Internal audit and the environment: how green is your audit?

Formerly the preserve of a few ethical consumers, environmental
sustainability is now a very real and important part of all walks of business
life. From the products companies deliver to the premises they occupy,
organisations are now sitting up and taking note of the value of their ‘green
credentials’. Internal audit needs to play a central role in this.

Being ‘green’ is no longer a PR-led matter of reputation management.
Regulatory pressures, employee retention and perhaps most importantly attracting
investment and raising finance, all increasingly require organisations to prove
they operate in an environmentally friendly way.

High-profile examples of companies making bold environmental statements
include M&S and BSkyB.
The question is, while a company’s move to address its ‘green’ responsibilities
is commendable, a lack of measurement, control and independent verification can
render many such statements meaningless.

For example, if an organisation pledges to reduce its carbon footprint by x%,
does it specify the original baseline? Does it detail how this is measured? And
are these figures properly audited?

It is not unreasonable to suggest that regulators, who are already active in
this area, will ultimately require external attestation for any environmental
claims made. In this instance, those organisations which have positioned
internal audit at the heart of this process will certainly have the upper hand.

Most internal audit departments currently fail to include environmental risks
when establishing the overall risks affecting their organisations. As a result,
they will often not develop audit programmes that provide assurance, even in
part, over the relevant environmental issues.

There is a wide range of assignments that could form part of the audit
planning process, taking into account risk, materiality, scope of audit
coverage, skill sets of the resources, and budget. Some examples include:

• the adequacy of policies addressing corporate social responsibility (CSR)
  and environmental strategies;

• the accuracy of statements and figures reported externally;

• the adequacy of environmental reporting procedures and controls;

• compliance with existing and future environmental legislation;

• benchmarking green policies against competitors and other industries;

• efficiency programmes to develop the sustainable use of resources;

• potential to engage with carbon offset schemes;

• major purchasing projects; and

• supply chains and partner practices.

This kind of audit activity is not the only way that internal audit should
engage with environmental sustainability. As part of its ‘change agent’ role,
there are several hot topics that internal audit should track ­ each could have
a significant impact on its work.

How effectively is the business dealing with the climate change agenda? This
is one of the hottest topics among leading businesses and is beginning to have a
profound impact on business models, risk management, innovation and product
development.

How effectively is the company meeting its legal obligations to report to
shareholders on environmental issues?

The Companies Act 2006 states that from October 2007 quoted companies must
ensure their business review, as part of the director’s annual report, discloses
information on environmental, employee, social and community matters.

Does the organisation have appropriate and specific corporate social
responsibility policies? Are CSR policies embedded in business-as-usual
management functions, or are they treated as a bolt-on responsibility, or as
something taken care of by staff in a separate CSR ‘silo’?

What present and future legislation or initiatives could specifically affect
your organisation, industry sector and geography? A brief look at just some of
the UK legislation on this topic highlights what a significant task this is. At
a wider level, the European Union is working on new policies to cover
sustainable consumption and production and sustainable industrial policy. Both
could lead to significant new regulations.

What assurance does the organisation have that any claims referred to in its
websites, corporate reports, etc are accurate and will not leave it open to
accusations of misreporting? The process of overstating a company’s green
credentials ­ known as ‘greenwashing’ ­ is a dangerous game.

What assurance does the organisation have that its environmental strategy is
not operating in a silo, dislocated from the organisation’s other aims and
objectives?

Where is the organisation on the change curve with respect to sustainability
programmes? For example, does management understand the significance of society
expectations for the company and the sector within which it operates?

Heads of internal audit should review their risk universe and perhaps even
their operating charter to ensure that they are able to provide assurance around
these risks.

Those who are able to establish a role for internal audit in this area will
be contributing significant value to their organisations.

UK legislation

These are just some of the areas in which environmental laws or regulations
can affect organisations in the UK.

• Companies Act 2006
• Low Emission Zone (London)
• Pollution permit auctions
• EU directive on packaging and packaging waste
• Kyoto Protocol
• Climate change levy
• Climate change agreement
• EU Emissions Trading Scheme
• Customer carbon offset schemes
• The European Waste Electronic and Electrical Equipment Directive
• The government’s carbon reduction commitment requirements
• ISO 14001

Risk universe

The specific environmental risks that an organisation faces will depend on
its industry sector, the kinds of service or products that it provides, its
geographical locations, the legislation it has to comply with and the ways in
which it uses technology. And while many of the risks have a compliance focus,
there are equally many opportunities in this area that are not necessarily
driven by a compliance requirement but rather just make good business sense.

Some of the risks we would expect to see in an organisation’s risk universe
as they relate to environmental risk are listed below.

• Compliance with applicable laws and regulations
• Responding to environmental changes and local initiatives
• Knowledge of proposed changes in environmental laws
• Nature and extent of new or potential environmental liabilities
• Costs associated with existing and anticipated environmental risks
• Lack of environmental management
• Public opposition to the environmental stance
• Accuracy of environmental disclosures
• Ability to raise and secure funds
• Adequacy of insurance cover
• Damage to reputation

Dene Burke is a director at
Protiviti