The Center for Audit Quality (CAQ) has published S&P 500 and ESG Reporting, a study of S&P 500 company environmental, social, and governance (ESG) disclosures. The CAQ found that 95 percent of S&P 500 companies publicly disclose detailed ESG information -- primarily in a standalone ESG, sustainability, corporate responsibility, or similar report, not in an SEC filing. Most of the remaining five percent publish “high-level policy information” on their website. About six percent of the S&P 500 received assurance from a public company auditing firm with respect to some part of their ESG disclosures, while about 47 percent obtained assurance from some other type of service provider.
During the past year, the CAQ has published several papers on the auditor’s role in ESG reporting. See Want to Improve the Reliability of Your ESG Reporting? The CAQ Suggests Asking Your Auditor for Help, July-August 2020 Update and CAQ Provides Guidance on Auditor ESG Assurance, March-April 2021 Update. The new CAQ report looks broadly at the extent to which large companies are making ESG disclosures and the extent to which they are asking their auditors, or other service providers, for assurance on their ESG reporting.
Some highlights of the CAQ study include:
ESG Reporting Period: Most of the S&P 500 report ESG information annually (or disclose their intension to report annually). As of June 18, 2021, 54 percent of S&P 500 companies had published ESG data for periods ending in 2020, while 37 percent had published data for periods ending in 2019.
ESG Reporting Frameworks and Standards. The CAQ tracked references to five ESG disclosure frameworks or standards: CDP (formerly known as the Carbon Disclosure Project), the Global Reporting Initiative (GRI), the Sustainability Accounting Standards Board (SASB), the Task Force on Climate Change (TCFD) and Integrated Reporting (IR). The CAQ found that 459 of the 500 companies referenced at least one of these five reporting frameworks or standards in their disclosure, and almost 80 percent (390 companies) referenced more than one framework or standard. Ten companies referred to all five. The most frequently referenced ESG disclosure framework or standard was CDP (371 companies), followed closely by SASB (362 companies) and GRI (328 companies).
Assurance or Verification. About 52 percent of the S&P 500 (264 companies) disclosed some form of third-party assurance or verification over all or part of their ESG metrics. Thirty-one of these companies retained an audit firm to provide assurance, while 235 utilized an engineering or consulting firm. (Two companies obtained assurance from both an accounting firm and some other type of service provider.)
Scope of Assurance. The majority (123 of 229) of the ESG assurance reports issued by non-auditor service providers covered only greenhouse gas (GHG) emissions. In contrast, the majority (22 of 31) of the reports issued by public company auditors covered metrics other than, or in addition to, GHG. Only 10 percent of assurance or verification reports from non-auditors covered multiple areas.
Assurance Standards. Of the 31 assurance reports issued on ESG disclosures by audit firms, 27 of the engagements were performed based on the attestation standards of the American Institute of Certified Public Accountants, and four were performed under the International Standard on Assurance Engagements. One engagement referenced both sets of standards, and the standards under which one engagement was performed were not publicly disclosed. The most common assurance standard that non-auditor service providers referenced was Organization for Standardization 14064-3 Green-house gases -- Part 3: Specification with guidance for the verification and validation of greenhouse gas statements (ISO 14064-3).
Level of Assurance. Of the 31 companies that obtained ESG assurance from public company auditors, 25 obtained limited levels of assurance over select information. Three companies obtained limited assurance over some metrics and reasonable assurance over other metrics. Two companies obtained reasonable assurance as to all metrics that were reviewed. In one case, the level of assurance could not be determined from the company’s disclosure. The great majority of reports issued by non-auditors provided limited assurance, although some used the terms “reasonable” or “moderate” or a mix of assurance levels.
The CAQ separately analyzed S&P 100 ESG disclosures. Among other things, the CAQ found that 82 percent of S&P 100 companies received some third-party assurance or verification over their ESG disclosures, compared to only 46 percent of the remaining S&P 500 companies. Further, 13 percent of the S&P 100 obtained such assurance from a public company auditor, as compared to less than five percent of the other 400 companies. The CAQ study shows that the SASB standards are rapidly gaining in popularity among the largest companies. Between March 12 and June 18, 2021, SASB overtook GRI as the second most referenced disclosure framework (apparently, after CDP) among the S&P 100.
Comment: The CAQ’s findings are broadly consistent with those of the Governance & Accountability Institute regarding the rapid growth of large and mid-sized U.S. public company ESG disclosure. See G&A Finds That Ninety Percent of the S&P 500 Publish a Sustainability Report, July-August 2020 Update and With Sustainability Reporting on the March, Protiviti Has Ten Questions Directors Should Ask, October-November 2020 Update. One of the themes of the Update has been that audit committees need to be aware of this ESG disclosure revolution. Sustainability disclosures are increasingly relied upon in investor decision-making and recognized as material for purposes of the federal securities laws. However, ESG disclosures are often not subject to the same controls and procedures as apply to traditional financial disclosures. This creates risks that the sustainability report may be inconsistent with other company disclosures or that the accuracy of the information presented may not be verifiable. These risks should be of concern to audit committees because of their responsibility for disclosure oversight and for related controls and procedures.
Auditor (or other third-party) assurance with respect to ESG disclosure can be an important tool in promoting confidence in ESG reporting. The CAQ report make clear that assurance is becoming more common and -- indeed might be viewed as the norm among the largest companies. Managements and audit committees that are not already doing so should give serious consideration to obtaining assurance over disclosures that include ESG metrics. In its publications, the CAQ makes a strong case for retaining the financial statement auditor to provide this assurance. Audit committees considering whether to retain their auditor or another type of professional to provide ESG assurance need to weigh a variety of factors, including each candidate’s reputation, independence, relevant expertise, and familiarity with the company and its systems. The professional standards an assurance provider applies are also a key factor.
Comments