It does not require many words to speak the truth
If your organisation either already reports or intends to produce a sustainability report, you will need to be thinking about independent assurance – formal or informal input designed to provide an independent view of the effectiveness, thoroughness and relevance of your sustainability approach.
This post follows on from our insights into the fundmentals of sustainability reporting.
What is assurance?
Assurance is the process by which readers of sustainability or CSR reports and information (commonly referred to as “non-financial information”) can have confidence that what they are reading is “true”.
This post contains advice and guidance for organisations new to the world of independent assurance or for those already commissioning such activities who wish to gain more, in terms of both sustainability and business value, from the process.
When I refer to “assurance” I am referring to “independent assurance” rather than assurance conducted by internal audit or other in-company parties.
The aim of any sustainability assurance process is to reassure internal and external stakeholders that the sustainability information provided by organisations is credible. A high quality assurance process should also act as a driver for performance improvement. There has been much debate on whether assurance processes are successful in achieving these aims.
As a judge for sustainability reporting awards, I have tended to believe that a report without an independent assurance statement is not worth the paper that it is printed on. However, it is also possible to have an independent statement which tells the reader so little that it is almost equally worthless!
It is difficult to draw black and white distinctions. Nevertheless a well specified, in-depth, independent assurance process and statement can be a fantastically meaningful, useful and essential part of delivering transparency and accountability and sustainable performance improvement.
What constitutes an assurance statement?
In CSR and sustainability reporting, an “assurance statement” is a blanket term that is used to refer to a number of review, perspective or audit pieces that are commissioned by a reporting company in order to gain insight and to demonstrate the veracity or truth of sustainability management or reporting disclosures.
There are three broad categories for such statements:
- Formal Assurance Statements (e.g. those based upon a specific Assurance methodology – AA 1000AS, ISAE 3000, and the Dutch Standard 3410N.
- Verification statements from accredited bodies which verify against a specific standard (e.g. ISO14001, EMAS).
- Perspective and commentary pieces – a wider category of statements which do neither of the above but which are intended to lend some credibility, weight or reliability to the contents of a report. These might be produced by recognised authorities (or personalities) in sustainability and CSR, NGOs, stakeholder panels or other parties intended to lend weight, gravitas or critical perspective on the work of the reporting organisation.
For a reader of a report – the purpose of any sort of statement is to allow them to have confidence that the contents of the report bear some resemblance to the “truth” of actual company commitment, practice and performance.
Given this, it is most likely that those assurance statements which either follow a clear third party methodology or disclose the methods by which the statement was derived are those likely to be able to create the most trust.
For a reporting organisation, the purpose of an assurance statement is twofold: to allow readers to trust the report contents but also (and this aspect is often overlooked or avoided) to gain insight and understanding from a third party of the strengths and weaknesses of their reporting approach.
Scope and depth
Assurance statements can vary in depth and extent of scrutiny, depending upon the Standard that is being used to conduct the assurance process. For assurance engagements conducted according to Accountability’s AA1000 AS, there is a requirement to “cover the full range of organisational performance”. For those conducted following ISAE 3000 it is possible for assurance to be conducted at either “limited” or “reasonable” levels. These levels refer both to the depth of and scope of activities undertaken to produce the statement, but also determine the type of conclusions made by the assurer.
For “limited” engagements, this conclusion is likely to be a fairly impenetrable, double negative based statement such as “there was nothing which came to our attention which indicated that the statements in this report are not a true and fair picture of…”.
For “reasonable” engagements, the conclusion is a little more meaningful, and will be of the form that “the statements in this report present a true and fair view”.
Using assurance to drive continuous improvement
However, if the purpose of obtaining assurance goes beyond a pretty bland statement from a third party that the contents of a report are not outright untruths then a reporting company should seek to drive value through the process and perhaps engage in a more developmental process.
Such a process can be delivered through specifying the use of AA 1000AS guided statements. These are more detailed, deep and, to a reader such as me, meaningful. They often contain specific recommendations for the development of the reporting company’s approach to managing and disclosing sustainability performance. The best statements may also contain year-on-year commentary which can be a useful way of assessing and disclosing progress in the maturity and embedding of sustainability management.
Type of assurance provider, qualifications and independence
There is a wide range of companies that have moved into the market of providing assurance statements, especially as assurance has moved from being the provision of formal verification statements. Such assurance providers include professional services firms, sustainability and CSR consultancies, specialist auditors and verifiers and specialist non-financial assurance firms.
Because there is such a wide range of companies earning income from providing such statements, it can be difficult for a reader to tell whether any of them is suitably skilled and equipped to provide such statements, therefore it is difficult to know whether the reader should trust all such statements or none of them.
There is, however, guidance on the levels and types of expertise required for the provision of assurance statements, for ISAE3000 and COS 3410N, this is provided by IFAC, for AA1000AS, Accountability has a Certified Sustainability Assurance Practitioner qualification.
Must an assurance provider always be “independent”?
In some cases, the provider of an assurance statement to a company is also the provider of advice and support to that company. Under such circumstances the relationship between the statement provider and the reporting company should be clearly and publicly disclosed.
Judging and specifying a good quality assurance statement – 5 key questions
The following guidance questions are drawn from my experience as a reporting judge and as an active participant in reporting consultancy and a number of best practice initiatives.
- Does the assurance statement cover the whole of the report?
- Does the statement refer to any standard methodology e.g. AA1000 AS, ISAE 3000 or Standard 3410N used to develop the third party statement (in my opinion AA1000 AS is perhaps the most meaningful standard)?
- How deeply did the third party organisation investigate (e.g. did they check the methodology, the figures, conduct interviews within and outside the organisation, did they use secondary data or go back to the original sources)?
- Does the statement note areas for improvement of company performance?
- Does the statement comment on previous performance and indicate key future issues for consideration?
Of course, these questions can also be used as the basis of a checklist to specify future assurance engagements.
Reporting without assurance
Though a large part of the non-financial reporting industry, external assurance remains a minority actvity within most non-financial reporting. At the recent Corporate Register Reporting Awards CRRA13 it was highlighted by Wayne Fletcher of ERMCVS that only 20-25% of reports have assurance.
In addition, and beyond the “Assurance Statement” industry, we are starting to see some company reports without a formal statement but have started to take us towards a “comply or explain” approach – for instance the recent CRRA13 overall report winner Nike – see page 83 of Nike’s Sustainable Business Report.
Without a clear perspective and intention for assurance to provide developmental insights to the company and trust to the stakeholder, assurance can too easily become all about (minimal) process and not about utility or outcomes.
Creativity and innovation is undoubtedly required but it will be essential to maintain a focus upon the ultimate purpose of assurance – it is a mechanism for trust and truth. If it becomes a mechanism for box ticking than we will have lost something vital!
Want to find out more?
In addition to the advice and guidance you can receive from experts such as us, there are a number of recent publications providing an overview of sustainability assurance and its use in practice, see especially, this overview from ICAEW, ACCA’s briefing paper and Corporate Register’s AssureView.
This post was updated in June 2013.