Barbara Strozzilaan 336
1083 HN Amsterdam
The Netherlands
gssbsecretariat@globalreporting.org

Item 02 – GRI Universal Standards
Project – Revised GRI 101: Section 5.
For GSSB discussion
Date

16 March 2021

Meeting

25 March 2021

Project

GRI Universal Standards Project

Description

This document presents the revised draft of Section 5. Additional
recommendations for reporting in GRI 101: Using the GRI Standards following the
public comment feedback.
Revisions made in response to public comment feedback are explained incomment boxes. Other editorial revisions have been made to the text to improve
clarity and consistency with the GRI Style Guide and are explained in commentboxes.
Minor editorial changes have not been highlighted, but a draft tracking all changes
to the text has been included in Annex 1.
The list of public comments on Section 5 of GRI 101 is included in Annex 2.

This document has been prepared by the GRI Standards Division and is made available to observers
at meetings of the Global Sustainability Standards Board (GSSB). It does not represent an official
position of the GSSB. Board positions are set out in the GRI Sustainability Reporting Standards. The
GSSB is the independent standard setting body of GRI. For more information visit
www.globalreporting.org.

© GRI 2021

1

Contents
Revised GRI 101: Using the GRI Standards........................................................................................... 3
Section 5. Additional recommendations for reporting ............................................................................. 3
Annex 1. Revisions with track changes .................................................................................................. 5
Annex 2. Public comments...................................................................................................................... 7

Page 2 of 11

2

Revised GRI 101: Using the GRI

3

Standards

4

Section 5. Additional

5

recommendations for reporting

6
7

This section provides additional recommendations for aligning sustainability reporting with other typesof reporting and for enhancing the credibility of the organization’s reporting.

8

5.1

9
10
11
12
13

The organization should align its sustainability reporting with other statutory and regulatory reporting,in particular, its financial reporting. This means that the organization should report the information forthe same reporting period and for the same group of entities as covered in its financial reporting. The
organization should also publish the information at the same time as its financial reporting, where thisis possible.

14

5.2

15
16

The organization can use several methods to enhance the credibility of its sustainability reporting.
These include internal controls, external assurance, and stakeholder or expert panels.

17

Internal controls

18
19
20
21

The organization should set up internal controls to strengthen the integrity and credibility of its
sustainability reporting. Internal controls are processes designed and implemented by theorganization, generally its management, to provide reasonable assurance regarding the achievementof its objectives.

Commented [SD2]: Type of change: revision
following public comment feedback.

22
23
24
25

Internal controls can be implemented at a day-to-day operational level through management andcompliance functions. Additionally, the organization can establish and maintain an internal audit
function as part of its processes for risk management to further improve the credibility of its
sustainability reporting.

Original wording: ‘ Additionally, the organization canestablish and maintain an internal audit function that is
responsible for the processes for sustainability related
risk management and for managing sustainability
reporting’

26
27
28
29
30
31
32
33

In some jurisdictions, corporate governance codes require the highest governance body to inquire
and, if it is satisfied, to confirm the adequacy of an organization’s internal controls in the annual
report. This confirmation may only relate to the adequacy of the internal controls for financial
reporting. It may not provide information about whether the same internal controls are also adequate
to assess the credibility of the organization’s sustainability reporting. If the organization relies oninternal controls set up for financial reporting, it should assess the relevance of these controls for its
sustainability reporting. In cases where these controls are inadequate, the organization should identify
and use additional internal controls to assess the credibility of its sustainability reporting.

Commented [SD1]: Type of change: editorial
revision.
The title of this section has been changed for clarity.
Original wording: ‘Additional recommendations forsustainability reporting’.

Aligning sustainability reporting with other reporting

Enhancing the credibility of sustainability reporting

Changed to clarify that the internal audit function is
independent and therefore not involved in thesustainability reporting processes.
Commented [SD3]: Type of change: editorial
revision.
Original wording: ‘directors’
Changed for consistency across the Universal
Standards.

Page 3 of 1134

External assurance

35
36
37
38
39
40

Even though this is not required in order to report in accordance with the GRI Standard, theorganization should, in addition to internal controls, seek external assurance for its sustainability
reporting. Disclosure REP-5 in GRI 102: About the Organization requires the organization to report
information on its policy and practice for seeking external assurance for its sustainability reporting. If
the sustainability reporting has been externally assured, the organization is also required to describe
what has been externally assured and on what basis.

41
42
43
44
45
46

External assurance comprises activities carried out by assurance providers to assess the quality andcredibility of the qualitative and quantitative information reported by the organization. External
assurance can also be used to assess the systems or processes the organization uses in order toreport information (e.g., the process for identifying impacts and determining material topics). External
assurance is different from activities that are used to assess or validate the performance of anorganization, such as compliance assessments or issuing of performance certifications.

47
48
49
50
51

External assurance results in published reports, conclusions, or opinions that can be used to verify
that the information has been prepared in accordance with reporting standards. It can also be used toreduce risk in data quality and increase trust in the reported information. This, in turn, helps
information users as well as the organization rely on the reported information for their decisionmaking.

52
53

External assurance should be conducted by competent assurance providers with appropriate
experience and qualifications. Assurance providers should meet the following criteria:

54
55
56

•

Independence from the organization to be able to reach impartial and objective conclusions
about the organization’s reporting and to be able to publish these conclusions in a report thatis publicly available.

57•

Demonstrable competence in the subject matter and assurance practices.

58•

Competence in applying quality control procedures to the assurance engagement.

59
60
61

•

Ability to conduct the engagement in a manner that is systematic, documented, evidencebased, and characterized by defined procedures in line with professional standards forassurance.

62
63
64

•

Ability to assess whether the reporting provides a reasonable and balanced representation of
the organization’s impacts, by considering the selection of the information reported as well as
its accuracy.

65
66

•

Ability to assess the extent to which the organization has applied the GRI Standards in thecourse of formulating opinions or reaching conclusions.

67

Stakeholder or expert panels

68
69

The organization can also convene a stakeholder or expert panel to seek external views on its
approach to sustainability reporting or for advice on the content of its reported information.

Page 4 of 11

Commented [SD4]: Type of change: revision
following public comment feedback.
Changed to clarify that for organizations who seek
external assurance, there is a requirement to report on
the assurance provided as part of Disclosure REP-5 in
GRI 102.

70

Annex 1. Revisions with track

71

changes72

Section 5. Additional

73

recommendations for sustainability

74

reporting

75
76

This section includes provides additional recommendations foron aligning sustainability reporting withother types of reporting and on methods for enhancing the credibility of the organization’s reporting.

77

5.1

78
79
80
81
82

The organization should align its sustainability reporting with other statutory and regulatory reporting,in particular, its financial reporting. This means that the organization shouldincludes reporting theinformation for the same reporting period and for the same group of entities as covered in its financial
reporting. The organization should also, and to the extent possible, publishing the information at thesame time as its financial reporting, where this is possible.

83

5.2

84
85

The organization can use several methods to enhance the credibility of its sustainability reporting.
These, includeing internal controls, external assurance, and stakeholder or expert panels.

86

Internal controls

87
88
89
90

The organization should put in placeset up internal controls to strengthen the overall integrity andcredibility of its sustainability reporting. Internal controls are processes designed and implemented by
the organization, generally its management, to provide reasonable assurance regarding theachievement of its objectives.

91
92
93
94

Internal controls can be implemented at a day-to-day operational level through management andcompliance functions. Additionally, the organization can establish and maintain an internal audit
function that is also responsible for theas part of its processes for sustainability-related risk
management and for managingto further improve the credibility of its sustainability reporting.

95
96
97
98
99
100
101

In some jurisdictions, corporate governance codes require directors the highest governance body toinquire and, if it is satisfied, to confirm the adequacy of an organization’s internal controls in theannual report. This confirmation might may only relate to the adequacy of the internal controls forfinancial reporting. It does may not necessarily provide information on about whether the sameinternal controls are also adequate to assess the credibility of the organization’s sustainability
reporting. If the organization relies on internal controls related set up forto financial reporting, it should
assess the relevance of these controls for its sustainability reporting. In cases where these controls

Aligning sustainability reporting with other reporting

Enhancing the credibility of sustainability reporting

Page 5 of 11

102
103

are inadequate, the organization should identify and use additional internal controls to assess thecredibility of its sustainability reporting.

104

External assurance

105
106
107
108
109
110
111
112

Even though this is not required in order to report in accordance with the GRI Standard, In addition tointernal controls, the organization should, in addition to internal controls, seek external assurance forits sustainability reporting, even though this is not required in order to prepare informationreport inaccordance with the GRI Standards or with reference to the GRI Standards. Disclosure REP-5 in GRI
102: About the Organization requires the organization to report information on its policy and practicewith regard tofor seeking external assurance for its sustainability reporting. If the sustainability
reporting has been externally assured, the organization is also required to describe what has beenexternally assured and on what basis if the sustainability reporting has been externally assured.

113
114
115
116
117
118
119
120

External assurance refers tocomprises activities that are used tocarried out by assurance providers toassess the quality and credibility of the qualitative and quantitative information reported by theorganization. External assurance can also be used to assess and/or the systems or processes theorganization uses inI order to for reporting this information (e.g., the process for identifying impacts
and identifying determining material topics and related impacts). External assurance This is different
from activities that are used to assess or validate the quality or level of performance of anorganization, such as compliance assessments or issuing of performance certifications or complianceassessments.

121
122
123
124
125
126

External assurance results in published reports, conclusions, or opinions that can be used for various
purposes, such as to verifyalidate that the information has been prepared in accordance with
reporting standards. It can also be used, and to reduce risk in data quality and increase trust in thereported information. This, in turn, and reduce risk in data quality, and to enable supportshelps
information users as well as the organization to in usinge therely on the reported information in
theirfor their decision-making.

127
128

External assurance should be conducted by competent assurance providers with appropriate
experience and qualifications.

129

In general, anA assurance providers should meets the following criteria:

130
131
132

•

Independence from the organization to be able to reach and publish impartial and objective
and impartial conclusions about the organization’s reporting and to be able to publish these
conclusions in a written report that is publicly available.

133•

Demonstrable competence in the subject matter and assurance practices.

134•

Competence in applying quality control procedures to the assurance engagement.

135
136
137

•

Ability to conduct the engagement in a manner that is systematic, documented, evidencebased, and characterized by defined procedures in line with professional standards forassurance.

138
139
140

•

Ability to assess whether the organization’s reporting provides a reasonable and balanced
representation of the organization’sits impacts, by considering the selectionaccuracy of theinformation reported as well as its accuracythe overall selection of content.

141
142

•

Ability to assess the extent to which the organization has applied the GRI Standards in thecourse of reaching its conclusions or formulating opinions or reaching conclusions.

143

Stakeholder or expert panels

144
145
146

The organization can also convene a stakeholder or expert panel to seek an external reviews onf its
overall approach to sustainability reporting or to seekfor advice on the content of its reported
information.

Page 6 of 11

147

Annex 2. Public comments

149

1. Comments on Section 5.1. Aligning sustainability reporting with otherreporting150

Please refer to page 24 in the Universal Standards exposure draft.

151

Table 1. Comments on Section 5.1. Aligning sustainability reporting with other reporting

148

No.

Comment
12

3

4(1) Deloitte strongly agrees with the explicit reference to the benefits ofaligning with other reporting, especially financial reporting. This isparticularly relevant to achieve consistent reporting periods and thebreadth of entities included across reports.
(2) We also recognize that sustainable development targets could have
implications for the assumptions and forecasts used in financial
statements. We recommend GRI remind preparers of this connectivity inthe standards.
(3) We also agree with the proposals to align sustainability reporting withother reporting and enhance its credibility. In our Asset Manager
Perspective on corporate sustainability reporting1, we explain that, in ourview, a company’s board of directors should ensure that company
reporting reflects all material sustainability risks and opportunities. We
also expect sustainability disclosures to be timely, readily accessible
and, when financially material, subject to similar quality control as otherinformation companies provide to financial markets.
I agree with this in principle as it makes sense to align to enhance thecredibility of sustainability reporting, i.e. as important as financial
reporting. However this should not be mandatory as it is simply not
feasible for all organisations. For example, we choose to do a calendar

Name oforganization orindividualCountry

Stakeholder
group

Submission
type

Deloitte

United States

Consultant

Deloitte

United States

Consultant

NBIM

No response

No response

On behalf of anorganization,group orinstitution
On behalf of anorganization,group orinstitution
On behalf of anorganization,group orinstitution

Think Impact Pty Ltd

Australia

Consultant

On behalf of anorganization,group orinstitution

Page 7 of 11

year report because the bulk of the reporting process aligns with aquieter period of time for us so we can get the report out within 6 monthsof the end of reporting period. If we were required to report to align with
our financial reporting (30 June year end), it would simply not be feasible
to deliver it within 6 months. I think timeliness of reporting should be
more important that alignment with other reporting.
152

2. Comments on Section 5.2. Enhancing the credibility of sustainability reporting

153

Please refer to pages 24-25 in the Universal Standards exposure draft.

154

Table 2. Comments on Section 5.2. Enhancing the credibility of sustainability reportingNo.

Comment
1

2

Regarding stakeholders or expert panels, shoul be more information or
recomendations o explanations about this.
This kind of panels or informs, give more added value to the reports andcompany mangagement than the external assurance. And also could
increase the aknolage of the use of the GRI Standards.
External Assurance: “ .. the organization should seek external
assurance for its sustainability reporting …. “ The Guidance should
include content to require assurance reports to include content on thetype of assurance provided, its objectives and limitations, in clear
language.
The commenter (Mr. Hileman) has experience with external assurance
engagements for financial reporting, sustainability reports, and SEC
submittals for conflict minerals. Having experience at explaining
different types of assurance and audits (including to clients andauditees), I have learned several things. First, accounting professionals
approach “assurance” engagements differently from non-accountants.
Furthermore, there are different types of assurance. They aredescribed as compilations, reviews, audits, negative assurance, andpositive assurance – among others. The concept may differ in different
jurisdictions. They may focus on processes or test data/ compliance –Name oforganization orindividualCountry

Stakeholder
group

Submission
type

AG Sustentable

Argentina

Consultant

On behalf of anorganization,group orinstitution

Douglas Hileman

UnitedStatesConsultant

As anindividual

Page 8 of 11

3or both. Second, these distinctions may be understood to theindividuals signing the reports, but they are largely lost on most otherstakeholders, including many of the auditees. Third, stakeholders placeconsiderable reliance on the fact that any assurance engagement was
performed, without understanding this variability. This poses risks to
many stakeholders. Assurance providers can “race to the bottom” toprovide lower-level assurance at lower cost. Stakeholders relying on
assurance assume much higher confidence than may be warranted.
DH is a proponent of assurance for sustainability reporting. The
commenter (Mr. Hileman) is also a proponent of transparency on scope,
approach, and limitations of assurance engagements.
Lines 643 – 645 (p. 24) Enhancing Credibility/ Internal Controls: . GRI
should correct errors in the concept of auditing. GRI should alsomention Internal Audit and other types of internal audits, with both citedas mechanisms to improve the credibility of non-financial reporting. The
draft Guideline says that “the organization can establish and maintainan internal audit function that is also responsible for the processes forsustainability-related risk management and for managing sustainability
reporting.” This statement is incorrect on some levels, misleading onothers, and misses broader (and more common and ore effective)
aspects of organizational governance. First, independence is a corerequirement of any audit. An audit function cannot perform audits andmanage the reporting; this invalidates their independence and renders
the audit untrustworthy. Second there are different types and different
levels of “internal audits.” As noted elsewhere in these comments the“Internal Audit activity” (or function – often capitalized) is authorized by
the Board/ Highest Governing Body (HGB). Although administratively
reporting to Management, Independent Audit is structurally independentand serves a critical role in risk identification and assessment,
assurance to the HGBs. Internal Audit also routinely plays a key role in
the assurance of internal controls over financial reporting (ICFR),
making it well-suited for a role adapted to non-financial reporting.
Organizations also authorize other internal audits (not capitalized)
functions at the “second line of defense” – reporting to Management.
These 2LOD audits focus on areas of higher risk, including IT,
environmental, health and safety, quality and supply chain. These“internal audits” may be done by organization staff, out-sourced
resources, or a blend of each. They may be full-time or engaged on a

Douglas Hileman

UnitedStatesConsultant

As anindividual

Page 9 of 11

4

5

6

7

project basis. Audits help ensure credibility of non-financial reporting;they also help drive improvements in performance in key sustainability
topics ranging from conflict minerals to greenhouse gas emissions
More on assurance providers needed that are not only from financial
line but also from non financial providers (e.g. maritime, engineering) so
assurance can be more competitive for companies to adopt in term ofeasier feasibility.
in “opinion that can be used”, maybe “that” is a typo to eliminate

The draft Guideline says that “the organization can establish andmaintain an internal audit function that is also responsible for theprocesses for sustainability-related risk management and for managing
sustainability reporting.” The IIA recommends GRI correct the concept
of internal auditing in this section of the Guidance, and specify internal
audit as a mechanism to improve the credibility of nonfinancial
reporting.
Independence is fundamental to the definition of internal auditing. Aninternal audit function cannot perform audits and manage the reporting;this invalidates its independence and renders the audit untrustworthy. In
addition, the internal audit activity is authorized by the Board/Highest
Governing Body (HGB). Although administratively reporting tomanagement, an internal audit function is structurally independent andserves a critical role in risk identification and assessment, and providing
assurance to HGBs. Internal audit is distinguished from others by the
key role it plays with its enterprise wide understanding of risks andcontrols, making it well suited for a role adapted to nonfinancial
reporting. Internal audit functions ensure credibility of nonfinancial
reporting, and help drive improvements in performance in key
sustainability topics ranging from conflict minerals to greenhouse gas
emissions.
External Assurance: “ .. the organization should seek external
assurance for its sustainability reporting…”. This section fails its readers
by omitting reference to internal assurance. The IIA recommends theinclusion of a requirement for assurance for sustainability reporting withmuch more precision: Add content to require assurance reports toinclude content on the type of assurance provided, its objectives andMalaysia

Consumers

As anindividual

Izzaty Khaleda Ismail
EY S.p.A.

Italy

Consultant

The Institute ofInternal Auditors

UnitedStatesStandard
setterOn behalf of anorganization,group orinstitution
On behalf of anorganization,group orinstitution

The Institute ofInternal Auditors

UnitedStatesStandard
setterOn behalf of anorganization,group orinstitution

Page 10 of 11

limitations, in clear language.
Accounting professionals approach “assurance” engagements
differently from non-accountants, and we know there are different
descriptions of assurance, such as compilations, reviews, audits,
negative assurance, and positive assurance – among others. The
concept may differ in different jurisdictions. They may focus onprocesses or test data/compliance – or both. While these distinctions
may be understood to some, they are largely lost on most otherstakeholders, including many of the auditees. Since stakeholders placereliance on the fact that any assurance engagement was performed,
without understanding this variability, the generalization “external
assurance” poses risks to many stakeholders, as they may assume
much higher confidence than may be warranted.

Page 11 of 11