues,” March 4, 2021,
www.sec.gov/news/press-release/2021-42.
SEC, “SEC Proposes Rules to Enhance and Standardize Climate-Related Disclosures for Investors,” March 21, 2022,
www.sec.gov/news/press-release/2022-46.
SEC, “Spotlight on Enforcement Task Force Focused on Climate and ESG Issues,” November 29, 2022,
www.sec.gov/spotlight/enforcement-task-force-focused-climate-esg-issues.
Leo E. Strine Jr., “Restoration: The Role Stakeholder Governance Must Play in Recrating a Fair and Sustainable
American Economy: A Reply to Professor Rock,” December 15, 2020, papers.ssrn.com/sol3/papers.cfm?abstract_
id=3749654.
Sustainable Stock Exchanges Initiative, ESG Disclosure Guidance Database, sseinitiative.org/esg-guidance-database.
Hans Taparia, “One of the Hottest Trends in the World of Investing is a Sham,” The New York Times, September 29,
2022, www.nytimes.com/2022/09/29/opinion/esg-investing-responsibility.html.
TCFD, Recommendations of the Task Force on Climate-related Financial Disclosures, June 2017,www.fsb-tcfd.org/recommendations.
Travelers Indemnity Company, Governance Practices, sustainability.travelers.com/governance/governance-practices.
Travelers Indemnity Company, Travelers Task Force on Climate-related Financial Disclosures Report 2021, 2022,
sustainability.travelers.com/iw-documents/sustainability/Travelers_TCFDReport2021.pdf.
Tom Seidenstein, “Balancing Urgency and Effectiveness in International Sustainability Assurance Standards,”
IAASB, June 8, 2022, www.iaasb.org/news-events/2022-06/balancing-urgency-and-effectiveness-internationalsustainability-assurance-standards.

113

ACHIEVING EFFECTIVE INTERNAL CONTROL OVER SUSTAINABILITY REPORTING (ICSR):BUILDING TRUST AND CONFIDENCE THROUGH THE COSO INTERNAL CONTROL—INTEGRATED FRAMEWORK

UNGC, Be a part of something better, unglobalcompact.org/participation/join.
United States Steel, 2021 Sustainability Report, www.ussteel.com/documents/40705/43725/USS_CSR21_Full_
Report.pdf/b990344d-2d81-f112-2a8f-b1c584989345?t=1658343821405.
US SIF: The Forum for Sustainable and Responsible Investment, 2022 Report on US Sustainable Impact Investing
Trends, 2022, www.ussif.org/trends.
Value Balancing Alliance, www.value-balancing.com.
Liv A. Watson, Tanuj Agarwal, Deborah Leipziger, Urmish Mehta, Dermot Murray, and David Wray,
A Digital Transformation Brief: Business Reporting in the Fourth Industrial Revolution, IMA, May 2020,
www.imanet.org/research-publications/white-paper/a-digital-transformation-brief-business-reporting-in-thefourth-industrial-revolution.
Whirlpool Corporation, 2021 Form 10-K, investors.whirlpoolcorp.com/financial-information/annual-reports-andproxy-statements/default.aspx.
Whirlpool Corporation, 2021 Sustainability Report, 2022, whirlpoolcorp.com/2021SustainabilityReport/
governance/responsible-sourcing.php and whirlpoolcorp.com/2021SustainabilityReport/appendix/tcfd.php.
World Resources Institute and World Business Council for Sustainable Development, Greenhouse Gas Protocol,
www.wri.org/initiatives/greenhouse-gas-protocol.

114