How do we prepare for assurance without a sustainability team?

You need three things and only one has to sit inside your business: someone to retrieve data from your own systems, someone who knows what evidence the assurance standard requires, and a governance record. The first is a retrieval task for finance, the second can be bought, and the third is a discipline rather than a headcount. A first-year filing is a defined project, which is why a permanent hire is usually the wrong first move.

What will our audit and risk committee ask us?

The same questions they ask about the financial report, applied to information the committee has never seen before. Expect them on capture and scope, where each number comes from and what controls sit over it, the significant judgements and materiality, who your assurance provider is and whether they are independent of the preparer, and what liability protection applies and until when. It works as a self-test: anything you cannot answer today is a work item.

What do we have to do ourselves and what can be done for us?

Anything that is a management judgement or a statutory act stays with you, and anything that is technical execution can be done for you. You keep access to source documents, approval of the boundary and the significant judgements, the governance record, and the signatures on the declaration and representation letter. Methodology, calculations, working papers, drafting the disclosures and managing assurance queries can all be done for you.

Glossary›Assurance, audit evidence and working papers›Reliance on internal audit

Glossary term

Cluster A · A45

Tier 1 · differentiator

Reliance on internal audit

Definition

Reliance on internal audit is the extent to which an external assurance provider can use work already performed by the entity’s internal audit function. Under ASSA 5000 the practitioner may use internal audit’s completed work as evidence, subject to evaluating its objectivity and competence. In Australia they may not use internal auditors to provide direct assistance.

ASSA 5000

· paragraphs Aus 42.1 and Aus 42.2 ·

In force

On this page

In practice
What the assurer does with it
Commonly confused with
Sources
Related terms
Related questions

Cluster

A · Assurance, audit evidence and working papers, 47 terms

In practice

This is one of the Australian-specific Aus paragraphs, and it is the one most likely to invalidate a resourcing plan an entity has already made.

There are two different things people mean by relying on internal audit, and Australia treats them oppositely. Using internal audit’s completed work means the external practitioner reads a review internal audit performed on its own initiative, evaluates it, and treats it as evidence. That is permitted, subject to assessment. Direct assistance means internal auditors working under the external practitioner’s direction and supervision, performing procedures for the external engagement.

Paragraph Aus 42.2 prohibits that outright, in terms: “The practitioner shall not use internal auditors to provide direct assistance on the sustainability assurance engagement. This extends to the use of internal auditors for direct assistance for components in the context of a group sustainability assurance engagement.”

The second sentence closes the obvious workaround. A group cannot route internal audit resource into a subsidiary’s component engagement and treat that as outside the prohibition.

The prohibition is not novel in Australian terms (it mirrors the existing prohibition for financial report audits here) but it is a divergence from the international standard, so a global group’s methodology or a foreign parent’s expectation may assume direct assistance is available. It is not.

The planning consequence is concrete. An entity that has budgeted for its internal audit team to run the site testing programme under the assurer’s direction, to keep external fees down, has budgeted for something the standard forbids. The workable version is the reverse sequencing: internal audit performs its own emissions review, on its own mandate, early enough that the external practitioner can evaluate and use the completed output.

What the assurer does with it

Before using internal audit work, the practitioner evaluates the function’s objectivity (who it reports to, whether it reports to the audit committee or to the CFO who owns the emissions numbers) and its competence for this subject matter, which is a real question because emissions work is new to most internal audit teams.

They then evaluate the specific work: whether it was properly planned, performed, supervised and documented, whether the evidence obtained supports the conclusions reached, and whether the conclusions are appropriate. They re-perform some of it to test that evaluation.

What they accept is a documented internal audit review with a clear scope, a working paper file, and a function that does not report to the person responsible for the figures. What they reject is internal audit work commissioned by finance, scoped by finance, and reporting to finance on finance’s own emissions numbers. They will also reduce reliance sharply where internal audit’s conclusions are more favourable than the evidence in the file supports.

The reliance decision is also capped by risk. However good internal audit is, the external practitioner performs more of the work themselves where the risk of material misstatement is highest, and cannot delegate the judgements.

Commonly confused with

Using a management’s expert. An external consultant who built your emissions model is management’s expert, evaluated under a different set of requirements, and is not internal audit. Entities sometimes offer the consultant’s calculation review as though it were an internal audit function output. It is not, and it carries less weight because the consultant is not independent of the number.