Sustainability reporting has evolved significantly in recent years. Each organization’s approach to sustainability and ESG initiatives is unique, often involving cross-functional collaboration. Consequently, key stakeholders for sustainability initiatives vary from organization to organization. CFOs and other finance and accounting leaders are increasingly involved or even leading these areas, yet finance and accounting departments often lack a seat at the table when it comes to sustainability. This needs to change because the office of the CFO possesses the skill set to ensure the information being reported is investor-grade.

As sustainability reporting has become an increasingly crucial aspect for stakeholders, including investors, regulators, and customers, the need for this data to be accurate and reliable is as critical as for financial disclosures. Whether a company is just beginning to collect and report this data or has been issuing sustainability reports for years, organizations must consider internal controls around sustainability reporting now. Unfortunately, all too often, the processes for collecting and reporting this data are manual, disparate, and lack proper review.

Prioritizing internal controls in sustainability reporting is not just a best practice; it is essential. Without robust internal controls, the accuracy, completeness, and reliability of ESG data cannot be assured, leading to potential reputational damage, regulatory penalties, and loss of stakeholder trust.

CFOs and sustainability professionals should explore the importance of internal controls in ESG reporting, understand the COSO framework, enact practical steps for establishing these controls, and determine how the process can be strengthened by technology and the role of internal audit.

Importance of Internal Controls in Sustainability Reporting

Ensuring Data Accuracy and Completeness

The demand for high-quality sustainability information is growing. Investors, regulators, and other stakeholders rely on this data to make informed decisions. As sustainability reporting becomes more integral to corporate strategy, ensuring the accuracy and completeness of this information is critical to not only meet stakeholder expectations but also to enhance organizational credibility and build trust. Establishing robust internal controls helps ensure the data collected and reported is reliable and complete, which is essential for maintaining stakeholder confidence.

Regulatory and Assurance Readiness

Several regulations now require assurance over sustainability data, making it imperative for companies to have strong internal controls. The US Securities and Exchange Commission’s (SEC) climate rule mandates that public companies disclose climate-related risks and greenhouse gas emissions, with these disclosures subject to assurance. For example, by 2026, large, accelerated filers will need to provide limited assurance on their Scope 1 and Scope 2 emissions, transitioning to reasonable assurance by 2028. Similarly, California’s Climate Corporate Data Accountability Act requires companies to report and obtain assurance on their greenhouse gas (GHG) emissions starting in 2026 for limited assurance and moving to reasonable assurance in subsequent years. The European Union’s Corporate Sustainability Reporting Directive (CSRD) mandates limited assurance over sustainability reports starting in fiscal year 2024, with the possibility of expanding the scope of assurance in the future. These regulations necessitate rigorous internal controls to ensure compliance.