Harnessing internal audit against climate change risk

Harnessing internal audit against climate change risk: A guide for audit committees and directors

October 2021

2

Harnessing internal audit against climate change risk: A guide for audit committees and directors

Introduction Climate change is arguably the most acute challenge facing our planet right now and is an issue that is firmly moving up the agenda. It is one that organisations simply cannot afford to ignore or sideline any longer, for those that do not take action face the genuine risk of an existential crisis.

Internal audit has a responsibility – and a great opportunity – to add true value to the work of organisations on climate risk from two perspectives.

Firstly, to act as a trusted advisor to the organisation in terms of how it is identifying, managing and mitigating the risks and opportunities associated with climate change. Secondly, to comment on and assess the measures that the organisation puts in place to reduce its environmental impact and contribution to climate change.

But the responsibility to rise to these challenges does not rest solely on the shoulders of internal audit. It is time that audit committees and directors look at their organisation and ask themselves whether they are fully prepared for climate change. What more can internal audit do in this space?

Our aim for this guide is twofold, and we take a two-pronged approach.

1. Firstly, we want senior leaders to make demands of and fully harness their internal audit teams in respect of climate change preparedness. To start the conversations and begin the work.

2. Secondly, we want to encourage internal audit professionals to be leaders in this space, stepping up to show their value and worth to the organisations they serve. Of those organisations who have not yet begun their journey towards fully auditing climate change risk, most already know that something must be done.

We know from our yearly Risk in Focus research that the risks around climate change and environmental sustainability are of rising concern to organisations across Europe1. In 2020, we carried out focused research on organisations’ preparedness for climate change2, which indicated that although the potential seriousness of the risk was recognised by many, very few were actively focusing on climate change risks.

1 2

Changes within the profession are happening fast and we know that, since then, internal audit teams are increasingly being harnessed to provide assurance in this area.

But there is still a lot of work to do. Given the level of risk associated with climate change, we need to see internal audit stepping up, taking the initiative and leading the way.

As a profession, internal audit cannot afford to be complacent. And neither can the Chartered IIA. It is part of our role and the purpose of this guide to actively engage with and encourage our members to address the demands of an increasingly globalised and interconnected world in which complex and multifaceted risks and uncertainties come with the territory. Climate change is no greater example of this.

The COP26 conference in Glasgow presented an opportunity to look again at whether we could provide further support in this area. There has never been a better time for Boards, and in particular audit committees, to start having conversations with their internal audit teams about the work they are doing on climate change. We urge directors to work in partnership and collaborate with their internal audit functions to ensure they are fully rising to the challenges associated with climate change.

To produce this guide, we held meetings with professionals and experts who we felt could shed light on this topic. We held two advisory panel sessions in July 2021, speaking to Chief Audit Executives (CAEs), audit committee chairs, professionals and academics with a background in climate change risk and audit. The quotes used throughout this guide are taken from those meetings and other discussions around climate change.

John Wood | Chief Executive Chartered Institute of Internal Auditors

Chartered IIA, Risk in Focus 2022 Chartered IIA, Organisations’ preparedness for climate change: an internal audit perspective

3

Harnessing internal audit against climate change risk: A guide for audit committees and directors

Why should climate change matter to Boards?

It is now accepted that we are seeing the impact of climate change today, and that this impact will continue to increase. Extreme weather events of rising severity are becoming the norm, including in the UK and Ireland. The World Economic Forum’s Global Risk Report 2021 is striking and clear in its recognition of climate change risk, noting that, “among the highest likelihood risks of the next ten years are extreme weather, climate action failure and human-led environmental damage […] in the five-to-ten-year horizon, environmental risks such as biodiversity loss, natural resource crises and climate action failure dominate.” 3 As well as the need to prepare for the physical impacts of climate change, Boards must help their organisations adapt to the requirements of new national and international laws and regulations that will embed sustainability in products and services.

Changing standards, laws, regulations & expectations As well as new laws and regulations, new standards will also emerge, and many have already begun to aid organisations’ transition to net zero. The British Standards Institution’s (BSI) main aim is to help improve the quality and safety of products, services and systems by enabling the creation of standards and encouraging their use. Whether making a product, managing a process, delivering a service or supplying materials – standards can cover a huge range of activities undertaken by organisations.

BSI is our partner for this guide. In September 2021, BSI announced a commitment to ensure that global standards will “support climate action and advance international initiatives” to achieve global climate goals4. Signatories of the London Declaration5 (also

3 4 5

called ‘the ISO’s Climate Commitment’) will embed key climate considerations into every new standard that is created. This also requires retrospectively adding these requirements to all existing standards as they are revised.

Internal audit is well placed to provide assurance that the organisation is responding to changing standards in a timely and appropriate manner by designing and implementing revised policies and procedures. Where relevant, also assessing the impacts of the changing standards on the viability of products and services or creating new business opportunities.

In all cases of new and revised laws, regulations and standards, the organisation has the responsibility to define and implement a response which is compliant.

Internal audit has a role to provide assurance that the changing expectations are being identified and assessed early; that revised policies and procedures meet the new requirements and that when implemented, they are working effectively.

Nearly all changes in regulations result in increased cost to organisations. In some cases, changes may also impact the business more significantly. For example, forcing a change in a product, service or pricing could massively reduce its value to the organisation. So, internal audit also needs to look at this angle and assess the extent to which it has been considered and actioned by the organisation.

Lastly, a further dimension is that regulatory changes may actually create opportunities. For example, an increased expectation for sourcing locally as a result of changing regulations may place the organisation in a better position for local markets. Internal audit has a role to understand all dimensions and can provide assurance in each instance if required.

World Economic Forum, Global Risks Report 2021 British Standards Institution (BSI), International commitment pledges to accelerate transition to net zero International Organization for Standardization (ISO), London Declaration: ISO commits to climate agenda

4

Harnessing internal audit against climate change risk: A guide for audit committees and directors

The political context

Green investments and opportunities

It is now a stated aim of the UK Government to assess, report and reduce the impacts of climate change risk.

In November 2020, the UK’s Chancellor, Rishi Sunak MP, announced that large companies and financial institutions in the UK would have to “come clean” about their exposure to climate risks within five years under the terms of a “tougher regime”. As a result, the UK Government now plans on introducing a regime of mandatory climate-related financial disclosures that align with those within the Task Force for Climate-related Financial Disclosures (the TCFD). These measures will affect publicly quoted companies, large private companies and Limited Liability Partnerships (LLPs), coming into effect in April 2022.

Legal and regulatory changes and new reporting requirements are happening against a backdrop of changing societal expectations that affect investors’ decisions. There is increasing societal recognition that organisations should fulfil environmental and social obligations or be held to account for their actions.

Changing laws, regulations and standards will affect the public, private and third sectors in the UK & Ireland.

For example, in the Republic of Ireland, the Climate Action Plan provides specific actions that government departments and public bodies will take “to reduce greenhouse gases and tackle the climate crisis”.6 Similar measures are emanating from Brussels.

The European Green Deal7 is now a fundamental component of all the regulatory requirements that the European Commission is developing. The Corporate Sustainability Reporting Directive (CSRD) aims to make sustainability reporting more consistent, so that investors and the public can use comparable and reliable information and significantly enlarges the scope of the current reporting requirements.8

Former Bank of England Governor, Mark Carney, is the UN Special Envoy on Climate Action and Finance.

Whilst making clear the detrimental impacts of climate change, his work for the UN also involves promoting smarter green investment in sustainable energy and infrastructure, and he refers to “an enormous investment opportunity.”9 Companies that are making meaningful adaptations to their processes and business models in order to reduce the negative impacts on the planet are essentially the companies which are increasingly attractive to investors. This was made explicitly clear when Larry Fink, the Chairman of the world’s largest investment firm, BlackRock, said to CEOs that “we know that climate risk is investment risk. But we also believe the climate transition presents a historic investment opportunity.”10 Of those organisations listed on the stock exchange and those seeking investment, it is now accepted that so-called ‘green’ companies do better, financially, than their competitors.

“We’re trying to educate and analyse risks at the enterprise level, and we find that climate change risks can erode highly material sums off the entire value of a business over the near-term; typically between 5% to 10% of company earnings” Oliver Carpenter, Lead, Climate Risk Research, Cambridge Centre for Risk Studies

6 7 8

Department of the Taoiseach, Climate Action: What the Government is Doing European Commission, the European Green Deal Deloitte, New EU Corporate Sustainability Reporting Directive: Sustainability Reporting to the next level

9 10

BBC News, Mark Carney: Climate crisis deaths ‘will be worse than Covid’, BBC News, 05 February 2021 BlackRock, Larry Fink’s 2021 letter to CEOs

5

Harnessing internal audit against climate change risk: A guide for audit committees and directors

“Organisations are all very different and the climate-change impacts, in terms of both financial and nonfinancial effects, are going to vary massively from organisation to organisation. Also, we mustn’t focus only on FTSE 100s. We need to look across sectors, at public sector, quasi-public sector, third sector, SMEs. We’ve got to try and take all organisations with us and remember they’re all different with different motivations.”

Kevin Gould, Audit Committee Chair, Assurance consultant & climate change expert

It is important to remember that internal audit functions are equally well-suited to look at the potential climate-related opportunities (whether through investments, services, or products) as well as the associated risks.

6

Harnessing internal audit against climate change risk: A guide for audit committees and directors

Internal audit’s role Board and Executive, Strategy vs Actions Audit committee chairs, board members and senior leaders aren’t always using their internal audit functions to their full advantage even though it is potentially one of the most powerful tools that they have at their disposal - providing independent, objective assurance over how well an organisation is managing climate-related risks, taking advantage of fast-paced opportunities and whether its governance processes are operating effectively.

Internal audit’s ideal position within the structure of an organisation is outlined in the Three Lines Model,11 rightly presenting it as the third line of defence.

This model also highlights internal audit’s role in communicating, collaborating and aligning with the first and second lines, and reiterates that its position should allow assurance to be given directly and independently to the Board.

From this position rests one of the key strengths of internal audit. It has a wide remit, allowing a ‘helicopter view’ of the organisation in which it operates and a direct link to the Board. Modern internal audit activities are required to understand the overarching strategy and direction of an organisation, as well as its composite parts.

Its view of the organisation, alongside the direct link with leadership, puts internal audit in a pivotal position to ensure that climate-related risks and opportunities inform the wider organisational strategy.

11

Global IIA, The Three Lines Model

“If you’re an internal auditor you’re looking at all the business processes, all the operations of an organisation.

If climate is a key factor in decisions and strategies, internal audit have every right to review how the organisation is looking at the risks around compliance with climate change targets and advise the organisation. Internal audit, as a trusted partner, whether it be private or public sector, whether financial or manufacturing, should advise on how we can best keep our organisations on a straight line towards compliance.”

Dermot Byrne, Head of Internal Audit and EU Audit, Ministry of Public Expenditure and Reform (Rep. of Ireland) The working relationship between internal audit and the audit committee, its chair, and the wider Board is an essential one in terms of the governance of the organisation.

7

Harnessing internal audit against climate change risk: A guide for audit committees and directors

“Have a voice. As an audit committee chair, I interface with my internal auditors frequently. I get a formal report every 3 to 4 weeks…but what I really want to know is ‘what do they think?’. A flat report is interesting, it’s useful, it serves its purpose. But if you let me know what you think, we can address things in many different ways.

Sometimes, more efficiently than waiting for the formal report to come out. So, I think that link between the audit committee chair and the chief internal auditor is key – very, very key.”

John Devine, Chair of Credit Suisse International, Audit Committee Chair of Abrdn PLC This means that in a reasonably healthy organisation with a good working culture and functioning system of governance and leadership, internal audit should have the confidence to challenge, to act as a critical friend and speak truth to power. This ability to initiate constructive dialogue is an essential foundation of a good working relationship between internal audit, Boards and audit committees. It should work in both directions.

If concerned that their organisation is not doing enough to address climate change risk, internal auditors should have the confidence to approach the Board and raise this as an issue deserving of attention. Similarly, as experienced leaders in their fields, board members must feel empowered to use their leadership position to steer and direct their internal audit activity.

Auditing climate-related commitments, plans and actions On climate change specifically, action around carbon neutrality and net zero are a good step for organisations to lessen their impact as active 12 13 14

generators of climate change via the emissions they produce. It is natural that these organisations wish to publicise their actions and intentions. Pledges around net zero and carbon neutrality are common.

A study by the Energy & Climate Intelligence Unit and Oxford Net Zero estimated that 417 of the world’s largest 2000 companies have made net zero commitments.12 But smaller businesses, charities, public sector entities and a whole range of other organisations can be seen making some sort of public commitment on carbon neutrality and net zero. The UN’s Race to Zero Campaign13 is there to facilitate such actions.

When organisations do decide to take action (e.g. through reducing emissions) internal audit can ensure that it provides assurance over the completeness and accuracy of data on these targets and actions, and over the processes and controls used to source, compile and report information.

“Often limited or no external assurance is in place. Internal audit has a real opportunity to provide assurance about both the target-setting, and the processes to manage and report on progress towards meeting those targets.

Early involvement is key; once commitments are made by an organisation, they are difficult to unmake if they can’t be delivered!”

14

Kevin Gould, Kevin Gould, Audit Committee Chair, Assurance consultant & climate change expert Internal audit is well-placed to ensure risks are understood and managed and that the associated opportunities are realised. And there is a wealth of further guidance and technical material to assist internal audit teams to make a start in addressing these topics if they haven’t already done so – especially around reporting climate-related financial data.

University of Oxford / Energy & Climate Intelligence Unit, Taking Stick: A global assessment of net zero targets UNCC, Race To Zero Campaign Chartered IIA, Net zero commitments - role of internal audit, by Kevin Gould

8

Harnessing internal audit against climate change risk: A guide for audit committees and directors

Climate-related stress-testing and scenario analysis Scenario analysis and testing should form part of organisations’ annual reports and accounts. These are methods used to appropriately incorporate the potential effects of climate change into planning processes - and also an area where internal audit can play a valuable role. In the UK, Ireland and the EU, the financial services sectors are amongst the most highly regulated and in which there are strong examples of internal audit teams carrying out essential work to prepare for future climate-related economic shocks.

Stress testing is also something that regulators are increasingly expecting to see. Internal audit is able to support stress testing across many sectors.

The Bank of England runs regular stress tests to help assess the resilience of the UK financial system and individual institutions, such as the Biannual Exploratory Scenario15 to assess systemic risks of climate change on financial services firms’ longterm financial risks and business model risks. This enables them to consider how their climate-related risks and opportunities may evolve and the potential implications under different conditions.

NatWest used its internal audit team to support its involvement with the Bank of England’s climaterelated stress tests in 2021. The internal audit function reviewed the processes and controls around the stress tests, including areas such as data quality, assumptions, modelling approaches and results aggregation. The internal audit team had carried out audits of many economic stress tests in recent years, yet recognised that climate-related stress testing was made more complicated due to the stress scenario horizon being 30 years rather than the usual 5 years expected for economic stress testing.16

The Task Force on Climate-related Financial Disclosures (TCFD) The TCFD is one of several frameworks that can be used by organisations to provide climate-related financial information. Others include the Carbon Disclosure Project Framework18 and the Global Reporting Initiative Standards (GRI).19 The TCFD’s aim is to improve and increase reporting of climate-related financial information. The Chartered IIA is supportive of the UK government’s proposals to make climate-related financial disclosures mandatory for publicly quoted companies, large private companies and LLPs20 . In fact, for many organisations, the TCFD provides a helpful framework that we believe should be more frequently used to report climaterelated financial information – regardless of whether this is mandatory for an organisation.

As the adoption of the TCFD framework is rolled out for increasing numbers of organisations, Boards have the opportunity to use internal audit in advance, to make preparations rather than react too late. Internal audit functions should be aware of these requirements and ask the Board and senior management how they are preparing to meet them.

To assist organisations with stress testing and scenario analysis, the TCFD has produced a technical supplement on the use of scenario analysis in disclosure of climate-related risks and opportunities.17

15 16 17

Bank of England, Key elements of the 2021 Biennial Exploratory Scenario: Financial risks from climate change Chartered IIA, Organisations’ preparedness for climate change: an internal audit perspective TCFD, Technical Supplement: The Use of Scenario Analysis in Disclosure of Climate-Related Risks and Opportunities

18 19 20

Climate Disclosure Project Global Reporting Initiative, Get started with reporting Chartered IIA, Mandatory climate-related financial disclosures by publicly quoted companies, large private companies and LLPs

9

Harnessing internal audit against climate change risk: A guide for audit committees and directors

Harnessing internal audit What is holding the internal audit team back from auditing climate change risks and associated opportunities?

Audit and risk committee chairs, board members and senior leaders aren’t always using their internal audit functions to their full advantage in providing independent assurance over how well an organisation is identifying, managing and mitigating climate-related risks, taking advantage of fast-paced opportunities and whether its governance processes are operating effectively.

Boards should begin by asking internal audit to undertake a climate risk audit engagement. Ask internal audit to identify what the following items say on climate change: the mission and purpose of the organisation; its long-term strategy; its organisational and governance policies; its declarations to its stakeholders (be they shareholders, customers, service users or staff); and the information associated with all non-financial and financial reporting. But rather than a simple information-gathering exercise (which could be done by the second line), interviews with executive management could also be carried out in the aim of producing a more thorough report and independent recommendations directly to the Board.

If it then transpires that climate change risks have not been properly documented and assessed, putting climate change risk (or, elements of it – depending on the specific needs of the organisation) on the internal audit plan for the foreseeable future would be the appropriate next step. Once climate change is on the risk register, internal audit should begin developing a risk-based plan as a stand-alone audit.

Skills and training, knowledge and resources It is the Board’s responsibility to ensure that its internal audit activity has the right combination of resources, skills and training to address climate change risk.

Guidance on effective internal audit in the private and third sectors’, recommendations 28, 29 and 30 make clear that ‘the chief internal auditor should ensure that the audit team has the skills and experience, including technical subject matter expertise, commensurate with the scale of operations and risks of the organisation. This may entail training, recruitment, secondment from other parts of the organisation or co-sourcing with external third parties.”21 The need for internal audit to have skills and training in this space will only increase over time.

There is also a wealth of freely available material published by organisations such as professional services and accountancy firms. The National Audit Office (NAO) have also produced material on climate change risk for audit committees.22 There is little excuse not to take these resources and put them to use.

Co-sourcing and a science-led approach The Chartered IIA’s Code of Ethics makes clear that internal audit should engage “only in those services for which they have the necessary knowledge, skills and experience”.23 It is helpful for internal auditors themselves to have a level of knowledge and expertise in the subject area that they’re auditing, but an audit of climate change risk may need to be largely science-led.

It is likely that internal audit will need to look into co-sourcing arrangements to cover gaps in areas of expertise. Collaboration with other internal audit activities in the same sector or working with an inhouse guest auditor are other possibilities.

Collaborating with specialists and consultants with scientific expertise on climate change will help internal audit to understand not only the raw data, but also guide them in practical areas of their work such as understanding how to define their priorities and what those priorities should be.

In the Chartered IIA’s ‘Internal Audit Code of Practice:

21 22 23

Chartered IIA, Internal Audit Code of Practice Guidance on effective internal audit in the private and third sectors National Audit Office (NAO), Climate change risk: A good practice guide for Audit and Risk Assurance Committees Chartered IIA, Code of Ethics

10

Harnessing internal audit against climate change risk: A guide for audit committees and directors

“I think internal audit have the skills to do the internal audit work but not necessarily the skills to assess the risk and work out what the right approach is. You have to co-source and get a bit of up-front advice. In terms of auditing that process, internal audit should be capable without having huge scientific knowledge and skill in that particular topic.”

Mary Hardy, Independent Director and Audit Committee Chair There might be present in an organisation the fear of being seen to lack expertise. Climate change is still seen by many as a new and emerging risk, and it is understandable that a degree of courage might be needed for anybody in a leadership position to initiate a focus on a topic that they understand relatively little about. But maintaining the status quo as opposed to identifying new challenges could make the difference between an organisation coasting along and surviving versus adapting and thriving.

“If audit committees just want to challenge internal audit to get into that space - simple statement - just go and challenge them! Demand that they get into that space. I hear people saying too often “I don’t know enough yet”. Well – when’s the right time?”

Derek Jamieson, Director - Regions, Chartered IIA

“The very welcome reality here is that directors don’t need significant expertise in climate change to bring this item to the agenda. More important is the willingness to stick one’s head above the parapet and say, “internal audit should look at this...”

Derek Jamieson, Director - Regions, Chartered IIA Boards must ensure that their internal audit teams have the resources to devote to this risk area. It is understandable that the past several years’ audit plans will have been dominated with the dual crisis of Brexit, cybersecurity and the coronavirus pandemic, resulting in immediate crisis impacts that internal audit teams have had to deal with. In the UK and Ireland, it is now time for organisations to turn their attention towards climate change and start those new conversations.

Relationships with regulators and other risk assurance professionals As well as receiving support from experts and forms of co-sourcing, the internal audit function will often already benefit from strong working relationships with other assurance providers and risk functions, as well as external audit. Section 38 of the Internal Audit Code of Practice makes clear that “the chief internal auditor and the partner responsible for external audit should ensure appropriate and regular communication and sharing of information”.24 Strong working relationships and open lines of communication with others, coupled with its unique perspective and overview of the entire organisation, make internal audit well-placed to coordinate climate-related risk and assurance activities across the organisation.

As the regulatory response to climate change develops rapidly, organisations will increasingly experience the need to review and revise products and services to meet changes in prescribed standards and to meet enhanced reporting standards.

24

Chartered IIA, Internal Audit Code of Practice: Guidance on effective internal audit in the private and third sectors

11

Harnessing internal audit against climate change risk: A guide for audit committees and directors

Internal audit’s relationship with regulators and standard-setting bodies can be critical both in helping to better understand their requirements, and in providing them with assurance over the organisation’s response to these requirements. It is therefore increasingly important that those who meet with regulators are familiar with current and emerging expectations and that they are also able to demonstrate awareness of the organisation’s response and can comment on the effectiveness of that response. Internal audit can excel here.

An increasing role for internal audit?

Audit & Assurance and Resilience Statements In the Department for Business, Energy and Industrial Strategy (BEIS) white paper, ‘Restoring trust in audit and corporate governance’25, the UK government outlined proposals to make sure that organisations develop an Audit and Assurance Policy in which they must set out where their company is getting assurance from on key non-financial risks – and climate change risk is certainly a key non-financial risk. The Audit and Assurance Policy should provide an explanation of what independent assurance, if any, the organisation intends to obtain in the next three years in relation to the annual report and other company disclosures beyond that required by statutory audit.26 Similarly, as part of its consultation, the UK Government sought views on whether an organisation’s Resilience Statement should specifically address the impact of climate change on the company’s business model and financial planning, and whether it should provide a means for companies to provide disclosures consistent with the recommendations of the Taskforce on Climate-related Financial Disclosures (TCFD).

Both the development of an Audit and Assurance Policy and the potential for Resilience Statements to address climate change are both opportunities for Boards to direct internal audit to lead in this space, and illustrate further that internal audit’s remit should increasingly encompass climate change risk.

25 26

Department for Business, Energy and Industrial Strategy (BEIS), Restoring Trust in audit and corporate governance Chartered IIA, Audit and Assurance Policy (AAP) - role of internal audit

12

Harnessing internal audit against climate change risk: A guide for audit committees and directors

Defining and breaking down climate-related risks What does climate change mean for your organisation?

Climate-related risks and opportunities can be challenging to grapple with when the effects seem fairly abstract or far off in the future. For some sectors, the risks are new and emerging and the effects wide-ranging. Essentially, climate-related risks manifest in many ways, but mostly through exacerbating existing risks.

“I think the biggest challenge is making climate change digestible as an auditable issue and something that makes sense to Boards and senior management. We all agree climate change is an issue, and a big risk. But, tangibly, what does it mean?”

Jeremy Lawson, Chief Internal Auditor, Persimmon Homes

Boards can think about their organisation’s relationship with climate change from two perspectives Firstly, organisations are affected by the impacts of climate change. Secondly, they are active generators of climate change. Internal audit functions are wellplaced to provide an independent and objective assessment of the processes management has put in place to address these two perspectives. They can look at how well organisations are working to mitigate their own contribution to climate change as well as the actions available to moderate the risks (and take advantage of the associated opportunities).

Another way to understand the risks is to place them in to two risk categories – evolution and physical.

1. Physical risk - from extreme weather events and chronic climate patterns which disrupt the availability of raw materials and energy supplies, operations, and communities at each point throughout the supply chain.

2. Evolution risk (also known as transition risk) from changing policy and legislation to achieve a low-carbon economy including such things as new technologies like blockchain, pricing of greenhouse gas emissions, changing consumer demand, value of brand equity and reputation.

“In the near-term, transition risk is going to be the driver of financial impacts. Physical risk will intensify over a longer timescale, so we can talk about flood and wildfire but actually transition risk is likely to be a much more material 3-to-5-year risk” Oliver Carpenter, Lead, Climate Risk Research, Cambridge Centre for Risk Studies Physical risks and evolution / transition risks can materialise in a variety of events, interacting with other risks and risk events. The Chartered IIA’s 2020 research, Organisations’ preparedness for climate change, found that CAEs recognised the following areas as the most likely to be affected by climate change:

13

Harnessing internal audit against climate change risk: A guide for audit committees and directors

1 Reputation Any organisation that publishes climate-related data or makes statements about their green activities and ambitions must also expect to be publicly scrutinised and held to account. Organisations of all shapes and sizes commonly issue public statements, voluntarily, about their green credentials in an effort to appear environmentally conscious. This presents a considerable risk of serious reputational damage if the statements do not hold up to scrutiny.

Reputation is certainly an area where internal audit would be able to provide an assessment as to the accuracy of the statements being provided to the media, as well as in the annual reports and accounts.

“Commitments are made in various parts of an organisation, but are they truly strategically aligned? I recently worked with one organisation which was going through the process of making a 2030 commitment. But what exactly is the commitment? It was a bit vague. Has the Board ever discussed it? How does it align with the rest of the strategy? Unless it’s strategically aligned, it is unlikely to be met, and if it’s not clearly defined it may be delivered but could be fairly meaningless.”

“So many businesses today are making so many pronouncements and commitments on a different basis across the organisation.

Kevin Gould, Audit Committee Chair, Assurance You have to have a fundamental consultant & climate change expert understanding that the information the firm is putting out there has got a solid foundation and is accurate. “We can’t say something unless we That’s the first thing.” can really support it.”

John Devine, Chair of Credit Suisse International, Audit Committee Chair of Abrdn PLC

Stephen Licence, Group Chief Internal Auditor, Legal & General

‘Greenwashing’

Annual General Meeting (AGM) or on social and traditional media.

The process of conveying a false impression or providing misleading information about how a company’s products and services are more environmentally sound than they really are – sometimes called ‘greenwashing’ – is a risk that many organisations have still not properly taken into account. There is nothing stopping climate activists and environmental campaigners from purchasing stocks and calling out an organisation’s leadership in a very public setting such as the

Different parts of organisations might also make conflicting promises that are misaligned with each other or in direct conflict with the broader organisational strategy. Boards need to be clear that misleading green statements can be exposed and there is nowhere to hide from public scrutiny – whether you’re a FTSE 100, large private company, local authority, third sector organisation or an arms-length governmental organisation.

14

Harnessing internal audit against climate change risk: A guide for audit committees and directors

2 Regulation risk and compliance Rising sustainability regulations are an evolution / transition risk associated with the move to a lower-carbon and more climate-resilient economy.

Highly-regulated sectors will be familiar with the rising tide of sustainability regulations – particularly in banking and insurance who are strictly regulated by the PRA and FCA. But these are set to increase across a broader range of organisations.

Internal audit can provide real added value here, from a compliance perspective. For less mature organisations, internal audit is well suited to identify future regulatory changes and plan how to adapt and prepare for these. There will be costs associated with implementing and adapting to incoming regulations which internal audit can provide insight, clarity, impact and support the organisation’s preparedness.

“Looking at the national implications for compliance with European and worldwide climate rules – there will be costs involved from a public sector viewpoint. If we don’t comply with targets, we’ll be paying fines.”

Dermot Byrne, Head of Internal Audit and EU Audit, Ministry of Public Expenditure and Reform (Rep. of Ireland) For larger and more mature organisations, internal audit is not usually directly responsible for compliance with laws and regulations. But it plays an important role in auditing how well the compliance functions are working and should be used to check efficacy of processes and controls that have been modified to deliver on the changing requirements of new regulations.

3 Supply chain risks Climate-related risks will have a knock-on effect on supply chains. Events related to extreme weather are already an increasing source of supply chain disruption, from smaller and more localised incidents such as flooding, tornados and droughts, to more high-profile events including hurricanes, typhoons and wildfires in Australia and California.

The impacts of climate-related supply-chain disruption might be wide-ranging.

Two-fifths of CAEs interviewed as part of Risk in Focus 2022 raised supply chain risks as a top priority.27 The accompanying survey data revealed that almost a third of CAEs across Europe consider Supply chains, outsourcing and ‘nth’ party risk within the top five risks being faced. In the UK and Ireland, the latter half of 2021 is seeing high-profile supply chain crises play out in reality.

27 28

Chartered IIA, Risk in Focus 2022 Chartered IIA, Technical guidance: Climate impact within supply chains

Internal audit should play a role in ensuring that climate risk is an intrinsic part of supply chain planning, management and resilience impacting all aspects of selection, availability, movement, and production. The Chartered IIA has published technical guidance, ‘Climate impact within supply chains’ which considers the climate related risks and controls to include in a supply chain audit.28 Depending on the type of organisation, it may be more appropriate to undertake an audit engagement that specifically looks at the management of climate risk within the supply chain that specifically takes into account governance, compliance and operational controls.

15

Harnessing internal audit against climate change risk: A guide for audit committees and directors

4 Business resilience, disasters and crisis response Section 13 of the Internal Audit Code of Practice makes clear that internal audit should carry out a “review of any post-mortem and ‘lessons learned’ analysis if a significant adverse event has occurred at an organisation. Any such review should assess both the role of the first and second lines of defence and internal audit’s own role.”29 This means internal audit’s scope is not limited to providing assurance on how well an organisation is prepared for a risk event taking place. It also has a valuable role to play before, during and after significant disruptions have taken place.

As the frequency and severity of extreme weather events increases, so too will the need of internal audit to evaluate their organisation’s response.

Organisations should update their Business Continuity Plans (BCPs) to accommodate extreme weather events. But there is more that can be done to build resilience, such as to identify and map key people and business units, set impact tolerances and test response and recovery actions based on those tolerances. Internal audit can highlight to the Board any gaps in the maturity of the organisation’s approach to resilience.

Summary All organisations, regardless of sector, will need to adapt to accommodate the world’s changing climate.

Internal audit has the skills to play a leading role within the organisations they serve, to ensure that climaterelated risks and opportunities are fully understood.

The question now for Boards is whether they wish to take action to harness the key strengths, skills and expertise of internal audit to meet these issues head on in order to adapt to the changing rules, expectations and environment.

Internal audit’s helicopter view of the organisation, coupled with its direct link with the Board and senior leadership, puts it in an ideal place to ensure that an appreciation of climate change risk is embedded within an organisation’s strategy.

Similarly, we call on internal audit teams to show leadership here. Internal audit functions already have the skills they need to grapple with these issues. Take advantage of the direct link to the Board, ask questions and challenge. Opening-up a dialogue on climate change is the first step that needs to be taken if organisations wish to keep up now and excel in the future.

We urge that Boards, and especially audit committee chairs, begin having conversations about climate change preparedness with their internal audit teams.

The discussion needs to begin somewhere, as climate-related risks are only set to rapidly increase.

29

Chartered IIA, Internal audit code of practice: Guidance on effective internal audit in the private and third sectors

16

Harnessing internal audit against climate change risk: A guide for audit committees and directors

Further support from the Chartered IIA Open dialogue, sharing of knowledge, and a collaborative approach amongst audit and risk professionals is a key method for moving forward and developing an understanding of climate change risk. It is the ambition of the Chartered IIA to facilitate a more open dialogue and space for collaboration with the creation of the Climate Change Working Group (CCWG) in 2022, building and developing our current work programme.

We also offer our members a range of technical guidance that offers more thorough practical and technical assistance on auditing climate-related issues.

The Chartered IIA would like to thank the following individuals for their insight: Martin Townsend Global Head of Sustainability and Global Economy, British Standards Institution (BSI) Oliver Carpenter Lead, Climate Risk Research, Cambridge Centre for Risk Studies Neil Kitching Energy Specialist at Scottish Enterprise (and author of Carbon Choices) Kevin Gould Audit Committee Chair, Assurance consultant & climate change expert Carolyn Clarke Audit Committee Chair & Director, Chartered IIA council member Stephen Licence Group Chief Internal Auditor at Legal & General Mary Hardy Independent Director and Audit Committee Chair Jeremy Lawson Chief Internal Auditor, Persimmon Homes John Devine Chair of Credit Suisse International, Audit Committee Chair of Abrdn PLC Andrew Smallman Audit Director (Finance, Treasury, Model Risk, Climate Risk) at Nationwide Building Society Dermot Byrne Head of Internal Audit and EU Audit, Ministry of Public Expenditure and Reform (Rep. of Ireland).

17

Harnessing internal audit against climate change risk: A guide for audit committees and directors

Useful resources Task Force on Climate-related Financial Disclosures (TCFD) World Economic Forum, Global Risk Report 2021 Global IIA, The IIA’s New Three Lines Model: An update of the Three Lines of Defense Chartered IIA, Organisations’ preparedness for climate change: An internal audit perspective, and related technical guidance Chartered IIA, Internal Audit Financial Services Code of Practice Guidance on effective internal audit in the financial services sector Chartered IIA, Internal Audit Code of Practice Guidance on effective internal audit in the private and third sectors National Audit Office (NAO), Climate change risk: A good practice guide for Audit and Risk Assurance Committees National Audit Office (NAO), Local government and net zero in England Financial Reporting Council, UK Corporate Governance Code, July 2018 Financial Reporting Council, UK Stewardship Code 2020 Financial Reporting Council, Guidance on Board Effectiveness Financial Reporting Council, Guidance on Audit Committees Financial Reporting Council, FRC Climate Thematic Audit – How are auditors taking account of climate-related challenges?

18

Harnessing internal audit against climate change risk: A guide for audit committees and directors

About the Chartered Institute of Internal Auditors

About BSI

The Chartered Institute of Internal Auditors is the only professional body dedicated exclusively to training, supporting and representing internal auditors in the UK and Ireland.

BSI is the business improvement and standards company that enables organisations to turn standards of best practice into habits of excellence, ‘inspiring trust for a more resilient world’. For over a century BSI has driven best practice in organisations around the world.

We have 10,000 members in all sectors of the economy.

First established in 1948, we obtained our Royal Charter in 2010. Over 2,000 members are Chartered Internal Auditors and have earned the designation CMIIA. About 1,000 of our members hold the position of head of internal audit and the majority of FTSE 100 companies are represented among our membership.

Members are part of a global network of 200,000 members in 170 countries, all working to the same International Standards and Code of Ethics.

Stay connected

Chartered Institute of Internal Auditors Wimbledon Business Centre The Old Town Hall 4 Queen’s Road Wimbledon SW19 8YB tel 020 7498 0101 email info@iia.org.uk

Working with over 77,500 clients across 195 countries, it is a truly global business with skills and experience across all sectors including automotive, aerospace, built environment, food and retail and healthcare. Through its expertise in Standards and Knowledge, Assurance Services, Regulatory Services and Consulting Services, BSI helps clients to improve their performance, grow sustainably, manage risk and ultimately become more resilient.

To learn more, please visit: www.bsigroup.com