Internal audit takes a leading role in climate change battle

As Matt Dalton, partner and risk consulting leader at Mazars, says: “Governments will be unable to achieve greenhouse gas reduction plans without the cooperation and support of the business community.

Climate change is a top five risk, a principle risk for organisations, and COP26 emphatically places an intense spotlight on how it will be managed inside businesses.

But while headline greenhouse gas reduction policies may be central to averting a climate catastrophe, there is also a critical role for some unsung business departments.

“Given that climate change is a principle risk,” says Dalton, “there is an important role for internal audit to play in managing an organisation’s response.”

Context

The context for internal audit is clear. COP26 is looming, an event likely to produce policy decisions with implications for business. Investors are already demanding that companies respond to climate change through action on sustainability, while bodies like the UN have set the board agenda through broad initiatives like the Sustainable Development Goals.

National governments have acted too. In the UK, companies must comply with Streamlined Energy and Carbon Reporting while guidelines from the Taskforce on Climate-related Financial Disclosures (TCFD) will become mandatory for most listed companies by 2024.

And as part of major reforms to audit and the audit market, the UK is about to introduce fresh regulation which will require directors to publish a statement on their internal controls, part of which will reflect the role of internal audit.

Consultative

But while internal audit will need to consider a company’s response to regulation, it could become involved in a company’s response to climate change at a much deeper level.

“Internal audit can respond to the climate question, and play a significant role in supporting boards, in two ways,” says Dalton. “They can play their traditional role as a third line of defence ensuring that the second line—risk management, sustainability and compliance—is robust.

“But internal audit can also play a consultative role supporting a business in developing climate-related projects and programmes.”

That may mean placing internal audit and its leadership at the “top table” and in the room as plans for capital projects, new business processes and upgraded supply chains are formulated.

“Internal audit should be involved early,” says Dalton, “at strategy days and providing a risk and controls lens on climate-related decision making.”

“The role should be looking at how a business will change and whether it is investing in capital programmes and sustainable business models and processes to future proof the business.”

“Then it should provide programme assurance ensuring that a company delivers on these initiatives.”

That may raise questions about the kind of expertise needed in a modern internal audit team. For Dalton, a team established now would include change management and programme experts. The push for digital models of doing business as a result of the pandemic, also places a premium on IT expertise and knowledge.

However, internal audit cannot ignore its customary role of providing assurance. This is a well-trodden path that internal audit knows well.

The plethora of new climate-related regulation needs to be built into the process. Chief among those is the TCFD, a reporting framework that demands not only disclosure of numbers but also scenario analysis.

This could be handled as a simple compliance exercise. But William Hughes, sustainability services lead at Mazars, warns against that. He argues that businesses should consider the added value they achieve from implementation of the TCFD, allowing the reporting framework to provoke substantive questions about business models through the lens of climate-related risk and opportunity.

Companies with an integrated approach to climate change and sustainability win themselves a lower cost of capital, lower costs of insurance, increased stakeholder trust and a reputation as an employer of choice.

“It’s important for businesses not to consider regulation as a compliance exercise because there are definite business advantages to be had from engaging in climate-related risk and opportunity,” says Hughes.

That’s the position an enlightened internal audit team would take. “Internal audit has got to get its head around all elements of risk and regulation,” says Dalton. Not least, he adds, because audit committee chairs have signalled their desire for more internal audit. That may require internal audit leaders to strengthen their ties with boardroom figures.

“Internal auditors are pushing at an open door,” says Dalton. “They need to be sitting at the top table. They need to have a consultative role in terms of these major initiatives that have been put in place by companies to change business strategy and models based on climate-related risk and opportunity. It’s very difficult to influence things after they have happened.”