Sustainability assurance is becoming mandatory across an increasing number of reporting regimes, and most organisations are approaching their first engagement with a reasonable degree of confidence in their numbers.
That confidence is usually justified. The calculation is rarely where a first assurance engagement runs into difficulty.
What causes difficulty is that assurance tests process and evidence, not just arithmetic -- and the process was frequently never documented, because the figure was produced by one competent person working in a spreadsheet.
Limited assurance is still a real examination
Limited assurance provides a conclusion expressed in the negative: nothing came to the provider's attention suggesting the information is materially misstated. It involves less testing than reasonable assurance, which gives a positive opinion.
It is a lower level of assurance, but it is not a review of the final number in isolation. The provider still examines how the information was produced, samples underlying evidence, and forms a view on whether the process is capable of producing a reliable result.
The four things that get tested
Across engagements, the same areas produce findings.
- Traceability: can a reported figure be followed back to a source document for the reporting period
- Methodology: is the calculation approach documented, and was it applied consistently
- Controls: did anyone independent of the preparer review the figure before it was reported
- Completeness: is the boundary defined, and can you demonstrate that nothing material within it was omitted
Why evidence retention is the hardest gap to close
Most findings can be remediated. Methodology can be documented after the fact. Controls can be designed and applied to the next cycle.
Evidence retention cannot be fixed retrospectively. If utility invoices for a period were not retained, if a supplier's data submission was not kept, if a meter reading was recorded in a spreadsheet that has since been overwritten, then the evidence does not exist and no amount of later effort creates it.
This is the single strongest argument for building to assurance standard before assurance is required. The marginal cost of retaining source documents during the reporting cycle is close to zero. The cost of not having them is a qualified conclusion.
Independence is not negotiable
An assurance provider cannot assure information it helped prepare. This is a requirement of the assurance framework rather than a matter of preference, and it means the adviser who builds your inventory cannot also assure it.
That separation is worth understanding early, because it affects how you appoint. Preparation support and assurance are two engagements with two providers, and an adviser offering both should be treated with caution.
Preparing properly
The most useful preparation is to run an internal version of the engagement before the real one: take each reported metric, and try to trace it back to source evidence without help from the person who prepared it.
Where that fails, you have found your gap list -- and you have found it at a point in the cycle where it can still be closed, rather than three weeks before a filing deadline.
Topics
- Assurance
- Reporting
- Data quality
- Controls
