The Future of Corporate Sustainability Reporting

A rapidly growing assurance opportunity.

by Brian Ballou, Dan L. Heitger and Charles E. Landes

EXECUTIVE SUMMARY

To satisfy the information needs of external and internal stakeholders, more organizations are measuring and reporting on their social and environmental performance. CPAs can play an important role in providing the needed information and helping to verify its accuracy. Corporate sustainability reporting (CSR) involves reporting financial and nonfinancial information to key stakeholders on the company’s operational, social and environmental activities and its ability to deal with related risks. The most dominant CSR regulations are those of the Global Reporting Initiative (GRI), which issued its first comprehensive reporting guidelines in 2002 and its G3 Reporting Framework in October 2006. As of October 2006, more than 1,000 international companies had registered with the GRI and issued corporate sustainability reports using its standards. An opportunity exists for CPAs to audit the information companies present in corporate sustainability reports. As of yet interested parties have not fully agreed on what information can and should be audited. Concern exists about the suitability of the criteria used to prepare the reports and what performance and reporting standards the auditor should use. A joint task force of the AICPA and the Canadian Institute of Chartered Accountants (CICA) concluded the 2002 GRI standards had not yet reached a point where they were suitable criteria to be considered generally acceptable and allow a set of generally accepted assurance standards for CSR reports to be developed. Two exposure drafts offered by accountants in the Netherlands on assurance engagements related to sustainability reporting are currently under review by international accounting organizations including the AICPA. Brian Ballou, CPA, PhD, is an associate professor of accounting at Miami University in Oxford, Ohio. His e-mail address is balloubj@muohio.edu. Dan L. Heitger, PhD, is an assistant professor of accounting at Miami University (Ohio). His e-mail address is heitgedl@muohio.edu. They are codirectors of the Center for Governance, Risk Management and Reporting at the Richard T. Farmer School of Business. Charles E. Landes, CPA, is vice-president, AICPA professional standards and services. He oversees technical activities, including the Auditing Standards Board, and also is the AICPA’s representative on COSO. His e-mail address is clandes@aicpa.org. Mr. Landes is an employee of the American Institute of CPAs. His views, as expressed in this article, do not necessarily reflect the views of the Institute. Official positions are determined through certain specific committee procedures, due process and deliberation.

aced with increased pressure from internal and external stakeholders, more organizations are measuring and reporting on their social and environmental performance as well as the usual financial reporting measures. Stakeholders have been pressing companies to publicly report this information either in annual financial reports to shareholders or in voluntary corporate performance reports. The worldwide growth of socially responsible investment funds, investment rating systems such as the Dow Jones Sustainability Index and investment policy disclosure requirements also have put financial pressures on companies to make these nonfinancial disclosures.

As this trend grows, so, too, will the role of accountants and auditors. CPAs within organizations will play a key role by providing and measuring the social and environmental information, using their skills to improve its quality and facilitate its use to make sound business decisions in areas such as investment appraisal, budgeting and strategic planning. Auditors also will have a significant role in verifying the accuracy of the reported information as well as the systems and practices from which it is derived. This article provides all CPAs with an overview of corporate sustainability reporting and the role it may play in businesses worldwide.

BEYOND THE BOTTOM LINE
Organizations have come to realize that meeting stakeholder expectations is as necessary a condition for sustainability as the need to achieve overall strategic business objectives. While maximizing shareholder value continues to be an overriding concern, companies will not be able to do that over the long term if they don’t meet other key stakeholder interests. According to a PricewaterhouseCoopers report, The Value Reporting Revolution: Moving Beyond the Earnings Game, “to create long-term economic value for society—shareholders and other stakeholders alike—sustainability says that companies must also create social and environmental value.” To create transparent reports that provide accurate and reliable data, as well as a fair picture of overall performance, many companies are now reporting results across the “triple bottom line” of economic, environmental and social performance.

Triple-bottom-line reporting, also known as corporate sustainability reporting (CSR), involves reporting nonfinancial and financial information to a broader set of stakeholders than just shareholders (see exhibit 1 for some examples). The reports inform stakeholder groups of the reporting organization’s ability to manage key risks. Because these interests vary, the type of information varies; however, much of it has to do with the company’s economic, operational, social, philanthropic and environmental objectives.

Typical Stakeholders for U.S. Publicly Owned Organizations Financial stakeholders Shareholders (institutions, hedge funds, employees and individuals) Bond holders Banking institutions Employees (including unions) Other sources of capital (venture capitalists) Supply chain stakeholders Customers Alliance partners Direct suppliers Upstream suppliers Contractors   Regulatory stakeholders Securities and Exchange Commission Internal Revenue Service Occupational Health and Safety Administration Food and Drug Administration Environmental Protection Agency Accounting standard setters (FASB, IASB, PCAOB) Federal Communications Commission Political stakeholders Federal government (lawmaking and court decisions, for example) State governments International governments United Nations European Union OPEC NATO Social stakeholders Local communities General public Academia Charitable organizations funded by companies Environmental and social organizations

A number of companies—DuPont, Mobil, Allstate, Gap Inc. and British Petroleum-Amoco among them—recognize the potential comparative advantages of publicly disclosing their goals related to nonfinancial and financial performance measures and then reporting on how well they achieve them. To better understand the pressure to be transparent about a broad number of issues, consider that Wal-Mart’s annual revenues exceed the gross domestic product (GDP) of Austria; ExxonMobil’s revenue is greater than the GDP of Argentina or Turkey; and General Motors’ revenue is more than the combined GDP of Columbia and the Philippines. All of them are among the world’s 50 largest countries.

CRITERIA FOR PREPARING SUSTAINABILITY REPORTS
Reports on corporate sustainability generally are prepared based on reporting criteria established by an outside organization or the company’s internal guidelines. The most dominant reporting regulations are those of the Global Reporting Initiative (GRI). Launched in 1997 with the goal of “enhancing the quality, rigor, and utility of sustainability reporting,” the GRI began to develop criteria that could eventually serve as the basis for generally accepted reporting standards. The GRI has received active support and input from numerous groups—including businesses, not-for-profit organizations, accounting regulatory bodies (including the AICPA), investor organizations and trade unions—to build reporting guidelines that are accepted worldwide. In October 2006 it released its second comprehensive set of reporting guidelines—called the G3 Reporting Framework.

The rapid increase in the number of companies around the world adopting GRI standards and issuing corporate sustainability reports, along with the fact that the GRI works closely with the United Nations, gives its reporting criteria the credibility necessary to be considered generally accepted. Overall, the number of organizations reporting under GRI guidelines has grown exponentially since 2000. As of October 2006, nearly 1,000 international companies from more than 60 countries had registered with the GRI and were issuing corporate sustainability reports using some or all of its standards. (See exhibit 2 for a list of the 100 U.S. companies.)

U.S. Companies Registered With the GRI for Corporate Sustainability Reporting 3M Abbott Labs AMD AES Corporation Agilent Alcoa Allegan Alliant Energy Amerada Hess American Standard Companies Anheuser-Busch Applied Materials Avon Products Bank of America Baxter Ben & Jerry’s Bristol-Myers Squibb Brown & Williamson Calvert Group Cascade Eng. Catholic Healthcare West CH2M Hill Chevron Chiquita Brands Cinergy (now Duke) Cisco Systems Citigroup Coca-Cola Enterprises Cummins Dell Dow Chemical Dow Corning Du Pont Ecolab EDS Exxon Mobil Ford Freescale Semiconductor GAP Genecor GE GM Georgia-Pacific Gillette (now P&G) Green Mountain Energy Haworth Heinz Hewlett-Packard Intel IBM International Finance International Paper Johnson & Johnson Kimberly Clark Louisiana Pacific Lucent Masco Mattel McDonald’s MeadWestvaco Merck Microsoft Mirant Motorola National Grid Newmont Mining Nike Office Depot Pepsico Pinnacle West Capital Plan A Polaroid Procter & Gamble R J Reynolds Reebok Rio Tinto Borax SC Johnson & Son Seventh Generation Smithfield Foods Staples Starbucks State Street Sunoco Target Temple-Inland Texas Instruments Timberland Time Warner Tyco Tyson Foods UPS United Technologies Visteon Wells Fargo Weyerhaeuser Wisconsin Energy World Bank Group Wyeth YSI Incorporated Source: As of October 2006, www.globalreporting.org.

Companies can use GRI guidelines in several ways with varying degrees of stringency. For example, they may elect to use them for informal reference or to apply them incrementally. Or they may decide to report their corporate sustainability information based on the more demanding in accordance level. The move from informal to in accordance under GRI standards occurs through enhancements of transparent reporting, reporting coverage across the company and reporting structure (see www.globalreporting.org/services/ for more information). As of July 2006, just over 20% of the organizations issuing CSR reports using GRI guidelines did so at the in accordance level. This percentage has been increasing since 2002, suggesting organizations issuing CSR reports recognize an increasing market value for in accordance reports. The new G3 Reporting Framework is designed to improve the process whereby organizations become in accordance.

OPPORTUNITIES TO PROVIDE ASSURANCE FOR CSR
As with any information an organization reports, the lack of an accompanying independent assurance report reduces the quality and informational usefulness of a CSR. (See “Fraud Risk in CSR.”) Consider the reaction should public companies begin to issue unaudited financial statements. Aspects of CSRs are auditable because they are quantitative and verifiable. However, the current lack of reliable metrics for all stakeholder measures results in many qualitative statements about risk management and performance and quantitative measures that are not reliable enough to audit. Thus, the reports that are audited generally are limited in scope (a report might be accompanied by a legend stating which measures are audited).

The GRI’s new reporting framework addresses the issue of assurance for CSRs. Exhibit 3, below, provides details on the framework’s choices on assurance. In 2005 KPMG reported that accounting firms prepared more than 50% of the assurance reports for CSRs.

Assurance Guidance in the GRI G3 Reporting Framework Assurance Choices on assurance Organizations use a variety of approaches to enhance the credibility of their reports. Organizations may have systems of internal controls in place, including internal audit functions, as part of their processes for managing and reporting information. These internal systems are important to the overall integrity and credibility of a report. However, the GRI recommends the use of external assurance for sustainability reports in addition to any internal resources. A variety of approaches are currently used by report preparers to implement external assurance, including the use of professional assurance providers, stakeholder panels, and other external groups or individuals. However, regardless of the specific approach, it should be conducted by competent groups or individuals external to the organization. These engagements may employ groups or individuals that follow professional standards for assurance, or they may involve approaches that follow systematic, documented, and evidence-based processes but are not governed by a specific standard. The GRI uses the term external assurance to refer to activities designed to result in published conclusions on the quality of the report and the information contained within it. This includes, but is not limited to, consideration of underlying processes for preparing this information. This is different from activities designed to assess or validate the quality or level of performance of an organization, such as issuing performance certifications or compliance assessments. Overall, the key qualities for external assurance of reports using the GRI Reporting Framework are that it: Is conducted by groups or individuals external to the organization who are demonstrably competent in both the subject matter and assurance practices; Is implemented in a manner that is systematic, documented, evidence-based, and characterized by defined procedures; Assesses whether the report provides a reasonable and balanced presentation of performance, taking into consideration the veracity of data in a report as well as the overall selection of content; Utilizes groups or individuals to conduct the assurance who are not unduly limited by their relationship with the organization or its stakeholders to reach and publish an independent and impartial conclusion on the report; Assesses the extent to which the report preparer has applied the GRI Reporting Framework (including the Reporting Principles) in the course of reaching its conclusions; and Results in an opinion or set of conclusions that is publicly available in written form, and a statement from the assurance provider on their relationship to the report preparer. As indicated in Profile Disclosure 3.13, organizations should disclose information on their approach to external assurance. Source: www.globalreporting.org.

Exhibit 4 shows the CSR audit opinion for Royal Dutch/Shell’s 2003 fiscal year. It was jointly audited by PricewaterhouseCoopers LLP (London) and KPMG LLP (The Hague). The opinion points out that only certain measures in the report were audited and describes the type of procedures performed. The last statement in the scope paragraph provides negative assurance for the remainder of the corporate sustainability report (the accounting firms read that part of the report and noted no material inconsistencies).

Independent Auditors’ Report for Royal Dutch/Shell 2003 Corporate Sustainability Report Source: The Shell Report 2003, Royal Dutch/Shell Group of Companies, www.shell.com.

The majority of information on which assurance currently is being provided is nonfinancial, quantitative performance measures. For example, PricewaterhouseCoopers and KPMG provided assurance on these performance measures in the Shell report:

Global warming potential.
Energy efficiency.
Total spills.
Flaring in exploration and production activities.
Fatal accident rate.
Injury frequency.
Carbon dioxide release.
Methane release.
Regulatory, health, safety and environmental fines.

While there are many other performance measures in the report, their auditability was not at the level the firms could audit with a high enough level of assurance to provide an opinion.

Other assurance approaches that accounting firms use include a review level engagement or limited assurance based on the policies in place and the results of evidence-gathering procedures, as well as verification reports that refer to existing international assurance and attestation standards. For example, exhibit 5 contains the independent auditors’ report for Starbucks’ 2005 CSR. Moss Adams LLP issued it as being prepared using international standards approved by the IAASB and issued in 2005 as a guideline. The firm’s conclusion says Starbuck’s CSR was prepared consistent with its internal policies and report information was reasonably supported by documentation, internal processes and activities, and information provided by external parties. This type of report, while only referring to established criteria (standards approved by the IAASB) still improves the quality of information for external users.

Auditors’ Report of Starbucks Corporation Sustainability Report Source: Starbucks 2005 Corporate Social Responsibility Report, www.starbucks.com.

Shell’s 2005 CSR report was ranked no. 1 by Pleon’s 2005 Global Stakeholder Report (www.pleon.com), which asked stakeholders worldwide to give examples of companies that do a good job of CSR reporting. Interestingly, Shell changed its approach for its 2005 report from using independent accounting firms to an independent panel of experts who reviewed the CSR and offered praise and criticism (see exhibit 6 for excerpts from the panel’s report). While this change does not mean the independent accounting firms were ineffective, it suggests organizations should consider a range of methods for providing assurance about the information in the CSR. If accountants fail to act on the opportunity to provide assurance, companies will begin to adopt other, less rigorous, means.

Expert Panel Report for Shell Group 2005 Corporate Sustainability Report Panel of Experts: Margaret Jungk, Business Department Director, Danish Institute For Human Rights Dr. Li Lailai, National Programme Director, Leadership For Environment And Development (Lead)—China: Director, Institute For Environment And Development, Beijing Jermyn Brooks (Review Committee Chair), Board Member, Transparency International Roger Hammond, Development Director, Living Earth Jonathan Lash, President, World Resources Institute. Shell invited us to assess on two counts. Firstly, does it contain the right information about the full range of issues that Shell stakeholders care most about? Secondly, how well does it reflect understanding of stakeholders’ expectations? We were guided in our appraisal by the AA1000 Assurance Standard, an independent standard for evaluating sustainability reports against three basic principles: materiality, completeness and responsiveness to stakeholders. We met twice during the final stages of Shell’s report drafting process. We interviewed senior Shell staff, including the Chief Executive, and individuals involved with the biggest projects and issues in the Report. In recognition of our time and expertise, an honorarium was offered, payable to us individually or to the organisation of our choice. This is our assessment of the 2005 Shell Sustainability Report, unedited by Shell. We speak here as individuals, not for our organisations. Shell’s sustainability reporting Since 1998, Shell’s reporting has been judged by many external experts as among the best in its sector and overall. Shell has made a serious effort to compile a full and informative report that responds to the needs of the company’s international stakeholders, while keeping it concise and readable. The Report’s combination of descriptions of the energy challenge and Shell’s business strategy, along with environmental and social performance data, documents Shell’s concern with sustainability issues and performance. The Report is frank and honest. The company discusses successes as well as challenges and mistakes made (for example, in the accounts of the Corrib and Sakhalin projects). [Detailed Comments on Specific Sections Excluded—see Shell.com for complete report] We suggest the following ways Shell might improve future Sustainability Reports: In selecting subjects for inclusion in the Report, Shell prioritises issues which have the greatest impact on Shell and are highlighted by pressure groups. These measures may fail to take sufficiently into account impacts on wider society, that are not currently the subject of pressure group or media campaigns, but where the company has a substantial and sustained impact. We recommend that these be considered as key selection criteria in future Reports. Shell is increasing the number of upstream projects. It is important for the company to comment on how the Shell Project Academy and biodiversity knowledge management system will contribute to the capture and transfer of project experience and skills. Emphasis should be on stakeholder dialogue and conflict-management skills. Key performance indicators are presented in the data section of the Report. We believe they could be improved by inclusion of additional metrics, for example relating to pay discrepancies between nationals and non-nationals, the average number of hours worked annually, and the use of hotlines to report breaches of Shell’s General Business Principles. The annual spend on researching and developing renewables would be more helpful than cumulative figures for the last five years. Conclusion We want to thank Shell for its commitment to reporting and its willingness to seek external review of the results. We are impressed by the Report’s quality and the care with which it has been compiled. Our critical comments in no way diminish this. We are unanimous in encouraging Shell to make progress on this path. The Hague, April 3, 2006 Source: The Shell Report 2005, The Shell Group, www.shell.com.

CHALLENGES OF PROVIDING AUDITOR ASSURANCE
There are two major challenges in providing a sustainability report with auditor assurance: the suitability of the criteria management uses to prepare its sustainability report and the performance and reporting standards the auditor uses. International and national standard setters should not let these challenges deter them from seeking a solution—there is need for these reports, as well as to protect the public through auditor verification.

While the GRI appears to have the most commonly adopted criteria for sustainability reporting and is the organization likely to evolve as providing generally accepted CSR guidelines, it has yet to be recognized in this role by a regulatory body. One reason GRI standards are not generally accepted is the nature of the measures included in its earlier 2002 reporting guidelines, which faced issues associated with relevance, reliability, auditability and the like. The GRI says one of its goals in issuing the new G3 guidelines was to improve the relevance and auditability of measures.

In 2002 the AICPA and the Canadian Institute of Chartered Accountants (CICA) formed a joint task force on sustainability reporting. While the task force concluded in 2003 that the GRI had not yet developed to a point where its criteria were suitable, it also recognized the importance of working with the GRI and international standard setters to develop performance and reporting criteria. The task force took an important step in the United States by developing the first attestation engagement on environmental reporting. With the approval of the AICPA Auditing Standards Board, the task force issued Statement of Position 03-2, Attest Engagements on Greenhouse Gas Emissions Information. The AICPA also is participating in the Enhanced Business Reporting Consortium (www.ebr360.com), which is examining how to improve information for public company stakeholders.

In January 2005 the professional body of accountants in the Netherlands published two exposure drafts—ED 3410, Assurance Engagements Relating To Sustainability Report, and ED 3010, Practitioners Working With Subject Matter Experts From Other Disciplines On Non-Financial Assurance Engagements (presumably referenced in the Starbucks CSR assurance report). These documents were built on International Assurance Standards, which are similar to the attestation standards the ASB issues. In response the International Audit and Assurance Standards Board (IAASB) formed a sustainability advisory expert panel (which includes members from the AICPA/CICA task force) to review the EDs and provide comments and suggestions to the Netherlands. The EDs and the IAASB comment letter can found at www.ifac.org.

The letter focused on several key aspects of the EDs that needed refinement before they would be acceptable to the IAASB and ASB. Those include:

Judgments around the suitability of criteria decision.
The use of experts in performing these types of engagements.
The work effort necessary to distinguish between reasonable or high assurance vs. limited or moderate assurance.
Materiality factors to consider in planning the scope of the engagement and when deciding on the type of report to issue.
The completeness of the sustainability report.

Adding further to the auditor’s challenge is the realization that the information in such reports usually is generated by a diverse set of measurement techniques. Information may be gathered from various sources, some of which are outside the reporting organization because of the specialized expertise required to accurately measure certain items. These circumstances may require the auditor to become familiar with the measurement procedures, management practices, systems and integrity of the other organization(s), in addition to those of the reporting organization. As Shell notes in its 2003 CSR, “environmental and social data and assertions are subject to more inherent limitations than financial data, given both their nature and the methods used for determining, calculating or estimating such data.”

An alternate set of assurance standards has been developed by AccountAbility, which has no relationship with the AICPA, IFAC or other well-established assurance organizations. In 2002 AccountAbility issued its AA1000Assurance Standards, which represented the first assurance standard covering sustainability reporting and performance based on principles of materiality, completeness and responsiveness (www.accountability.org.uk). Some 120 organizations used the AA1000 standard in 2004.

GROWTH OPPORTUNITY
Corporate sustainability reporting is a rapidly growing way to address stakeholder demands for risk management and more performance measurement information. There are tremendous opportunities for CPAs in industry to be involved with the preparation and disclosure of these reports. The GRI G3 Reporting Framework might emerge as the one most likely to be generally accepted. With organizations issuing corporate sustainability reports at a rapid rate using GRI guidelines, stakeholders for all public companies will come to expect these reports at some point in the future.

There also are tremendous opportunities for CPAs in public practice to provide independent assurance on these reports. However, they face several challenges, including the development of performance and reporting standards. The ASB is supportive of and is working with the IAASB to develop international standards that can be tailored for U.S. auditors. Addressing these challenges will satisfy the growing needs of investors who are demanding the information and who would benefit from auditor assurance. In the 2005 Pleon report, researchers Thomas Lowe and Jens Clausen said CSR report credibility is best achieved by external accountants providing formal external report verification. However, as Shell’s change to an expert panel illustrates, accountants might only have a finite amount of time to step forward and provide the expected assurance.