It does not require many words to speak the truth
Chief Joseph
If your organisation either already reports or intends to produce a sustainability report, you will need to be thinking about independent assurance – formal or informal input designed to provide an independent view of the effectiveness, thoroughness and relevance of your sustainability approach.
This post follows on from our insights into the fundamentals of sustainability reporting.
What is assurance?
Assurance is the process by which readers of sustainability or CSR reports and information (commonly referred to as “non-financial information”) can have confidence that what they are reading is “true”. This article provides advice and guidance for organisations new to the world of independent assurance or for those already commissioning such activities who wish to gain more, in terms of both sustainability and business value, from the process.
When I refer to “assurance” I am referring to “independent assurance” rather than assurance conducted by internal audit or other in-company parties.
Why assure?
The aim of any sustainability assurance process is to reassure internal and external stakeholders that the sustainability information provided by organisations is credible. A high quality assurance process should also act as a driver for performance improvement. There has been much debate on whether assurance processes are successful in achieving these aims.
As a judge for sustainability reporting awards, I have tended to believe that a report without an independent assurance statement is not worth the paper that it is printed on. However, it is also possible to have an independent statement which tells the reader so little that it is almost equally worthless!
It is difficult to draw black and white distinctions. Nevertheless a well specified, in-depth, independent assurance process and statement can be a fantastically meaningful, useful and essential part of delivering transparency and accountability and sustainable performance improvement.
What constitutes an assurance statement?
In CSR and sustainability reporting, an “assurance statement” is a blanket term that is used to refer to a number of review, perspective or audit pieces that are commissioned by a reporting company in order to gain insight and to demonstrate the veracity or truth of sustainability management or reporting disclosures.
There are three broad categories for such statements:
- Formal Assurance Statements (e.g. those based upon a specific Assurance methodology – AA 1000AS, ISAE 3000, and the Dutch Standard 3410N.
- Verification statements from accredited bodies which verify against a specific standard (e.g. ISO14001, EMAS).
- Perspective and commentary pieces – a wider category of statements which do neither of the above but which are intended to lend some credibility, weight or reliability to the contents of a report. These might be produced by recognised authorities (or personalities) in sustainability and CSR, NGOs, stakeholder panels or other parties intended to lend weight, gravitas or critical perspective on the work of the reporting organisation.
For a reader of a report – the purpose of any sort of statement is to allow them to have confidence that the contents of the report bear some resemblance to the “truth” of actual company commitment, practice and performance.
Given this, it is most likely that those assurance statements which either follow a clear third party methodology or disclose the methods by which the statement was derived are those likely to be able to create the most trust.
For a reporting organisation, the purpose of an assurance statement is twofold: to allow readers to trust the report contents but also (and this aspect is often overlooked or avoided) to gain insight and understanding from a third party of the strengths and weaknesses of their reporting approach.
Scope and depth
Assurance statements can vary in depth and extent of scrutiny, depending upon the Standard that is being used to conduct the assurance process. For assurance engagements conducted according to Accountability’s AA1000 AS, there is a requirement to “cover the full range of organisational performance”. For those conducted following ISAE 3000 it is possible for assurance to be conducted at either “limited” or “reasonable” levels. These levels refer both to the depth of and scope of activities undertaken to produce the statement, but also determine the type of conclusions made by the assurer.
For “limited” engagements, this conclusion is likely to be a fairly impenetrable, double negative based statement such as “there was nothing which came to our attention which indicated that the statements in this report are not a true and fair picture of…”.
For “reasonable” engagements, the conclusion is a little more meaningful, and will be of the form that “the statements in this report present a true and fair view”.
Using assurance to drive continuous improvement
However, if the purpose of obtaining assurance goes beyond a pretty bland statement from a third party that the contents of a report are not outright untruths then a reporting company should seek to drive value through the process and perhaps engage in a more developmental process.
Such a process can be delivered through specifying the use of AA 1000AS guided statements. These are more detailed, deep and, to a reader such as me, meaningful. They often contain specific recommendations for the development of the reporting company’s approach to managing and disclosing sustainability performance. The best statements may also contain year-on-year commentary which can be a useful way of assessing and disclosing progress in the maturity and embedding of sustainability management.
Type of assurance provider, qualifications and independence
There is a wide range of companies that have moved into the market of providing assurance statements, especially as assurance has moved from being the provision of formal verification statements. Such assurance providers include professional services firms, sustainability and CSR consultancies, specialist auditors and verifiers and specialist non-financial assurance firms.
Because there is such a wide range of companies earning income from providing such statements, it can be difficult for a reader to tell whether any of them is suitably skilled and equipped to provide such statements, therefore it is difficult to know whether the reader should trust all such statements or none of them.
There is, however, guidance on the levels and types of expertise required for the provision of assurance statements, for ISAE3000 and COS 3410N, this is provided by IFAC, for AA1000AS, Accountability has a Certified Sustainability Assurance Practitioner qualification.
Must an assurance provider always be “independent”?
In some cases, the provider of an assurance statement to a company is also the provider of advice and support to that company. Under such circumstances the relationship between the statement provider and the reporting company should be clearly and publicly disclosed.
Judging and specifying a good quality assurance statement – 5 key questions
The following guidance questions are drawn from my experience as a reporting judge and as an active participant in reporting consultancy and a number of best practice initiatives.
- Does the assurance statement cover the whole of the report?
- Does the statement refer to any standard methodology e.g. AA1000 AS, ISAE 3000 or Standard 3410N used to develop the third party statement (in my opinion AA1000 AS is perhaps the most meaningful standard)?
- How deeply did the third party organisation investigate (e.g. did they check the methodology, the figures, conduct interviews within and outside the organisation, did they use secondary data or go back to the original sources)?
- Does the statement note areas for improvement of company performance?
- Does the statement comment on previous performance and indicate key future issues for consideration?
Of course, these questions can also be used as the basis of a checklist to specify future assurance engagements.
Reporting without assurance
Though a large part of the non-financial reporting industry, external assurance remains a minority actvity within most non-financial reporting. At the recent Corporate Register Reporting Awards CRRA13 it was highlighted by Wayne Fletcher of ERMCVS that only 20-25% of reports have assurance.
In addition, and beyond the “Assurance Statement” industry, we are starting to see some company reports without a formal statement but have started to take us towards a “comply or explain” approach – for instance the recent CRRA13 overall report winner Nike – see page 83 of Nike’s Sustainable Business Report.
Without a clear perspective and intention for assurance to provide developmental insights to the company and trust to the stakeholder, assurance can too easily become all about (minimal) process and not about utility or outcomes.
Creativity and innovation is undoubtedly required but it will be essential to maintain a focus upon the ultimate purpose of assurance – it is a mechanism for trust and truth. If it becomes a mechanism for box ticking than we will have lost something vital!
Want to find out more?
In addition to the advice and guidance you can receive from experts such as us, there are a number of recent publications providing an overview of sustainability assurance and its use in practice, see especially, this overview from ICAEW, ACCA’s briefing paper and Corporate Register’s AssureView.
This post was updated in June 2013.
This is a very precised and comprehensive article. I just would like to add some idea about the perspective on the value of the report assurance and quality of the assurance. The comment for the former is the reporting organization is not aware of the important of the report assurance and some consider that it’s redundant. Publishing the routinely annual report is already a big investment for them. And the public at large is only interested in a short and less detail PR promotation than a thick report. Assurance statement as part of the CSR report is not important. In terms of the assurance quality, I’d like to add that regardless of the standard made as reference on the assurance statement, the quality of the assuerer should be the prequisite. There is a promotion of integrated report – – financial + non-financial. The doubt is that would a single assurance provider understands the interrelated subjects of sustainability in which most of the issues cannot financially guaged.
Dear Gary,
Thank you very much for your kind words and for your comment.
Your thoughts speak to a number of very pertinent issues.
Firstly, you are right that there is a challenge for the role and purpose of CSR reports – that at times they can sit midway between a corporate document and a PR document.
However, I do not believe that the point and purpose of a CSR report is to communicate to the general public, like an annual report they should communicate strategic corporate understanding, priorities and performance on CSR/ sustainability to stakeholders – including investors, owners, staff, NGOs, customers, partners and regulators.
If this latter purpose is the case, then assurance should naturally be considered as a requirement – to provide trust as to the quality of the report contents.
Of course, in order for this to be the case, further regulation (or more manifest investor demands) may need to be in place to support CSR information being understood and communicated as additional topics of business and investment interest.
On the issue of assurance quality and the capability of assurers, I completely agree, which is the reason I included some information on the qualifications of assurers.
I think you are absolutely right about the rising challenge of appropriate assurer skills in the context of integrated reporting, and I have heard privately from a number of professionals in this area who have noted that assurers with financial assurance expertise are increasingly out of their depth in an integrated context.
Another, associated issue with integrated reporting is a perceived retreat from deeper assurance for CSR/ sustainability information. My feeling (informed by anecdote rather than data) is that integrated reporting takes companies and assurers into a different mind-set – one more aligned with risk aversion than inclusivity, materiality and responsiveness.
We recently conducted assessment of more than 100 reports from around the world for CorporateRegister.com’s CRRA Reporting Awards – we wrote up some general findings from this exercise and have some observations on the state of assurance which speaks to this very issue: https://www.terrafiniti.com/blog/sustainability-reporting-2014-state-art/
Certainly the capacity of the assurer is a critical issue that should be of prime importance to the commissioning company – the challenge many commissioners might face is their lack of familiarity with the topic and therefore an inability to discern skills gaps in a proposed assurance team. I would say that there are definitely assurers out there that do have the spread of skills required, but that there are also ones out there that presume that experience in one area gives them expertise in another!
Thank you again for your comment, it is really appreciated.
Best regards,
Joss