Maija Orbidane

PwC ESG practice leader

Ance Ziemele

PwC senior auditor

To get ready for implementation of the Corporate Sustainability Reporting Directive (CSRD), in this article we are looking for the answers to why an external review of sustainability reports is necessary, what review procedures are expected, and how we can prepare ourselves for this change.

Why an external review of sustainability reports is necessary

The first and foremost compliance reason is that an external review is directly mandated by legislation. For example, the CSRD states that companies must obtain a statement confirming the reliability of sustainability details they report.

While this is not mandatory as yet, many companies choose to assure the quality of their sustainability reports and the reliability of disclosures by voluntarily engaging a certified auditor to carry out an independent review of sustainability reports. Many companies are preparing their sustainability reports to the Global Reporting Initiative’s standards, which emphasise the best practice of engaging an auditor to obtain an external assurance that the sustainability reports are up to the standard, making compliant companies more attractive and reliable in the eyes of investors, for instance.

Secondly, a review of your sustainability report may also be necessary if your company is part of the supply chain of a large multinational enterprise that is required to report on its sustainability performance along with an external assurance of data reliability in the form of a conclusion or an opinion.

Such an assurance document may have to be filed along with specific sustainability data or a full sustainability report if your company wishes to start doing business with a large multinational enterprise (to sell your goods or services) and one of the applicant screening criteria is to present the requested information with an auditor’s assurance.

We can see that an external review of sustainability reports is no news, yet the upcoming legislation will make it mandatory, as well as more thorough and serious – the bar set for information quality will certainly be higher.

A review of the sustainability report – reasonable assurance or limited assurance?

There are two types of reviews, and auditors will issue two different assurance documents on sustainability reports: a reasonable assurance opinion or a limited assurance conclusion.

A reasonable assurance engagement involves findings being expressed as positive assertions that the auditor has gained a reasonable assurance of the item under review and it is (or is not) compliant in all material respects, as well as giving a true and fair view according to the reporting criteria.

A limited assurance engagement means that based on the procedures carried out, the auditor finds that no matters have come to his attention that cause him to believe that the item under review (the sustainability report in this case) has not been prepared, in all material respects, in accordance with the reporting criteria.

Limited assurance reviews will be required in the early years after the legislation takes effect requiring mandatory reviews of sustainability reports, so in this article we focus on limited assurance reviews. Later years will see a transition to reasonable assurance, moving reviews of sustainability reports closer to how financial statements are being audited. This transition needs appropriate auditing standards, which are being developed, but it will be several years before they come into force.

A review of the sustainability report can be split into four key stages: choosing an auditor, planning the review, running the procedures, and presenting the final conclusion or opinion.

Choosing an auditor

The process is most efficient if your sustainability report is audited by the same certified auditor company that audits your financial statements, because otherwise two different reviews included in one document are more difficult to plan, which can lead to longer time frames, extra costs and various procedural issues (e.g. the same questions coming from different auditors and a higher probability that your sustainability report will not be consistent with your financial statements).

Planning the review

This is the invisible part of the iceberg for the company, as it takes a fairly long time at the auditor’s end, with the company being audited spending much less time on it. The auditor will study the company, its strategy and goals, as well as the process of preparing the sustainability report. Based on the information gathered, risks will be assessed and a procedural plan will be drawn up. The auditor estimates what materiality levels will be used for assessing the quantitative information included in the report.

Running the procedures

Once the plan has been developed and a draft sustainability report (a near-ready version) is available, the auditor can start the review procedures and the testing of internal controls. Dates on which the review will take place are normally defined in the audit services agreement (including a schedule with dates for giving information).

There are two key procedures where the auditor (1) assesses how disclosures in the sustainability report comply with the standard and (2) examines the information and data disclosed. It’s worth noting that the methodology used should be reasonably transparent. This means that if, for example, a specific ratio is calculated, then theoretically you should include or describe the calculation formula so the reader is able to recalculate it.

The review process takes 6–8 weeks on average (requesting documents, interviews, data analysis, etc). You should take this into account when planning your resources and time.

Presenting the final conclusion or opinion

The sustainability report, which will in fact be part of the management report within the financial statements, must be approved by the company’s board (and council if there is one). Before the auditor can issue a signed conclusion or opinion to the management, as with financial statements, the auditor must be provided with a letter of responsibility signed by the management where they confirm that the report is free from material misstatement and that the management has disclosed information on all material facts and circumstances capable of affecting the company’s business and has provided access to all the information requested by the auditor.

How to prepare for a review of your sustainability report

Finally, we encourage you to read questions your company should answer to be ready for a review of its sustainability report:

1. What is the process for preparing, assessing and reporting the information included in your sustainability report?
2. What internal controls has your company set up with respect to drawing up your sustainability report?
3. What information systems, tools and primary sources is your company using for capturing, aggregating and reviewing the quantitative information included in its sustainability report?
4. Has your company used or relied on any data or information prepared by a third party in drawing up your sustainability report?
5. How do you ensure that the information included in your sustainability report is accurate and complete?
6. Which employee(s) is/are responsible for doing the activities mentioned in questions 2 and 5?
7. What is the process for identifying your company’s material sustainability aspects? Is it documented?
8. What is the role of your top management in drawing up your sustainability report?

This article has been written as an add-on to PwC ESG Academy’s new series of webinars, Module 5, “Drawing up a sustainability report and an external review (audit)”. If you want to learn more about sustainability topics, feel free to apply for webinar recordings here.