The Internal Audit (IA) profession has always adapted to the needs of organisations, stakeholders, regulators and wider society. The current environmental, social and corporate governance (ESG) agenda provides the need and pivotal moment for IA to adapt, broaden and grow the function, and subsequently support the organisation. The immediate task for IA will be to help organisations and their management live up to their sustainability promise within an overall ESG context, whilst avoiding exaggeration of achievements within their stories told. To ascertain this position as an IA function, investment in knowledge and experience is required, alongside intrinsic motivation of IAs to contribute to a more sustainable organisation and society. To continuously meet the organisation’s future needs, IA should start their sustainability journey by incorporating sustainability in their daily practice. In this article three integrated pillars and practical advice are shared that can help IA functions in fulfilling their sustainability position.

IA, ESG, Sustainability Business Partner

The involvement of IA professionals in sustainability provides an opportunity to realign the profession with its stakeholders and seize its moment to engage at a strategic level. IA has both the capability and connections to make an invaluable contribution.

At first, it’s important to reflect on the background. The IA profession came into being after World War II, when the task of rebuilding economies and societies with fresh insights provided the ideal platform for disciplines such as management science to influence how the relationship between business and society could be reviewed and renewed (Parker and Johnson 2017). In this climate, the role played by internal auditing became increasingly important. The forerunners of the profession had a vision that IA would fulfil societal and organisational needs to provide independent assurance that an organisation’s risk management, governance and internal control processes were operating effectively (Parker and Johnson 2017). Assurance was of relevance to all stakeholders, including those with no direct financial interest in the organisation. An early vision on the whole became a reality, and today’s IA professionals deliver an unbiased and objective view on how many aspects of an organisation operate in the real world – working to a code of ethics and professional standards of the IIA (Institute of Internal Auditors 2017). To do so means that internal auditors have access, and a duty to report, to the most senior decision makers within the organisation; those who determine the current and future activities of the business – be they leaders, trustees, or those concerned specifically with other aspects of governance, such as the Audit Committee.

The relationship between organisational life and sustainability has developed over time. Nowadays, sustainability in organisations typically refers to the effect those organisations have on the world around them. Sustainable organisations – especially businesses – look to assess and improve their operational impact, and in doing so make a difference to society’s most pressing problems: climate change and pollution, depletion of natural resources, economic inequality, societal injustices, and so on (Fedele and Schor 2021). Although some commentators would, cynically, regard such efforts as being more to influence how an organisation is viewed by stakeholders rather than the substantive impact of sustainability change measures, the tide has now shifted in favour of substance over form (Instituut van Internal Auditors 2022). We now live in an age where the scrutiny of how an organisation truly affects the communities it operates in, and the environment we all live in, goes well beyond optics and good intentions. In particular, the sustainability story told by an organisation has to be truthful, so as to pass all forms of scrutiny. So-called ‘greenwashing’, or exaggerating environmental achievements, is likely to abate over time.

Equally, we believe that the motives for organisations to live up to sustainability promises are no longer confined to altruism or the feel-good factor of a brand. Working towards better outcomes in society and the environment is increasingly the commercially sensible decision. In some sectors, this comes to a head when ESG reporting becomes regulated and ESG ratings have a direct impact on a business’s market value, and therefore affect how the business is treated by investors and capital market advisors.

As a result, sustainability goals are now an integral part of the strategy for many corporate businesses. Internal Audit’s increasing role is to make independent comment as to whether the company is doing its best and is succeeding to live up to the organisation’s strategic set of promises. To do otherwise may risk not only the company’s intangible assets (e.g., reputation), but also the way in which its tangible assets are used for best returns – particularly by reference to competitors and stakeholder expectations.

When it comes to ESG, governments, organisations, communities and individuals all have a part to play. For many industries, the role of businesses in responding to the call for environmentally sustainable working practices is crucial. As we are all stakeholders in the future of the planet, we are all stakeholders in how businesses respond to the current and future challenges.

Organisations are at different stages of adapting to the environmental sustainability challenge, and the IA functions they need will reflect that difference. Some businesses are already much further ahead than others (Deloitte 2022); around 19 percent of the respondents in Deloitte’s 2022 CxO Sustainability survey can be regarded as leaders, in the sense that they are implementing at least four or five of the following ‘needle-moving’ actions:

• developing new, climate-friendly products or services;
• requiring suppliers and business partners to meet specific sustainability criteria;
• updating or relocating facilities to make them more resistant to climate impacts;
• incorporating climate considerations into lobbying and political donations; and
• tying senior leader compensation to sustainability performance.

Even though many businesses understand the part they play in contributing positively to the issues of sustainability as a whole, they cannot always put the case in commercial terms; terms that their shareholders will find persuasive and acceptable as factors for continued investment. IA can help management to find that business case, by looking at ESG risks and opportunities from many angles – strategic, operational, and investment.

In this paper, we will explain why and how IA functions can and should be involved in the increasing importance of ESG, and the risks related to the topic. Although ESG covers more than the environment alone, this paper will use climate change as the main example and driver for Internal Audit to become a catalyst (Fedele and Schor 2021). At the end of the paper, we share practical steps that can help IA functions integrate sustainability within IA activity.

Deloitte’s Global CxO Sustainability Report 2022 (Deloitte 2022) sought the views of over 2000 C-suite executives from 21 countries – mostly from organisations with a mature IA function – on the topic of climate change and environmental sustainability, to demonstrate the importance to organisations as a whole. The research is based on a survey shared with the C-suite executives, and additional one-to-one interviews with global industry leaders have been conducted. The report built on the findings of an earlier Deloitte report in 2021 that was based on a survey of 750 executives from 13 countries (Deloitte 2021). During the months between the two, the world was battered by extreme weather events – wildfires, flooding, drought (Deloitte 2022). In the US alone, there were 20 separate billion-dollar weather and climate disasters (National Oceanic and Atmospheric Administration 2022). Only 2020 trumped that level of catastrophe.

In Survey 2022, 96 percent of the respondents agreed that climate change would affect their businesses in a moderate-to-very-high way, with 62 percent anticipating the effect would be highly significant. There is a growing sense of urgency. Some 79 percent of respondents agreed that the world is at a climate change tipping point (up from 59 percent in Survey 2021), while 97 percent had already experienced some negative impacts. The pressure to change is coming from many directions, and sustainability is now unquestionably top of mind for executives across the C-suite. CxOs are sounding the alarm. “Extreme weather is here now and affecting us in ways we have not seen before”, said Christine Dacre, CFO of TransLink (Deloitte 2022). “We need to adapt and build resilience into our infrastructure now – there is no more time to talk about it.”

In November 2021, 120 world leaders attended the UN Climate Change Conference in Glasgow (COP26). There, countries reaffirmed the Paris Agreement goal of limiting the increase in the global average temperature to well below 2°C above pre-industrial levels, and pursuing efforts to limit it to 1.5°C.

The governments at COP26 also expressed “alarm and utmost concern that human activities have caused around 1.1°C of warming to date, that impacts are already being felt in every region, and that carbon budgets consistent with achieving the Paris Agreement temperature goal are now small and being rapidly depleted.” Recognising that the impacts of climate change will be much lower at a temperature increase of 1.5°C compared with 2°C, countries stressed the urgency of action “in this critical decade.” By 2030, carbon dioxide emissions must be reduced by 45 percent if the world is to achieve net zero around mid-century.

The growing pressure from society, policymakers and stakeholders on C-suite executives to make climate-relevant improvements comes through strongly on the results of Survey 2022. Three-quarters of the respondents said they are feeling large or moderate pressure to act from regulators, government, board members and consumers or customers (see Chart 1). At the same time, business leaders want clarity and certainty – they need to know what regulators and policymakers will demand of them. Indeed, 47 percent of respondents cited climate-related “regulatory and political uncertainty” as impacting their business already (Deloitte 2022).

Chart 1.

Investors’ views are also influencing many executives’ thinking. “For our company to be considered a good investment, we have to demonstrate to investors how we are sustaining the environment now and in the future”, said Tom Doll, President and CEO of Subaru of America (Deloitte 2022). “Part of being an appealing company today is to make sure you are environmentally conscious and actually doing something authentic.”

Businesses are prepared to rise to that challenge. In Survey 2022, the vast majority (88 percent) of respondents agreed that immediate action will limit the worst impacts of climate change. That figure was significantly lower, at 63 percent, in Survey 2021. The increase is in line with the Risk in Focus research by the IIA in 2022 (Institute of Internal Auditors 2022). The research, conducted through qualitative interviews with 35 CAEs, 12 audit committee supervisors and 3 CEOs, demonstrates an increasing importance of climate change and environmental sustainability on the agenda. The number of CAEs who recognise this as a top-five risk has increased from 14 percent in 2020 to 31 percent in 2022.

During a Deloitte-facilitated event for 35 CAEs ahead of the IIA conference 2022 (Institute of Internal Auditors 2022), we obtained similar results. 38 percent of the CAEs consider sustainability (in the broad definition) as a key theme, stating that sustainability efforts were present at all levels of the organisation. 15 percent even stated that sustainability has been part of organisational DNA for many years. Meanwhile, 24 percent recognise sustainability as a key theme, but feel that action on sustainability is currently driven more by external expectation and new regulation than internal motivation. The remaining 23 percent lag behind, having, for example, no clear vision on their organisations’ sustainability approach and objectives.

Whatever their perspective, we find that in most businesses, any sense of ambition or urgency around sustainability still needs to be translated into meaningful action. Survey 2022 found most organisations are struggling to embed climate considerations into their cultures and strategies, and obtain broad senior leader buy-in. In the subsequent sections, we will explain why Internal Audit is urged to act (see Chart 2), and how IA can help their organisations to change.

Chart 2.

Deloitte’s internal audit work across all sectors points very clearly to the role IA is expected to play in the world of sustainability. We have experienced soaring demand for sustainability-related (internal audit) engagements, and even though management is responsible, IA can and should have a supportive role and act as a catalyst.

The opportunity is to go beyond the conformance and compliance activity and catalyse true change within organisations. By adding value at the design stage of an organisation’s response to the sustainability challenge, IA professionals can help the whole organisation navigate its way through new and largely uncharted territory for the CxO community – as executives are expected to know all the answers. Those answers will be felt throughout the range of business activities – from how the strategy is set, through to detailed aspects of the client or customer experience. Our observations align with the IIA’s own research on climate change and environmental risk (De Blok et al. 2021), which supports our assertion that the IA function is expected to play a role – especially when the theme has a clear link with the strategic objectives of the organisation.

In the short term, having a considered and comprehensive response to the sustainability question will improve how the business is regarded by those looking to invest in it, do business with it, or work for it. In the longer run, having a well-engineered way of meeting the sustainability challenge could be of existential value, as environmental and social tipping points combined with market forces increasingly make it harder to operate without such forethought.

We see many ways in which IA professionals can help their organisation meet the sustainability challenge beyond ensuring adherence to regulations and the satisfaction of legal obligations. The first is to be positioned as sustainability IA experts, which will require investment of both time and effort to acquire the knowledge. Internal auditors are often seen as specialists in financial, operational and compliance risk, and it requires both retraining and rebranding to present those same professionals as experts in the risks emerging from sustainability too. This in turn provides the forum for IA individuals to have deeper conversations with stakeholders than they may have done previously, and understand the environmental and sustainability agenda of individual stakeholders.

The ability to steer a professional dialogue around such issues while acting in the best interests of an employer organisation may be less developed by some in the profession than others, but the opportunity for all to forge more meaningful relationships with stakeholders is there to be taken.

As a profession, IA has most of the required skills and experience to both catalyse and investigate what organisations are doing to live up to their sustainability promises (Fedele and Schor 2021). Having high-level connections and perspectives, yet the ability to perform very detailed work too, is precisely the expertise that can help to ensure the strategic aspects of sustainability planning are dealt with at an operational level.

The IA function is networked to both executive and non-executive directors in a unique way. Independence and objectivity with an assurance mindset already predisposes internal auditors to be involved in the task of ensuring communications about sustainability conformance and performance are fair and true. The consulting capability of IA professionals also puts them in an ideal position to add value and improve an organisation’s operations. The IA philosophy of being systematic, methodical and disciplined is also vital to having comprehensive and multidisciplinary approaches to assessing the management and control of the strategic goals on sustainability.

For many organisations, the journey towards improved environmental sustainability will be challenging. Given new legal requirements and stakeholder expectations, we expect that for certain classes of business, up to 25 percent of IA time may be required on matters of ESG reporting and related compliance issues over the next three to five years. What is clear for all organisations is that data, risk and control will become increasingly important in the context of environmental sustainability – and ESG reporting in general (Association of International Certified Professional Accountants and Center for Audit Quality 2021). This increasing importance, and the need for a substantiated and controlled approach subsequently, highlights the opportunity – and need – for Internal Audit to play a role in the organisation’s ESG development process.

“The Internal Audit activity must evaluate and contribute to the improvement of the organisation’s governance, risk management and controls processes using a systematic, disciplined, and risk-based approach. Internal Audit credibility and value are enhanced when auditors are proactive, and their evaluations offer new insights and consider future impact.” (IPPF, 2100 Nature of work).

IA is positioned to play a key role, in understanding what the implementation of the regulations require, and in helping to anticipate and assess the integrity and transparency of the data to be used, and the appropriate technology to be in place. IA should also be there to give insights to management on the steps needed to be taken, so that the data and control framework and the underlying IT landscape are robust enough both for the organisation’s operational needs, and also for the eyes of external auditors and regulators. Chart 3 illustrates the expected transformations that influence an organisation, as well as its Internal Audit function.

Chart 3.

As mentioned above, gaining the knowledge to position IA individuals as experts in the field – particularly on the aspects of governance, risk management and internal control, but also covering emerging and sector-specific regulations – is of great relevance. That knowledge acts as the foundation for IA to establish itself as a Sustainability Business Partner, helping to advise the business on its transition, while addressing risks along the way (De Draaijer 2012). The goal for the business and IA in their partnership is to ensure that the sustainability strategy is aligned with both near-market expectations and more distant external stakeholder demands, such as those from financiers and regulators. Not all investments made in sustainability will be recouped in the short or even medium term, but they will lay the foundations for continued operations, and are likely to add value as viewed by investors in the form of intangible assets.

Beyond the strategic position, IA must challenge how business processes work in reality, and assess whether the organisation has the right KPI and risk measures in place to ensure that the incentives to stick to recommended ways of working are effectively reflected in the management measurement and reward mechanisms. At the heart of these critical measurements is the accuracy of the ESG data that the organisation reports and acts upon. With IA’s involvement, the evolution of data, information and technology landscapes to be fit for sustainability change can be achieved with far greater accuracy than if IA were absent from the planning and design phases. Once the strategy, business model and processes, supporting technology, and output data and information challenges have been tackled, there is also an ongoing role for IA to ensure sustainability features throughout its own charter, audit universe, risk assessment and audit plans, in order to spot the subtle exceptions and nuances that can undermine the good work of a sustainability mission.

It is very likely that most organisations will find themselves progressing through a sustainability maturity journey, from conformance to performance and greater value creation – perhaps starting with satisfying the basics, and then progressing to a more mature, leading or innovating stance. The interventions required by IA, and the reporting required from IA, will evolve during that journey and, by implication, require a different shape or make-up of team along the way.

From initial gap analysis between strategy and the means to deliver, through to a day-to-day commitment to live up to sustainability expectations, IA has a deep role to play in every organisation and can genuinely make a difference to the impact organisations have on the environment. By driving thought leadership on a new topic, emphasising the connection between strategy, risk management and controlled processes, while riding the strong momentum behind sustainability, Internal Audit will be able to improve its standing and credibility within the organisation even further. In short, the push for sustainability is an opportunity to add more value to the organisation, and also more broadly to society (see Chart 4).

Chart 4.

On a practical level, we see that IA’s role can develop through three integrated pillars, from knowledge to business partnering to full sustainability integration within IA activity.

Organisations that lead in the context of sustainability are more likely than others to see the benefits of their efforts, and less likely to see cost and short-term priorities as obstacles – perhaps an indication that they grasp the price of climate and social inaction. They will also have more sophisticated demands of their IA professionals, and require more nuanced insights than remedial recommendations. For the purpose of categorising the different IA responses required, Deloitte classifies organisations four ways, depending on the extent to which they have embraced sustainability: follower, mature, leader and innovator (see Chart 5).

Chart 5.

The sea-change towards sustainability is going to require considerable commitment from the Internal Audit department, not only in terms of getting to grips with sustainability data, but also embedding the topic throughout internal audit activity. To get started, we suggest taking the following steps:

• Create awareness within the Internal Audit department on the relevance of sustainability.
• Identify where you are (current state).
• Define how Internal Audit will be positioned to be the Sustainability Business Partner for the organisation (ambition) – is sustainability a topic in your conversations with the board, and does your Audit team have a role in the ESG reporting cycle?
• Identify sustainability risks and how they can be embedded throughout the audit plan – have you included sustainability risks in your risk assessment, and are you working with the Risk Management team on the topic of sustainability?
• Identify gaps between your current state and desired ambition level – what does your audit plan look like next year?
• Define an action plan to achieve your desired ambition level – how do you think sustainability will (further) impact your activities?
• Communicate and gain buy-in (commitment, time, money, resources) regarding your ambition (action plan). Keep aligned with first and second line.
• Stimulate intrinsic motivation of the team, to gain and develop sustainability knowledge and insights.
• As a CAE, have that meaningful conversation; be the catalyst for change.

As the potentially catastrophic impact of climate change, environmental impact and social misconduct becomes apparent, the talk about sustainability is finally being translated into a desire to act. As more and more organisations define their sustainability roadmap, they will need the advice and support of Internal Audit in making the action happen. Our recent consultations with a group of 35 Heads of Internal Audit at the IIA pre-conference in 2022 (Instituut van Internal Auditors 2022) confirmed that this shift is both happening and accelerating. Climate change is catalysing a significant response at board level, with IA becoming more involved at a strategic level, and factoring environmental sustainability and ESG into everything they do. Per our three pillars, the key is investing in knowledge to enable sustainability business partnering, and ensuring the sustainability agenda runs deep within IA’s work.

IA has the potential to develop a deeper and more meaningful role within the organisation. The sustainability of a business is an existential issue, fundamentally linked to its financial performance and its ongoing viability, as well as its impact on the environment and society. The time for Internal Audit to act is now.

With sincere thanks for the contribution of our research assistants Barbara Scarpelli Correa and Sophie Nijenhuis in the realization of this article.