Auditing sustainable development: internal auditors can add value by assessing their organization's sustainability management system

Internal Auditor, April, 2007 by Hans Nieuwlands

INCREASINGLY, BOARDS OF DIRECTORS are realizing that sustainable development is an essential part of corporate governance. The number of companies publishing sustainability--or corporate social responsibility--reports continues to grow. Formerly seen as a marketing tool, today these reports are used to demonstrate transparency on policies and progress made on the company's economic, environmental, and social responsibilities. Sustainable development thinking emerges quickly and affects many organizations, both in the public and private sector.

Organizations are recognizing that they need a system to structure formerly scattered elements of sustainability information gathering and fill in missing links. Internal auditors are well-positioned to assist management in implementing a sustainability management system and perform system audits after the implementation phase. To do so, however, they must acquire knowledge about sustainability and applicable audit techniques.

THE SUSTAINABILITY MANAGEMENT SYSTEM

According to the United Nations' Brundtland Commission, sustainable development is a process of change in which exploitation of resources, the direction of investments, the orientation of technological development, and institutional change are in harmony and enhance both current and future potential to meet human needs and aspirations. Sustainable development seeks to find the balance between economic, environmental, and social performance.

Organizations following the Global Reporting Initiative's (GRI's) reporting guidelines use specific performance indicators to identify reportable sustainability achievements and challenges. GRI also requires that the organization describe its sustainability management system. In addition to having a sustainability policy and strategy, such a system should include four phases: 1) planning and risk management, 2) implementation and operations, 3) checking and corrective action, and 4) management review and continual improvement. Management is responsible for implementing the sustainability management system, and internal auditing should perform an assessment of its adequacy and effectiveness.

POLICY AND STRATEGY

The sustainability policy should be appropriate to the nature, scale, and sustainability impacts of an organization's activities, products, or services. Internal auditors should review the process that sets and reviews the policy. Auditors should test whether the policy is consistent with the organization's strategic plan and other policies, and verify that it includes all relevant laws, regulations, protocols, and industry standards. They also should determine whether the policy has been communicated to all stakeholders. Further, the policy should be reviewed to identify if it reflects top management commitment and clear targets and objectives.

The sustainability strategy should be consistent with the sustainability policy and overall organizational plan. Processes that have been recognized as being critical to the risk assessment process should be addressed, and the strategy should provide sufficient information and direction to enable effective sustainability objectives, targets, and plans. To determine the practical usefulness of the sustainability strategy, internal auditors should interview those involved in defining the objectives, targets, and plans; review the processes associated with generating them; and communicate their conclusions to top management and the board.

PLANNING AND RISK MANAGEMENT

The planning phase of the management cycle links the sustainability policy and strategy to objectives and targets. Auditors should determine whether described roles and responsibilities are consistent with the strategy and policies, included in job descriptions, and understood by relevant staff and employees. To accomplish this, auditors can review personnel files and conduct interviews or surveys.

Internal auditors should investigate whether systems designed to ensure consistency of objectives and targets with the policy and strategy are adequate and effective. In particular, they should review whether specific objectives and targets assigned to one employee are in conflict with those assigned to another employee. For example, if a buyer in a supermarket chain is instructed to procure fruit at the lowest price possible, desired aspects of labor conditions or the use of pesticides at the supplier's plantation may not meet the company's sustainability standards. Internal auditing should evaluate whether objectives and targets meet specific, measurable, achievable, risk related, and time bound (SMART) criteria.

Given the sustainability objectives and targets set as a result of the organization's policy and strategy, procedures should be established and maintained to identify controllable aspects of the organization's activities, products, and services. Internal auditing should review the design and maintenance of these procedures. In particular, the determination of relevant aspects by which sustainability impact will be measured should be subject to review. GRI's Indicator Protocols can be used as reference materials to determine the best suitable performance indicator. Examples are direct and indirect greenhouse gas emissions by weight, or the noise in decibels produced by departing airplanes within 10 kilometers from an airport.