Why audit committees should steer ESG reporting

The clock is ticking. Environmental, social and governance (ESG) reporting is moving from voluntary to required. The first mandatory ESG reporting will be required for some Canadian companies as soon as 2025. But few organizations are prepared for this new regime and the third-party assurance expected to come with it. To be ready, companies must formulate a detailed plan, make organizational changes and commit resources.

Mandatory public reporting of non-financial metrics will expose companies to new risks. Misleading or incorrect reporting can cause reputational damage in the eyes of key stakeholders, reduce access to capital and lead to a decline in the company’s share price. Companies may need to disclose competitive information, such as resource use, that they may not have previously disclosed to investors, and overall business strategy could be affected by shareholder pressure to improve certain metrics. At the same time, the integration of ESG strategy into the broader corporate strategy and its effects on financial metrics will be more visible and open to more stakeholder scrutiny.

Given these implications, companies must develop a robust management and governance system for ESG with board-level oversight. This system may well be delegated to the audit committee at most companies because it is the board body that has the most experience with assurance, oversight of data and controls, and reviewing reports that will be made public. In addition, the company’s financial auditor may be engaged to provide third-party assurance over ESG reporting and the finance department will probably―and should―be heavily involved because its competencies most closely align with those needed to prepare this new reporting.

In KPMG’s Road to Readiness: KPMG ESG Assurance Maturity Index 2023, two-thirds (66 percent) of all respondents and 78 percent of those from listed companies say their firms “must now report ESG data or will be required to soon.”¹ Until now, most of this reporting has been voluntary, but in the coming years, public companies and other public interest entities will need to disclose specific ESG information under one or more disclosure frameworks.

In June 2023, the International Sustainability Standards Board (ISSB) issued its first sustainability disclosure standards, IFRS S1 General Requirements for Disclosure of Sustainability-related Financial Information and IFRS S2 Climate-related Disclosures, designed to be adopted globally on a jurisdictional basis.² In Canada, the Canadian Sustainability Standards Board (CSSB) has been formed to support the adoption of the standards. In the interim, some companies may choose to adopt them voluntarily and report on IFRS S1 and S2 beginning fiscal years starting on or after January 1, 2024. These disclosure standards have also been endorsed by the International Organization of Securities Commissions (IOSCO), which has encouraged its 130 member jurisdictions to look at incorporating them. IOSCO represents 95 percent of the world’s security markets, so adopting the standards into regulation will likely be widespread.³

As of fiscal periods ending on or after October 1, 2024, certain federally regulated financial institutions in Canada must make climate-related financial disclosures per Guideline B-15: Climate Risk Management, published by the Office of the Superintendent of Financial Institutions (OSFI). And in Europe, the first companies subject to the Corporate Sustainability Reporting Directive (CSRD) must start reporting according to European Sustainability Reporting Standards (ESRS) for periods beginning on or after January 1, 2024.⁴

The Canadian Securities Administrators (CSA) is working with the CSSB as it looks to adopt the ISSB standards. It’s still undertaking consultations and has not announced an effective date for new disclosure requirements for publicly listed entities in Canada, but we anticipate they’ll become effective in the next couple of years. In the U.S., companies must prepare for the requirements that will come soon after the Securities and Exchange Commission (SEC) makes its final announcement on its climate-related reporting rules. Audit committees will want to ensure that management has a process for tracking the regulatory environment and knows which regulations apply to the company.

The “S” in ESG is driving new reporting requirements as well. The Fighting Against Forced Labour and Child Labour in Supply Chains Act will require some Canadian companies and government institutions to submit a publicly available report to the Minister of Public Safety every year on the steps taken in the previous financial year “to prevent and reduce the risk that forced labour or child labour is used at any step of the production of goods in Canada or elsewhere by the entity or of goods imported into Canada by the entity.” ⁵ The first report will be due May 31, 2024, and failure to report can result in fines, investigations and liability for directors. Audit committees must be sure management is aware of whether their organization is in scope for this reporting and, if so, what steps they’re taking to provide complete and accurate information by the deadline.

Despite the prevalence of forthcoming ESG reporting mandates, few organizations are ready to transition to formal reporting. Only 27 percent of companies surveyed by KPMG report that they “have robust policies and procedures to support the development of their ESG disclosures” and only a quarter (25 percent) feel they have the “policies, skills and systems in place to be ready for ESG assurance.”⁶ Given the impending deadlines for mandatory reporting, audit committees must ensure management is putting the required policies and systems in place and recruiting or upskilling employees to ensure the company has the talent and knowledge required to meet these requirements.

Almost all organizations will need to bolster their ESG reporting to align with these new regulatory requirements, and the transition complexity should not be underestimated. It will require significant resources, time and cross-disciplinary cooperation across the organization. Even companies that currently report ESG metrics voluntarily will need to make substantial changes as the final regulations will require companies to report on metrics they may not currently report, use a methodology that differs from what they use today, or both. Companies operating in multiple jurisdictions may also find that reporting prepared for one jurisdiction is insufficient or non-compliant for another.

Audit committees must ensure that management has a clear path to completion to bring their reporting to the standard required for the formal reporting and assurance requirements for which they are in scope. This plan must be feasible given the organization’s available resources and the importance of other initiatives. It begins with a clear understanding of where the company is today and where it needs to be to report under the new standards. Plans must be developed to close gaps and address resource needs.

A particular area of challenge for companies, and one of the areas where audit committees can focus, is the processes and controls management has in place―or intends to put in place―to ensure that information reported is complete, accurate and assurable. These processes and controls should be as robust as those for financial information and their design and implementation should involve people with appropriate skills and knowledge in these areas. Given their core competencies in these areas, this supports our expectation that the financial reporting and internal audit teams will play key roles in ESG reporting.

Of key importance are management’s capabilities today versus those that are needed to achieve a successful transition to ESG reporting readiness and assurance. The audit committee can play a critical role in understanding current capability, what is needed, and where additional support is needed through upskilling current staff or engaging internal or external experts, including at the board level.

While financial statement and ESG disclosure standards remain separate, we’re likely headed toward an integrated report containing financial and non-financial information. Some organizations already have this type of reporting, although only pieces of it may be subject to external assurance.

In many firms, ESG strategy and reporting are siloed from the broader strategy and other types of reporting. However, cross-functional cooperation will be necessary as we move closer to integrated reporting. A holistic approach to reporting must start at the board level and trickle down to management and the broader organization. The audit committee has the breadth of perspective required to ensure the organization moves toward a structure where ESG and sustainability are integrated into all aspects of the organization.

With mandatory ESG reporting on the horizon, investors are demanding third-party validation of those metrics and related information. Providing assurance is the core competency of financial statement auditors, leaving them best positioned to provide assurance on non-financial information. The standards are being written using many of the principles of financial statement reporting standards, in which financial statement auditors are well versed.

Beyond core knowledge, using a company’s financial statement auditor brings additional benefits and efficiencies. Dealing with one firm will impose a lower administrative burden than dealing with multiple firms and spare companies the potential complications of dealing with two divergent opinions and having to provide the same information twice. The financial auditor is already familiar with the company, its processes and control systems, and therefore are best positioned to help companies identify disconnects or risks between financial and non-financial information and disclosures.

Companies need to begin transitioning to formal ESG reporting now. It’s a complex task and opens them up to new risks. The skillsets and knowledge of audit committees will allow them to provide valuable guidance throughout this process.