“In the global financial crisis, methods for increasing the effectiveness of auditing have weighed heavily on the minds of those responsible for corporate governance. When a business is making a healthy profit, irregularities can go undetected; however, when cash flow declines, internal costs and operations are more strongly scrutinised and discrepancies detected more easily.
Effective Auditing for Corporates provides proactive advice from business leaders who have realised effective auditing is fundamental to a company’s financial health, and key to shareholders’ perceptions of the company’s value. Aimed primarily at auditors but of significant important to risk managers, CFOs and consultants, Effective Auditing for Corporates not only covers the financials and regulatory compliance, but the crossover between the roles of internal and external auditor.
This book is an essential guide, both a refresher course for what is required from an internal and external audit and an outline of the processes and structures required to ensure the necessary tasks are accomplished. Areas covered include: general audit management, compliance and corporate auditing, the internal audit and governance audit, and up-to-date coverage of regulation globally.”
1. Integrated Reporting Requires
Integrated Assurance
by Robert G. Eccles,a Michael P. Krzus,b
and Liv A. Watsonc
a
Harvard Business School, Boston, Massachusetts, USA
b
Mike Krzus Consulting, Chicago, Illinois, USA
c
XBRL International, Clark, New Jersey, USA
This Chapter Covers
8 brief background on integrated reporting and the important role the
A
accounting profession has played in developing it.
8 he meaning of “materiality” for both financial and nonfinancial information.
T
8 he key challenges faced in providing an integrated assurance opinion.
T
8 ecommendations for overcoming these challenges in order to make integrated
R
assurance opinions a reality.
Introduction
Interest in integrated reporting is growing around the world. It is now required in
South Africa by the approximately 450 companies listed on the Johannesburg Stock
Exchange on a “comply or explain why not” basis.1 Although other countries may
follow South Africa’s lead and mandate integrated reporting over the next several
years, today it is an otherwise entirely voluntary activity by companies. Nevertheless, a
growing number of companies are adopting it because of the substantial benefits they
receive, including a better understanding of the relationship between financial and
nonfinancial performance, improved internal measurement and control systems for
producing reliable and timely nonfinancial information, lower reputational risk, greater
employee engagement, more committed customers who care about sustainability,
more long-term investors who value sustainable strategies, and improved relationships
with other stakeholders.2 There are approximately 240 companies using the Global
Reporting Initiative’s (GRI) G3 Guidelines that identified themselves as producing
an integrated report during 2010.3 Although many of these are European companies,
notable companies producing an integrated report in the United States include
American Electric Power, Pfizer, PepsiCo, Southwest Airlines, and United Technologies
Corporation.
In nearly all cases, the companies that produced an integrated report first started out
by producing a corporate social responsibility or sustainability report.4 The number of
such reports has grown dramatically over the last 10 years. For example, data from
CorporateRegister.com showed 3,287 companies publishing a sustainability report in
2010, compared to 830 companies in 2001.5 Similarly, the number of GRI reporters
had grown from 125 in 2001 to 1,864 in 2010.6
1
2. Effective Auditing for Corporates
Though the growth in sustainability reporting is impressive, the growth in the extent
to which these reports have any form of assurance on them, whether by a Big Four
accounting firm or a specialist boutique, is less impressive.
As shown in Table 1, in 2010 Spain had the largest percentage of companies obtaining
an assurance opinion on their report, at 44%, and the United States had the lowest, at
6%. Providing an assurance opinion on nonfinancial information is a necessary, albeit
incomplete, step toward providing an integrated assurance opinion.
Table 1. Sustainability reports with an external assurance statement 2001–107
2001 2010
Sustainability Sustainability Proportion Sustainability Sustainability Proportion
reports reports of reports reports reports of reports
issued with with issued with with
assurance assurance assurance assurance
(%) (%)
Australia 117 31 26 248 52 21
Canada 61 4 7 213 26 12
Denmark 26 16 62 74 20 25
Finland 27 6 22 71 19 27
France 29 3 10 223 32 14
Italy 58 30 52 566 66 12
Japan 164 25 15 558 56 10
Netherlands 46 14 30 159 39 25
Norway 35 8 23 52 12 23
South Africa 9 4 44 119 29 24
Spain 12 3 25 256 113 44
Sweden 37 6 16 163 49 30
United 169 62 37 566 107 19
Kingdom
United 156 10 6 629 37 6
States
We believe that the full value of integrated reporting will only be realized when
integrated assurance is provided on the report. After all, how much would investors
rely on financial reports if they weren’t accompanied by an audit? It is the audit that,
despite the occasional shortcoming, makes financial reports reliable and comparable.
Reliability comes from the fact that the user knows that an objective third party has
carefully reviewed the reported figures to ensure that the report has been prepared
according to the relevant accounting standards—typically, International Financial
Reporting Standards (IFRS) or US Generally Accepted Accounting Principles (US GAAP).
2
3. Integrated Reporting Requires Integrated Assurance
Comparability of information across companies, at least within a country and a sector,
comes from the fact that they have used the same accounting standards and that the
auditor has used audit procedures that are subject to oversight and review to ensure
their efficacy in ensuring the reliability of the reported information.
To make integrated reports as reliable and comparable as financial reports, an
integrated assurance opinion will have to be provided. Ideally, it will be in the form of
“positive assurance” (“the company did it right”) rather than the “negative assurance”
(“nothing leaped out at us as terribly wrong”) that is typically provided today. What we
are calling for are “integrated audits” that have the same degree of rigor, including the
review of internal systems and controls, as today’s financial audits. And while we prefer
the term “integrated audit” to “integrated assurance” to reinforce this connotation, we
will use the latter because the Public Company Accounting Oversight Board (PCAOB)
in the United States has already established its own, and much more limited, definition
of an “integrated audit.”8 The US Sarbanes–Oxley Act of 2002 established the PCAOB
as the US standard-setter for audits of public companies and reserved the term “audit”
for an examination of financial statements.9 Similarly, the International Auditing and
Assurance Standards Board (IAASB) limits use of the term “audit” to an examination
of the financial statements.10 The IAASB is the audit and assurance standard-setting
organization of the International Federation of Accountants (IFAC).11
In this chapter we will provide some brief background on integrated reporting and the
important role which the accounting profession has already played in developing it, discuss
the meaning of “materiality” for both financial and nonfinancial information, identify the
key challenges in providing an integrated assurance opinion, and make recommendations
for overcoming these challenges in order to make integrated assurance opinions a reality.
Background on Integrated Reporting
On August 2, 2010, the Prince of Wales’ Accounting for Sustainability (A4S)
project and the GRI announced the formation of the International Integrated
Reporting Committee (IIRC).12 The mission of the IIRC is “To create a globally
accepted integrated reporting framework which brings together financial, environmental,
social and governance information in a clear, concise, consistent and comparable format”13
in order to “help business to take more sustainable decisions and enable investors and
other stakeholders to understand how an organization is really performing.”14
The accounting profession, through participation in the IIRC and in other ways,
has already made a substantial contribution to the integrated reporting movement.
Representatives from seven accounting associations (ACCA, CICPA, CIMA, FASB,
IASB, ICAEW, and IFAC) and six accounting firms (BDO Seidman, Deloitte Touche
Tomahtsu, Ernst & Young, Grant Thornton, KPMG, and PricewaterhouseCoopers) sit
on the steering committee of the IIRC.15 These firms have also contributed valuable
resources in the form of secondments. Deloitte,16 Ernst & Young,17 KPMG,18 and
PricewaterhouseCoopers19 have all written white papers on integrated reporting.
On July 27, 2011, the ACCA sponsored a live broadcast “Integrated reporting: A
framework for the future” as part of their annual Research and Insights Conference.20
It is our hope that these firms and associations will soon start contributing ideas and
resources to the topic of integrated assurance.
3
4. Effective Auditing for Corporates
Integrated reporting involves reporting both financial and nonfinancial (environmental,
social, and governance (ESG)) information in a single document, ideally showing
the relationship between the two in terms of how strong performance on ESG issues
contributes to strong financial performance and vice versa. A recent study by Eccles,
Ioannou, and Serafeim (2011) shows that a set of 90 “high sustainability” firms
significantly outperform a matched set of 90 “low sustainability” firms, providing
evidence that attention to ESG issues contributes to financial performance.21 Today
all listed companies are required to report on their financial performance on at least
an annual basis, but reporting on nonfinancial performance is a voluntary exercise in
most countries. We believe that integrated reporting of both financial and nonfinancial
performance should ultimately be mandated. Ioannou and Serafeim (2011) have
shown the benefits to companies and society of mandated ESG reporting.22 The same,
and even more so, will be true of integrated reporting.
What is Integrated Reporting?
In simple terms, integrated reporting combines a company’s key financial and
nonfinancial information into a single document. However, the integration
of financial and nonfinancial reporting is about much more than publishing a
single paper document. An integrated report serves as a means of reporting
financial and nonfinancial information in a way that explains their impact on
each other, answering a fundamental question: Just how does nonfinancial
performance contribute to financial performance, and vice versa?
The International Integrated Reporting Committee’s discussion paper23
adds, “Integrated Reporting brings together material information about an
organization’s strategy, governance, performance and prospects in a way that
reflects the commercial, social and environmental context within which it
operates. It provides a clear and concise representation of how an organization
demonstrates stewardship and how it creates and sustains value.”
Integrated reporting has the potential to significantly change how both
companies and investors make capital allocation decisions, shifting the focus
from that of meeting short-term financial goals to developing a long-term
business strategy that defines sustainability as the creation of economic value
over the long-term.
Integrated reporting involves more than a static document. It also entails providing
performance information in a more integrated way on the company’s website, along
with providing more detailed information of particular interest to shareholders and
other stakeholders. Analytical tools for exploring the relationship between financial
and nonfinancial performance using data from the company and other sources, as well
as comparing the company’s performance to its competitors, can also be provided.
Finally, the company’s website can be used to improve its dialogue and engagement
with all stakeholders. Integrated reporting is as much about listening as it is about
talking.24
4
5. Integrated Reporting Requires Integrated Assurance
Long-term sustainable value creation requires the company to take a holistic view of
the consequences of its decisions regarding financial, natural, and human resources in
terms of how decisions about each type of resource affects the others. It also requires
good governance and risk management in order to ensure that decisions producing
short-term performance do not threaten the company’s long-term performance or,
in more extreme cases, even existence. As expressed by the IIRC, through integrated
reporting a company is able “to demonstrate the linkages between an organization’s
strategy, governance and financial performance and the social, environmental and
economic context within which it operates. The IIRC’s Framework will support an
organization in addressing, in a clear and concise manner, the material issues affecting
its ability to create and sustain value in the short, medium, and longer term.”25
Sustainable Strategies and Value Creation
Companies operate in a multi-faceted world. The global economy is complex
and intertwined, the demand for finite natural resources is accelerating, and
the lingering effects of the 2008 financial crisis have left society skeptical and
untrusting of corporations. Accordingly, a company’s strategy and business must
reflect an inherent understanding of the relationships between the economic,
governance, environmental, and social dimensions of performance.
A sustainable strategy sets a company on a course towards value creation over
the long term.
Sustainable strategies include, but are not limited to (Eccles and Krzus, 2010):
1. Long-term view. Sustainable strategies require a long-term view by
the company and, by implication, its shareholders, who are one class of
stakeholder.
2. Multiple-stakeholder perspective. Sustainable strategies require the
recognition of the legitimacy of the interests of other stakeholders, who must
also take a long-term view.
3. Engagement processes. Sustainable strategies depend upon processes of
engagement for understanding the expectations of all stakeholders.
4. Value creation for all stakeholders. Doing so contributes to value creation
for shareholders as well as to meeting the needs of other stakeholders.
Failure to adopt a sustainable strategy will put a company’s reputation and
its ability to create shareholder value at risk. Success in the 21st century will
belong to organizations that have learned to balance the imperative for long-
term viability of the company and the world it relies on to create economic
value, with the demands for short-term competitiveness and profitability.
Integrated reporting is both the most effective way for a company with a sustainable
strategy to report on its performance and a form of discipline to ensure that it has a
sustainable strategy in the first place. Integrated assurance will enhance the credibility
of the integrated report to both management and investors, thereby increasing its utility
to both.
5
6. Effective Auditing for Corporates
The seeds for an integrated assurance opinion are already being sown. For example,
KPMG does both the financial audit and provides negative assurance on the nonfinancial
information reported by Philips Electronics in its integrated report.26 PricewaterhouseCoopers
does the same for the Novo Nordisk integrated report.27 But to get to a single integrated audit
assurance opinion, the question of defining “materiality” for nonfinancial information needs
to be addressed.
Case Study
The Challenges of Integrated Assurance at Philips Electronics
Interest in nonfinancial (e.g., environmental, social, and governance) information is growing (see
Eccles, Krzus, and Serafeim, 2011). From an investor perspective, a link between sustainability
performance and a company’s ability to create economic value over the long term has been
demonstrated (see Eccles, Ioannou, and Serafeim, 2011). Credibility is one of the keys to increased
demand for, and more widespread acceptance of, nonfinancial information by shareholders and
other stakeholders.
An increasing number of companies have asked their auditor to provide an assurance report
on their nonfinancial information. KPMG found that of the 250 largest companies publishing
environmental, social, and governance reports, 46% of those reports include formal assurance.
This is up from 29% in 2002.28
One of the issues facing companies when they contemplate a request for positive rather
than negative assurance on their nonfinancial information is data quality. Sustainability and other
nonfinancial information are not typically produced by systems subject to robust controls and
processes, as is financial information. As a result, assurance providers may not be able to apply their
methodologies and procedures to nonfinancial information. This doesn’t mean that the data are
inherently inaccurate. However, sustainability managers will be required to establish preventive
and detective controls and complete internal control questionnaires for systems and processes.
A complicating factor for both Philips and KPMG is the absence of generally accepted global
standards for measuring and reporting nonfinancial information. Standards promote reporting
that provides relevant and useful information to stakeholders. Standards are necessary so that
nonfinancial information is meaningful, especially across sectors. Absent standards, comparative
analysis is virtually impossible.
The discussion about integrated assurance at Philips challenged KPMG to carefully weigh the
benefits and risks of providing assurance on nonfinancial information. Certainly, KPMG was in a
position to develop a new revenue stream. However, KPMG—like the other Big Four accounting
firms—realize that their market position depends on the firm’s credibility and reputation.
Anything that threatened the firm’s reputation would be thoroughly and cautiously reviewed.
While some might argue that financial statement audit methodologies can be easily applied
to nonfinancial information, neither KPMG nor other audit firms had fully developed approaches
to provide positive assurance on nonfinancial information. The lack of nonfinancial accounting
standards and related high quality assurance methodologies for nonfinancial information
prevented KPMG from delivering an integrated assurance report.
The process to deliver integrated financial and nonfinancial assurance required a significant
investment of time and people at both Philips and KPMG. Ultimately, Philips shareholders and
other stakeholders need to respond to the question of whether the increased quality and
reliability provided by assurance on nonfinancial information will be judged as adding value.
6
7. Integrated Reporting Requires Integrated Assurance
Materiality
The IIRC, quoted above, refers to “the material issues” that affect the organization’s
“ability to create and sustain value in the short, medium, and longer term.” The
concept of materiality is critical to both financial statement disclosure and the
reporting of nonfinancial information. In addition, judgments about materiality
influence accounting firms’ audit and assurance processes. Ultimately, each user of
business information—management, shareholders, analysts, regulators, civil society,
and a variety of others—determines what is material.
The omission or misstatement of an item in a financial report is material if, in
consideration of relevant facts and circumstances, the magnitude of the item is such
that it is probable that the judgment of a reasonable person would be changed or
influenced by the inclusion or correction of the item. In other words, a matter is
material if there is a substantial likelihood that a reasonable person would consider it
important. The International Accounting Standards Board (IASB) and the US Financial
Accounting Standards Board (FASB) captured this point when both organizations
adopted the same definition of materiality. Materiality is “…an entity-specific aspect
of relevance based on the nature or magnitude (or both) of the items to which the
information relates in the context of an individual entity’s financial report.”29, 30
The concept of materiality in financial reporting has both quantitative (nature) and
qualitative (magnitude) aspects. Regulators and standard-setters often state that
materiality cannot be reduced to a numerical formula, yet numerical “rules of thumb,”
such as 5% of earnings before income taxes or 10% of a given account balance, are
often used as a basis for determining materiality. Since the determination of what is
material must reflect both the nature and the magnitude of an item, simply quantifying
the magnitude of an error or misstatement in percentage terms cannot be used as a
substitute for a full analysis of relevant considerations. Qualitative factors, such as:
8 whether the misstatement masks a change in earnings or other trends,
8 whether the misstatement hides a failure to meet analysts’ earnings
expectations,
8 whether the misstatement changes a loss into income or vice versa,
8 or whether the misstatement affects the compliance with laws or regulations,
may cause quantitatively small amounts to be material. The Supreme Court of the
United States reinforced the importance of considering qualitative and quantitative
factors by ruling that a fact is material if there is “a substantial likelihood that the…
fact would have been viewed by the reasonable investor as having significantly altered
the ‘total mix’ of information made available.”31
Materiality guidance for auditors of financial statements is similar to guidance provided
to companies in preparing their financial statements. For example, the IAASB does not
prescribe any specific methodology for determining materiality, but states that “The
auditor’s determination of materiality is a matter of professional judgment, and is affected
by the auditor’s perception of the financial information needs of users of the financial
statements.”32 Similarly, the PCAOB does not prescribe any methodology for determining
materiality. Instead, the PCAOB standard refers to a US Supreme Court decision.33
7
8. Effective Auditing for Corporates
There are no standards for the preparation of nonfinancial information equivalent
to either IFRS or US GAAP, and there is therefore no materiality guidance for
companies. Yet there is guidance on assurance and attestation methodologies, and
the international and US versions are very similar. The IAASB and the PCAOB use
the terms “assurance” and “attestation” in reference to engagements other than
audits or reviews of historical financial information. PCAOB guidance on attestation
states: “In expressing a conclusion, the practitioner should consider an omission or a
misstatement to be material if the omission or misstatement—individually or when
aggregated with others—is such that a reasonable person would be influenced by
the omission or misstatement. The practitioner should consider both qualitative and
quantitative aspects of omissions and misstatements.”34 Note that the term “reasonable
person” anticipates users of the information other than investors.
Similarly, the IAASB provides the following guidance to assurance providers:
“Materiality is considered in the context of quantitative and qualitative factors, such
as relative magnitude, the nature and extent of the effect of these factors on the
evaluation or measurement of the subject matter, and the interests of the intended
users. The assessment of materiality and the relative importance of quantitative
and qualitative factors in a particular engagement are matters for the practitioner’s
judgment.”35 Again, the term “users” is clearly a broader one than “investors,” raising
the question of whether materiality lies in the eyes of the beholder.
In summary, international and US guidance on materiality for financial and
nonfinancial information is substantively the same and can be broken into two parts.
First, materiality is a matter of professional judgment. Second, the determination of
materiality is based on the company’s and the auditor’s perceptions of the information
needs of users. Both of these elements pose challenges to companies and assurance
providers. There is also the question of whether the absence of detailed rules or fear
of litigation inhibits professionals from exercising judgment. Another issue is whether
it is possible to know if a “reasonable person” would consider a given matter to be
important enough to influence his or her decision-making.
Given that authoritative guidelines for determining materiality for nonfinancial
information are very general at best, companies are developing their own ways to put
this concept into practice. According to the CorporateRegister.com database,36 almost
3,300 sustainability reports were published in 2010, and approximately 800 of those
reports included a discussion of materiality. Seventy-one of these 800 companies
presented a materiality matrix to identify matters that were important to stakeholders
and to the company. Like the reports themselves, there was a wide range in the quality
of the disclosures within the materiality matrix. For example:
8 Banco Bradesco used a materiality matrix in its 2009 report, but did not
populate it.37
8 BASF did not provide a materiality matrix in the paper version of the BASF
Report 2009, but provided a link to an online matrix. Clicking on a topic takes
the reader to a more detailed discussion of the issue. The company identified
approximately 40 key issues (i.e., ranking higher than 0.5 on a scale of 0.0 to
1.0).38
8
9. Integrated Reporting Requires Integrated Assurance
8 L’Oréal mapped topics of concern to stakeholders and relevance to the
company and, similar to BASF, clicking on a link in the online 2009
sustainability report enabled a reader to download a factsheet summarizing
L’Oréal’s approach to these challenges.39
8 Petrobras disclosed over 40 issues in their 2009 sustainability report as highly
relevant to stakeholders and the company.40
8 SolarWorld noted in its 2009 annual report that materiality is determined
by the economic, environmental, and social impact of the topics and
indicators. However, the materiality matrix did not specifically identify
any issues.41
8 State Street Corporation disclosed a small number of critical issues in its 2009
materiality matrix. Key topics and concerns included the company’s role as a
fiduciary, marketplace issues in the current environment, business conduct,
community impacts, and fraud and corruption.42
The materiality disclosures of the six companies identified above are representative
of the information provided by the 71 companies that provide a materiality matrix.
These companies are trying in their own ways to understand which issues should
influence their decisions and actions in order to deliver on dimensions of performance
that are important to the company, its shareholders, and other stakeholders. From
these examples, the following questions are raised that will need to be addressed in
providing integrated assurance opinions: (1) How are the dimensions of the matrices
defined? (2) What is the value of providing a materiality matrix without reporting on
what issues the company regards as material? (3) How does materiality differ across
groups, such as shareholders vs. stakeholders? (4) Can 40 or 50 nonfinancial factors
truly be material?
Challenges to Providing an Integrated Assurance Opinion
There are three major challenges to producing an integrated assurance opinion:
8 developing a global set of credible standards for measuring and reporting
nonfinancial information which have the appropriate governmental support,
just as is true for accounting standards;
8 developing methodologies for providing positive assurance on nonfinancial
information;
8 integrating standards and assurance methodologies for financial and
nonfinancial information in a way that provides a “true and fair view of an
organization’s sustainability.”
Credible Standards for Measuring and Reporting Nonfinancial Information
Standards for nonfinancial information provide the foundation for being able to
provide an integrated assurance opinion that is backed by the same degree of rigor
as a financial audit. This is also the most difficult challenge and one fraught with
contention, as is always the case when establishing standards. Two issues must be
addressed. The first is “Who should be responsible for doing this?” Today there are a
number of organizations that are doing good work in this domain, such as:
9
10. Effective Auditing for Corporates
8 The Carbon Disclosure Project (CDP). As the secretariat to the Climate
Disclosure Standards Board (CDSB), the CDP has developed the Climate
Change Reporting Framework.43 Modeled in some ways after how accounting
standards are set and with significant input from the Big Four firms, the CDSB
has established standards for measuring carbon emissions and could build on
this work to set standards for other environmental issues, such as water.
8 The European Federation of Financial Analyst Societies (EFFAS). EFFAS built
on work done by the Society of Investment Professionals in Germany (DVFA)
and published its own set of key performance indicators with an emphasis on
information that is of particular interest to investors.44 These standards are
both general and industry-specific, which is also true of the G3 Guidelines.
8 The Global Reporting Initiative (GRI). The GRI is one of the oldest standard-
setting organizations for nonfinancial information and its G3 Guidelines
for economic, environmental, and social metrics are currently the most
commonly used set of standards for reporting on ESG performance. The
GRI is currently working on developing its G4 Guidelines to ensure that its
efforts support the work of the IIRC.45 In August 2011, the GRI launched a G4
Public Comment Period46 to solicit comments and ideas from organizational
stakeholders and the public to help shape G4.
8 The International Organization for Standardization (ISO). The ISO published
ISO 14000,47 which focuses on environmental management systems, and ISO
26000,48 and addresses matters of social responsibility.
8 Impact Reporting and Investment Standards (IRIS). IRIS developed
performance indicators and metrics for companies and investors. The
indicators are organized in a framework that is designed to apply across
sectors and geographies.49
8 The Organization for Economic Development and Cooperation (OECD).
The OECD published its most recent version of “Guidelines for reporting by
multinational enterprises” in 2008.50
8 The United Nations Conference on Trade and Development (UNCTAD).
UNCTAD’s Intergovernmental Working Group of Experts on International
Standards of Accounting and Reporting (ISAR) released voluntary guidance
in 2008 to assist enterprises in their efforts to communicate with investors
and other stakeholders.51
The GRI, the CDSB, the DVFA, and other groups attempting to set standards for
nonfinancial information need to collaborate rather than compete with each other so
that the history of “country-GAAP” does not repeat itself.
Assuming that this cooperation emerges—an admittedly big assumption—the
question then becomes “How will these standards become institutionally legitimized
and enforced?” Accounting standards, such as those set by the FASB in the United
States, are ultimately backed by governmental authority; for example, the Securities
and Exchange Commission in the United States. Little to no such governmental
support exists for the work done by the organizations cited above. Until it does,
companies will not know which set of standards to use, comparability of performance
measures across companies will be compromised, and the ultimate reliability of the
reported information will be in doubt.
10
11. Integrated Reporting Requires Integrated Assurance
Methodologies for Providing Assurance on Nonfinancial Information
The second challenge is to develop audit methodologies—and we use the term “audit”
on purpose—for nonfinancial information that are as rigorous as they are for financial
information. Having a rigorous and institutionally legitimate set of standards for
nonfinancial information greatly facilitates the development of audit methodologies.
Procedures for evaluating the quality of the internal control and measurement
systems also need to be developed. Though a crude metric, we suggest that that the
hours (and costs) of auditing nonfinancial information should be roughly the same
level as for financial information. Today there are orders-of-magnitude differences
between the two—one of many factors that contribute to the greater attention paid
to financial information. One obvious concern is whether this will lead to a “windfall”
for external auditors’ fees. If the auditing profession is providing a valued service, it
should be paid for doing so. Our view is that shareholders will ultimately determine
the level of effort and cost applied to the audit of nonfinancial information, and thus
the fees paid to those who perform these audits, based on the value shareholders are
getting from having more reliable information. We also believe that technology can be
used to dramatically reduce the cost of integrated audits, although this will depend
on the development of standards for nonfinancial information which, in turn, requires
a clear concept of materiality for nonfinancial information, as discussed above.
Rigor of Financial Audits and What Goes into Them
The standard auditor’s report, whether prepared under US or international
auditing standards, includes a paragraph that describes the auditor’s
responsibility. This paragraph describes, among other things, the auditing
standards used and that the audit has been planned and performed to obtain
reasonable assurance about whether the financial statements are free of material
misstatement. Also explained is that the auditor tested evidence supporting the
amounts and disclosures in the financial statements and assessed the accounting
principles used and significant estimates made by management. Finally, the
auditor states that the audit provided a reasonable basis for our opinion.
The Center for Audit Quality explains52 processes and practices for the
performance of a financial statement audit. Audit procedures for financial
statement audits that could be replicated to provide assurance on nonfinancial
information include:
1. Inspection. The examination of records or documents, whether internal or
external, in paper form, electronic or other media, or physically examining
an asset. For example, inspecting a sample of invoices.
2. Observation. Observing a process or procedure being performed by
company personnel or others. For example, observing a company’s physical
inventory count, and re-performing counts on a test basis.
3. Inquiry. Seeking information from knowledgeable persons in financial or
nonfinancial roles within the company or outside the company.
4. Confirmation. Obtaining information or representation of an existing
condition directly from a knowledgeable third party.
11
12. Effective Auditing for Corporates
5. Recalculation. Checking the mathematical accuracy of documents or
records.
6. Analytical procedures. Comparison of recorded amounts, or ratios
developed from recorded amounts, to expectations developed by the
independent auditor.
7. Re-performance. The auditor’s independent execution of procedures or
controls that originally were performed as part of the company’s internal
control over financial reporting.
Integrating Standards and Assurance Methodologies for Financial and
Nonfinancial Information
The third challenge is to integrate accounting and auditing standards for financial and
nonfinancial information in order to provide a “true and fair view of an organization’s
sustainability.” Today, the “true and fair”53 view of a company’s financial statements—a
concept that is more common outside of the United States, where the term “presents
fairly”54 is used—asserts that the overall picture provided in the financial statements
is more than simply a collection of “the right numbers” taken one at a time. There is a
rebuttable presumption in both the “true and fair” view and “presents fairly” that the
company is an ongoing concern for one year, unless stated otherwise. This perspective
is a relatively short-term one which is focused solely on shareholders. Since integrated
reporting is intended to give shareholders and other stakeholders information about
the company’s ability to create value over the long term, an integrated assurance
opinion needs to be a “true and fair” view of the company’s long-term sustainability,
explicitly taking into account the extent to which the company is meeting the needs of
other stakeholders in order to be able to continue creating value for its shareholders.
Who Should Provide Integrated Assurance Opinions?
Once these challenges are overcome, the question then becomes which organizations
should issue integrated assurance opinions. We believe that accounting firms,
especially the Big Four and others like BDO Seidman and Grant Thornton, which
audit public companies, have a central role to play. They have the necessary global
networks, established relationships with all public companies, and the skills and a
long tradition of conducting rigorous audits. As a practical matter, at least in the
short term, we do not see any other types of organization as interested in and able
to perform this role. This could change over time as technology advances and other
firms, such as software and IT services firms, develop the capabilities to perform
continuous audits, albeit in a rather different way that will require major adaptations
by auditing standard-setting bodies.
But for the world’s major auditing firms to conduct integrated audits, two other
challenges need to be faced. The first is building the necessary capabilities, and the
second is liability reform. The accounting firms need to take responsibility for the
former, but the latter is a question of public policy and the firms cannot resolve it
on their own. Once an assurance opinion goes beyond financial information based
on accounting standards to include information on environmental, social, and
governance performance, a much broader range of capabilities becomes necessary.
None of the major accounting firms have even close to the necessary capabilities,
although some are working to develop them.
12
13. Integrated Reporting Requires Integrated Assurance
Practice Protection Costs
According to the October 2008 final report of the Advisory Committee on the
Auditing Profession to the US Department of the Treasury,55 the six international
auditing firms paid approximately US$5.7 billion to bring 362 cases to closure
during the period 1997–2009. Of that amount, about US$3.7 billion, or 65%,
was related to the audits of public (listed) companies. Litigation and practice
protection costs include all litigation-related costs—costs of outside counsel and
other experts, settlements and judgments, internal litigation-related costs, and
insurance premiums, less insurance recoveries. The amount is equal to 6.6% of
these firms’ revenues and 15.1% of these firms’ audit- related revenues.
Litigation is clearly of significant concern to the auditing firms but is also of
concern to investors and other market stakeholders. The challenge, certainly
from the perspective of the auditing firms, is that they are an easy target for
litigation. Audit firms are often sued when a company suffers a sudden and
dramatic drop in its stock price or when a company goes bankrupt. Other
stakeholders question whether efforts to limit liability are in the interest of
investors and the capital markets, believing that the firms can best protect
themselves by performing high quality and informative audits in full compliance
with US or international professional standards. Ultimately, the legal system
must balance the needs of auditing firms and the public interest.
The extent to which accounting firms have the incentives and resources to build these
capabilities partially depends on their expected and actual liabilities in conducting
integrated audits. Liability reform remains a hot topic in the auditing profession,
especially in the litigious United States. The debate today centers on the audits of
financial statements, especially when accounting problems are confounded with
a company’s bankruptcy, or when major fraud, especially in top management, is
detected. This debate needs to be extended to the liabilities that will emerge from
giving as much prominence to nonfinancial information as to financial information.
Legislators and regulators will have to address this topic in a reasoned and responsible
way. Ultimately, laws and regulations must balance the need to punish incompetence
and malfeasance while creating an environment that encourages the accounting firms
to make the investments necessary to provide high-quality assurance on nonfinancial
information.
Summary and Further Steps
We will conclude with five recommendations which address the above five challenges.
Each of these recommendations requires the active engagement of the accounting
profession, including those in auditing firms, corporations (such as those in the finance
function and internal audit), and academia. Failure of the accounting profession to help
address these challenges puts its long-term relevance at risk. More importantly, it also puts
at risk the development of a sustainable society.
13
14. Effective Auditing for Corporates
8 First, working with the agencies of the government that give authority to their
efforts, accounting standard-setters, such as the FASB and the IASB, should initiate
projects to determine how to develop an institutionally legitimate set of standards
for nonfinancial information. These bodies have deep expertise in the standard-
setting process, although their domain knowledge is exclusively in the financial
realm. Working with organizations that have expertise in the nonfinancial realm,
they can develop a set of standards for nonfinancial information that have the same
credibility as do standards for financial information. We also suggest that greater
use could be made of technology to speed the development process. Setting
accounting standards is a notoriously slow process, taking years or even decades,
and a greater sense of urgency is necessary if a sustainable society is to be created.
8 Second, auditing standard-setters, such as the PCAOB in the United States and the
IFAC, through the IAASB, should initiate projects for developing auditing standards
for nonfinancial information, with respect both to individual metrics and to the
internal control and measurement systems that produce them. As with accounting
standard-setters, they should leverage their expertise in standard-setting and
extend it by collaborating with organizations that have relevant expertise in the
nonfinancial domain, such as organizations that audit supply chains and adherence
to principles of human rights.
8 Third, both accounting and auditing standard-setting bodies should collaborate on
initiating a project to define the meaning of “a true and fair view of an organization’s
sustainability.” This definition will inform how measurement and auditing standards
for financial and nonfinancial information are forged, rather than spliced, together
in order to produce a truly integrated assurance opinion—a true “integrated
audit” that takes into account the relationship between financial and nonfinancial
performance. This project will require substantial input from organizations that
have the relevant expertise in standard-setting and the assurance of nonfinancial
information.
8 Fourth, the major accounting firms should build the necessary capabilities to
conduct an integrated audit. This will be done through a combination of hiring
individuals with technical skills outside of accounting (such as in engineering
and supply-chain management), acquisitions of firms that have such skills, and
building alliances and partnerships with such firms. The first two approaches
raise an important practical question which the accounting profession and the
entities that regulate it should address: What are the roles and responsibilities of
the nonaccountant professionals within the audit and assurance hierarchies of
the firms? Failure to address this question will leave them forever as “second class
citizens,” to the detriment of placing nonfinancial information on an equal footing
with financial information. The third approach, in which the accounting firm
would be functioning as a “general contractor,” raises issues of liability exposure
and risk-sharing. As experience in the construction industry shows, this is a
difficult question to resolve and no clean and simple solution exists. International
Standards on Auditing56 (ISA) and US Generally Accepted Auditing Standards57
(GAAS) provide similar guidance to auditors who use the work of an expert or
specialist in performing an audit. Both standards apply to the work of, for example,
actuaries, appraisers, attorneys, engineers, environmental consultants, and
geologists. Under international and US standards, the auditor is not permitted to
refer to the work or findings of the specialist to avoid the risk that such a reference
14
15. Integrated Reporting Requires Integrated Assurance
might be misunderstood to be a qualification of the opinion or that any division of
responsibility exists.
Of course, it is conceptually possible to split the responsibilities for auditing
the financial and nonfinancial information between two audit firms, or have a
nonaccounting firm do the latter, or even have a nonaccounting firm issue the
integrated audit with input from an accounting firm on the financial audit. At
least in the short term, we don’t see any of these models as being practical due to
regulations and the unlikelihood that investors would find a nonaccounting firm to
be credible in issuing an integrated audit.
8 Fifth, the politically contentious issue of limiting the liability of accounting firms
should be addressed. Opponents of this idea cite the substantial incomes earned
by partners in the major accounting firms, point out that audit failures and the
inability to detect fraud are still too common, and legitimately worry about the
moral hazard problem if the risk of failure is shifted away from the firms. They may
also point out that the substantial new revenue opportunities made possible by
integrated audits should be enough of an incentive for auditing firms to do them.
However, given the current concentration in the auditing industry,58 especially
with respect to the world’s largest companies, the public risk of losing another
large accounting firm due to litigation is simply too great. In the long term, this
concentration is a public policy question that should be addressed, but in the
short term we need to ensure that sufficient capacity exists to provide integrated
assurance opinions for all listed companies.
More Info
Book:
Eccles, Robert G., and Michael P. Krzus. One Report: Integrated Reporting for a Sustainable
Strategy. Hoboken, NJ: Wiley, 2010.
Article:
Eccles, Robert G., and Kyle Armbrester. “ Integrated reporting in the cloud: Two disruptive
ideas combined.” IESE Insight 8 (First Quarter 2011): 13–20. Online at: tinyurl.com/7tkqojj
Reports:
Eccles, Robert G., Ioannis Ioannou, and George Serafeim. “The impact of a corporate
culture of sustainability on corporate behavior and performance.” Working paper
12-035. Harvard Business School, November 4, 2011. Online at:
www.hbs.edu/research/pdf/12-035.pdf
Ioannou, Ioannis, and George Serafeim. “The consequences of mandatory corporate
sustainability reporting.” Working paper 11-100. Harvard Business School, 2011. Online
at: www.hbs.edu/research/pdf/11-100.pdf
15
16. Effective Auditing for Corporates
Websites:
Carbon Disclosure Project (CDP): www.cdproject.net
Climate Disclosure Standards Board (CDSB): www.cdsb.net
CorporateRegister database: www.corporateregister.com
European Federation of Financial Analyst Societies (EFFAS): www.effas.net
Global Reporting Initiative (GRI): www.globalreporting.org
Impact Reporting and Investment Standards (IRIS): iris.thegiin.org
International Integrated Reporting Committee (IIRC): www.theiirc.org
Notes
1. South African Institute of Chartered Accountants. “An integrated report is a new requirement for listed companies.” Press
release. June 4, 2010. Online at: tinyurl.com/8845pl9
2. For a more complete discussion of the benefits to companies of integrated reporting, see Eccles and Krzus (2010), and
Eccles and Armbrester (2011).
3. GRI reports list: tinyurl.com/7jmt2yw
4. Terminology regarding the reporting of nonfinancial information is inconsistent and confusing. Some people use the
terms “corporate social responsibility” (CSR) and “sustainability” interchangeably, whereas for others they mean different
things. Each term also has different meanings. For some companies, their CSR report is about philanthropic contributions
and community activities. For others, it is about their ESG performance more broadly. Similarly, for some companies their
sustainability report is solely about carbon emissions and other environmental concerns, while for others it is about ESG
performance more broadly. We will use the term “sustainability report” to refer to the entire range of ESG performance
information. For a discussion of the origins of the concepts of corporate social responsibility and sustainability see chapter 5
in Eccles and Krzus (2010).
5. CorporateRegister.com (see www.corporateregister.com/about.html). The database is available on a subscription-only basis.
6. GRI, op. cit. 3.
7. CorporateRegister.com, op. cit. 5.
8. Public Company Accounting Oversight Board. “Auditing standard no. 5: An audit of internal control over financial reporting
that is integrated with an audit of financial statements.” Online at: tinyurl.com/ye5sprj; para. 6–7.
9. The Sarbanes–Oxley Act of 2002, Section 2, Definitions (2), defines an “audit” as “an examination of the financial
statements of any issuer [a publicly traded or listed company] by an independent public accounting firm in accordance with
the rules of the Board [Public Company Accounting Oversight Board] or the Commission [the US Securities and Exchange
Commission]…”
10. International Auditing and Assurance Standards Board. “International standard on auditing 200: Overall objectives of the
independent auditor and the conduct of an audit in accordance with international standards on auditing.” Online at:
tinyurl.com/6oyvbat [PDF].
11. The International Federation of Accountants develops international standards on ethics, auditing and assurance, education,
and public sector accounting standards through its independent standard-setting boards, which include the International
Auditing and Assurance Standards Board. See web.ifac.org/download/Facts_About_IFAC.pdf
12. See tinyurl.com/75eoxuw
13. See www.theiirc.org/the-iirc
14. See www.theiirc.org/about
15. See www.theiirc.org/the-iirc
16. Deloitte. “Integrated reporting: Is your message lost in regulation?” 2011. Online at: tinyurl.com/7vdphmt [PDF].
17. Ernst & Young. “Integrated report: Content outline.” 2011. Online at: tinyurl.com/6wdssod [PDF].
18. KPMG. “Integrated reporting: Closing the loop of strategy.” 2010. Online at: tinyurl.com/6m8swmq [PDF].
19. PricewaterhouseCoopers. “Insight or fatigue? FTSE 350 reporting.” 2010. Online at: www.pwcwebcast.co.uk/cr_ftse350.pdf
20. The ACCA event can be accessed at tinyurl.com/6we2ndm
21. Eccles, Ioannou, and Serafeim (2011).
22. Ioannou and Serafeim (2011).
23. International Integrated Reporting Committee. “Towards integrated reporting: Communicating value in the 21st century.”
September 12, 2011. Online at: tinyurl.com/6k4y8w4; p. 3.
24. For discussions of the role of the Internet in integrated reporting, see chapter 7, “The Internet and integrated reporting,” in
Eccles and Krzus (2010), and Eccles and Armbrester (2011).
16
17. Integrated Reporting Requires Integrated Assurance
25. See tinyurl.com/88w5tvv [PDF].
26. Philips Annual Report 2010: www.annualreport2010.philips.com/downloads/. See Section 14.5, page 206, for the
KPMG independent auditor’s report on the 2010 Philips financial statements, and Section 15.7, page 221, for the KPMG
independent assurance report on the 2010 Philips sustainability statements.
27. Novo Nordisk Annual Report 2010: tinyurl.com/87vmptm. See page 110 for the PricewaterhouseCoopers independent
auditor’s report on the 2010 Novo Nordisk financial statements and page 111 for the PricewaterhouseCoopers independent
assurance report on the 2010 Novo Nordisk nonfinancial information.
28. KPMG. “KPMG international survey of corporate responsibility reporting 2011.” November 2011. Online at:
tinyurl.com/7z46ne8 [PDF].
29. Deloitte IAS Plus. “Summaries of international financial reporting standards … Conceptual framework for financial
reporting 2010.” September 2010. Online at: www.iasplus.com/standard/framewk.htm. Note: International Financial
Reporting Standards are only available through a subscription service.
30. Financial Accounting Standards Board. “Statement of financial accounting concepts no. 8: Conceptual framework for
financial reporting.” September 2010. Online at: tinyurl.com/86c5dr9; para. QC11.
31. TSC Industries v. Northway, Inc., 426 U.S. 438, 449 (1976). See also Basic, Inc. v. Levinson, 485 U.S. 224 (1988).
32. International Auditing and Assurance Standards Board. “International standard on auditing 320: Materiality in planning and
performing an audit.” Online at: tinyurl.com/7mekuor [PDF]; para. 4.
33. TSC v. Northway, op. cit. 29.
34. Public Company Accounting Oversight Board. “AT section 101: Attest engagements.” Online at:
pcaobus.org/Standards/Attestation/Pages/AT101.aspx; para. 67.
35. International Auditing and Assurance Standards Board. “International standard on assurance engagements 3000: Assurance
engagements other than audits or reviews of historical financial information.” Online at: tinyurl.com/7h2fez7 [PDF]; para. 23.
36. CorporateRegister.com, op. cit. 5.
37. Banco Bradesco. “2009 sustainability report.” Online at: tinyurl.com/75yj2ug [PDF]; p. 65. Bradesco is one of Brazil’s largest
private banks (not controlled by government) in terms of total assets.
38. BASF is the world’s leading chemical company. BASF employed about 110,000 people and had approximately 385
production sites worldwide. See tinyurl.com/7xd3s3q
39. L’Oréal is the world’s leading cosmetics group. Based in France, the company employed 66,600 people in 130 countries. See
tinyurl.com/8ydjhtp
40. Petrobras was a publicly traded corporation and its the majority stockholder was the government of Brazil. It ranked as the
third-largest energy company in the world with a presence in 28 countries. See tinyurl.com/7clh779
41. SolarWorld was one of the world’s largest solar energy businesses with more than 3,600 employees at production facilities
in Germany and the United States. See tinyurl.com/7qlc8dp
42. State Street Corporation was founded in 1972. The company was a global leader in financial services and provided a wide
range of products and services for large pools of investment assets. See tinyurl.com/75ga2tb [PDF]; p. 5.
43. Climate Disclosure Standards Board. “Climate change reporting framework.” Edition 1.0. September 2010.
44. Society of Investment Professionals in Germany. “KPIs for ESG: A guideline for the integration of ESG into financial analysis
and corporate valuation.” Version 3.0. 2010. Online at: tinyurl.com/6z2msgz [PDF].
45. GRI G4 developments: tinyurl.com/bvf7rsp
46. GRI G4 first public comment period—survey: tinyurl.com/5t6gmyo
47. International Organization for Standardization. “ISO 14000 essentials.” Online at: www.iso.org/iso/iso_14000_essentials
48. International Organization for Standardization. “ISO 2600 social responsibility.” Online at:
www.iso.org/iso/social_responsibility
49. Impact Reporting and Investment Standards. “IRIS standards.” Online at: iris.thegiin.org/iris-standards
50. Organisation for Economic Co-operation and Development. “Guidelines for reporting by multinational enterprises.” 2008.
Online at: www.oecd.org/dataoecd/56/36/1922428.pdf
51. United Nations Conference on Trade and Development. “Guidance on corporate responsibility indicators in annual reports.”
2008. Online at: www.unctad.org/en/docs/iteteb20076_en.pdf
52. Center for Audit Quality. “In-depth guide to public company auditing: The financial statement audit.” May 2011. Online at:
tinyurl.com/6lunkeu [PDF].
53. Financial Reporting Council. “True and fair.” July 2011. Online at: tinyurl.com/75trdvx [PDF]. Also: Moore, Martin. “The
true and fair requirement revisited: Opinion.” April 21, 2008. Online at: tinyurl.com/5qpfen [PDF].
54. Public Company Accounting Oversight Board. “AU section 411: The meaning of present fairly in conformity with generally
accepted accounting principles.” Online at: pcaobus.org/Standards/Auditing/Pages/AU411.aspx
55. Advisory Committee on the Auditing Profession. “Final report.” October 6, 2008. Online at: tinyurl.com/6myfvw5 [PDF].
56. International Auditing and Assurance Standards Board. “International standard on auditing 620: Using the work of a
auditor’s expert.” Online at: tinyurl.com/7fqgrto [PDF].
57. Public Company Accounting Oversight Board. “AU section 336: Using the work of a specialist.” Online at:
pcaobus.org/Standards/Auditing/Pages/AU336.aspx
58. Advisory Committee on the Auditing Profession, op. cit. 55, section V, pp. 5–6.
17