Internal auditors' perceptions of their role in environmental, social and

Internal auditors’ perceptions of their role in environmental, social and governance assurance and consulting

Dominic S. B. Soh Department of Accounting and Corporate Governance Macquarie University, Australia [email protected]

Nonna Martinov-Bennie International Governance and Performance Research Centre Macquarie University, Australia [email protected]

Acknowledgements: The authors would like to thank the IIA – Australia for their assistance and the survey participants for their time and contribution.

Electronic copy available at: http://ssrn.com/abstract=2576567

Internal auditors’ perceptions of their role in environmental, social and governance assurance and consulting

Abstract Purpose – This paper investigates the nature and extent of internal audit functions’ involvement in environmental, social and governance assurance and consulting in Australia. To identify emerging priorities, and the profession’s capacity to respond to these, the paper also explores internal audit practitioners’ perceptions of the current and future importance of these issues and the adequacy of their skills and expertise in meeting the challenges associated with their involvement in these areas. Design/methodology/approach – Data was collected from 100 chief audit executives and internal audit service provider partners through a survey. Findings – Governance issues are a key area of focus for respondents’ assurance and consulting efforts, followed by social and environmental issues respectively. While governance issues are perceived to be of greatest current importance to internal audit functions, environmental issues are most commonly expected to increase in importance over the next five years, and are reported to be in greatest need of further development of internal audit functions’ skills and expertise. Research implications – As the corporate landscape and expectations around transparency and accountability increase, the internal audit profession needs to address the current perceived skills gap in their ability to provide assurance and consulting on environmental, social and governance issues to ensure their continued relevance and ability to meet stakeholders’ needs and expectations in providing effective integrated assurance and in contributing to internal improvements. Originality/value – This paper provides initial empirical evidence of the nature and extent of internal audit’s involvement in environmental, social and governance assurance and consulting. Keywords: Internal audit; sustainability; environmental, social and governance assurance

2

Electronic copy available at: http://ssrn.com/abstract=2576567

1. Introduction There are a growing number of drivers for organisations to report on their environmental, social and governance (ESG) performance and for this information to be assured either internally or externally. In addition to increasing regulatory requirements in relation to ESG reporting (UNEP, KPMG, GRI & UCGA, 2010; Ioannou & Serafeim, 2012; European Commission, 2014), there is also a growing impetus for greater integration of ESG information with organisations’ financial reporting. Notably, the International Integrated Reporting Council (IIRC) was established in August 2010 as a forum of international leaders aiming for the development of a universally accepted reporting framework for integrating financial information with ESG information (IIRC, 2011). The key articulated driver behind the move towards integrated reporting is the perceived need to provide a holistic view of a business enterprise, focusing on the financial, environmental, social and governance frameworks and their synergetic relationships in organisational value creation. There is also growing awareness and influence of stakeholders such as proxy advisers and institutional investors who incorporate ESG information in informing their advice and decisions (Banasik et al., 2010; AICD, 2011; PRI Initiative, 2013). Emerging evidence also suggests that organisations are increasingly incorporating ESG information into their governance, strategy and operational decisions (Adams & Frost, 2008; EsquerPeralta et al., 2008; Martinov-Bennie et al., 2012). The heightened interest in ESG has been accompanied by an increase in demand for assurance over these disclosures to add to their credibility. There is also growing recognition that assurance services have the potential to add value to ESG management and reporting systems by driving internal organisational change and improvement (Bae & Seol, 2006; Mock et al., 2007). However, studies of ESG assurance have been largely confined to external providers, despite some evidence that internal stakeholders prefer ESG issues to be assured by internal audit functions (IAFs) and perceive internal assurance as adequate (Jones & Solomon, 2010), or acknowledgement that internal audit can improve the reliability of this information (IIRC, 2013). There is also recognition that the management and reporting of ESG should be linked to risk management systems and processes, and that internal audit has a role to play in adding credibility to ESG information and identifying gaps for improvement (ICAA and Kiewa, 2011). As an international leader on integrated reporting, the Integrated Reporting Council of South Africa notes that assurance processes over ESG information are less developed than those for financial information, and a consultative approach between the organisation and its internal and external assurance providers should be undertaken to determine which aspects of the integrated report are subject to assurance (IRC, 2011). A combined assurance model that takes into account assurance

3

provided by management, internal audit, external audit and other external assurance providers in determining the integrated reporting assurance strategy is also recommended (IRC, 2011). This is important for the internal audit profession going forward as recent studies have pointed to the evolving role of the IAF and an increasing recognition of the importance of and reliance on the IAF by various stakeholders (Cohen et al., 2010; Allegrini et al., 2011; Leung et al., 2011; Soh & Martinov-Bennie, 2011). In particular, emerging evidence indicates that the scope of the IAF is expanding to include nonfinancial assurance and consulting engagements at the request of the board or audit committee (Protiviti & IIA-Australia, 2011). Despite evidence that IAFs are, or should be, involved in ESG areas (Nieuwlands, 2007; Protiviti, 2008; Darnall et al., 2009; Cascone et al., 2010; Jones & Solomon, 2010; Leung et al., 2011; Ridley et al., 2011; IIA, 2013c), there has been limited investigation of the nature and extent of IAFs’ involvement in a comprehensive range of ESG areas. Instead, prior studies have typically touched on one or two specific aspects of ESG such as environmental audits or health and safety audits (Paape et al., 2003; Soh & Martinov-Bennie, 2011). With the increasing attention on (integrated) ESG reporting and assurance, the IAF’s role in this regard (Deloitte, 2011; Druckman, 2013; IIA, 2013c), and its potential to contribute to improving ESG practices, the objective of this paper is to provide initial evidence on the nature and extent of IAFs’ involvement in ESG assurance and consulting. The paper further examines internal audit professionals’ perceptions of the current and future importance of ESG issues to IAFs, the current levels of IAFs’ skills and competencies in performing ESG engagements, and their adequacy, as well as the standards and guidance used by IAFs in performing ESG engagements. Finally, the paper undertakes a discussion on the implications of IAFs’ involvement in ESG assurance and consulting for research and practice. Overall, the results of this study indicate that IAFs are currently very involved in providing assurance on governance issues, reasonably involved in social issues, but perform a very limited role in relation to environmental issues. Respondents also report relatively lower levels of consulting activities for all categories of ESG issues relative to assurance activities. While the perceptions of the future importance of governance and social issues are generally stable, environmental issues are widely expected to increase in importance. Respondents also report that IAFs’ skills and competencies in relation to environmental issues are in greatest need of further development. Lastly, the findings indicate divergence in usage of standards by IAFs when performing ESG engagements, compared to those used by external assurance providers reported in prior studies.

4

This evidence is useful to policy makers, professional bodies and internal audit professionals. The findings of the study enable practitioners to benchmark their activities against the reported results. The findings, particularly in relation to perceived relative future importance of issues and adequacy of IAF’ skills and competencies in addressing these emergent issues provide useful input to professional bodies in developing their professional education offerings. The results also provide evidence for policy debates in relation to the role of the IAF in providing assurance on ESG issues, for example, in the development of a combined assurance model for integrated reporting. Finally, the initial evidence of IAFs’ involvement in ESG assurance and consulting provides a platform for future research to leverage and build upon. The remainder of this paper is structured as follows. The following section reviews relevant literature and outlines various ESG regulatory initiatives, focusing on those that support the case for IAFs’ involvement in ESG issues. The third section describes the research method undertaken in this study. The fourth section provides the empirical results of the study. The final section provides a discussion synthesising the results of the study and their potential implications for the internal audit profession and research before concluding the paper, outlining the limitations of the study and suggesting potential areas for future research.

2. Literature review and research questions The internal audit profession has undergone significant change and received renewed emphasis internationally and in Australia in recent years. In Australia, in following with the international trend of stock exchanges (e.g. New York Stock Exchange, Johannesburg Stock Exchange) implementing requirements relating to internal audit, the Australian Securities Exchange (ASX) in its recent revision of its Corporate Governance Council’s Principles and Recommendations also incorporated a new recommendation requiring companies to disclose whether they have an IAF, and the function’s structure and role if they do. Companies that do not have an IAF are required to disclose their processes for evaluating and improving the effectiveness of their risk management and internal control (ASX CGC, 2014). There is also growing recognition of the role IAFs can or should perform in contributing to improved ESG governance and reporting as organisations perceive and respond to risks associated with nonfinancial disclosures (Cascone et al., 2010). With its unique position within the organisation and transition towards undertaking a more strategic approach, the IAF’s key role in the move towards integrated reporting (Druckman, 2013) and its capacity to improve the reliability of ESG information (IIRC, 2013) has been explicitly acknowledged. However, while there is a growing body of academic 5

literature examining various aspects of external ESG assurance, there has been a paucity of research investigating the nature and extent of internal assurance and consulting on ESG issues. Investigation into IAFs’ involvement in ESG areas is timely as there is emerging evidence of the evolving focus and role of internal auditing (Allegrini et al., 2011), such that the majority of the IAF’s work is now on nonfinancial matters (Protiviti & IIA-Australia, 2013). Based on findings from a global internal audit survey, it has been reported that internal audit practitioners expect that in the near future, less emphasis would be placed on operational and compliance audits and audits of financial risks, while corporate governance, enterprise risk management, strategic reviews, social and sustainability audits, and ethics audits are set to become major focus areas (Allegrini et al., 2011). The increasing importance and engagement of IAFs in ESG areas is also evidenced by the proliferation of ESG-related practice guides issued by the Institute of Internal Auditors (IIA) in recent years, including Evaluating Corporate Social Responsibility/Sustainable Development and several other specific subject-matter guides. There is some existing evidence of IAFs’ involvement in ESG areas, whether in specific areas such as occupational health and safety (Blewett & O’Keeffe, 2011; Robson et al., 2012), or more broadly in environmental areas (Darnall et al., 2009) or ESG reporting (Jones & Solomon, 2010) overall. However, there is a paucity of research that has examined the nature (i.e. assurance vs. consulting) and extent of IAFs’ involvement across a comprehensive range of specific ESG issues. The dichotomy between the IAF’s assurance and consulting role particularly in the ESG context is of interest in view of recent studies reporting expectations of the increasing importance of the consulting aspect (Stewart & Subramaniam, 2010; Soh & Martinov-Bennie, 2011). As part of recent revisions to International Standards on Auditing (ISA) 610 and 315 undertaken in light of developments in the internal auditing environment, the International Auditing and Assurance Standards Board (IAASB) also revised the definition of an IAF to reflect its status as an assurance and consulting activity (ISA 610, p.14(a)), bringing it in line with the IIA’s definition of internal auditing. The IIA, in its standards, defines consulting services as ‘advisory and related client service activities, the nature and scope of which are agreed with the client, are intended to add value and improve an organization’s governance, risk management, and control processes without the internal auditor assuming management responsibility’ (IIA, 2012a, p20). Assurance services, on the other hand, involve ‘objective examination of evidence for the purpose of providing an independent assessment on governance, risk management, and control processes for the organization’, with the nature and scope of these engagements determined by the internal auditor (IIA, 2012a, p19). In the context of ESG engagements, the IIA’s practice guide suggests that assurance activities may include auditing 6

ESG programs, controls and disclosures, while consulting (and facilitating) include facilitating management self-assessments of ESG controls and results, and consulting ‘on project design and implementation for CSR programs and reports or serve as an advisor on CSR governance, risk management and internal controls’ (IIA, 2010c, p7). It has been suggested that as organisations progress through different stages of sustainability maturity, the role of the IAF is likely to evolve, with greater emphasis on assurance (compliance) in the earlier stages and consulting (value creation) in later stages (Deloitte, 2011; IIA, 2013c). Given the growing case for internal audit’s involvement in the provision of both assurance and consulting in ESG areas, the remainder of this section outlines a number of significant developments in ESG regulation and guidance and discusses the limited extant evidence of IAFs’ involvement in specific ESG issues. While it is beyond the scope of this paper to provide an exhaustive discussion of all relevant ESG regulatory developments, particularly in the international environment, the following discussion provides support for internal audit’s involvement in a number of specific ESG areas, and provides context for the discussion on the implications of IAFs’ involvement in these areas in the final section of the paper. 2.1 Environmental issues There have been regulatory movements towards greater environmental management and reporting by organisations in recent years on issues such as energy and materials usage, greenhouse gas emissions and hazardous waste and water management (Haque & Deegan, 2010). Water management is a key environmental issue in the Australian context of significant variability in the terrain and climate and water scarcity (Chartres & Williams, 2006; Kendall, 2013). Australia has become an international leader in efforts to develop a water accounting system having issued a conceptual framework (WASB, 2009), accounting standard for general purpose water accounting reports (WASB, 2012), and an associated assurance standard (AUASB & WASB/the Bureau of Meteorology, 2014). While the preparation of a general purpose water accounting report remains voluntary at present, the Water Regulations 2008 establishes mandatory water information reporting requirements to the Bureau of Meteorology for various categories of organisations. There are also various initiatives across different level of government requiring organisations to implement environmental management and reporting processes (NetBalance, 2008). For example, the Energy Efficiencies Opportunities Program, established under the Energy Efficiency Opportunities Act 2006, requires organisations that individually, or as part of a corporate group, use more than 0.5 petajoules (PJ) of energy annually to report to the government and publicly on the outcome of and responses to energy efficiency assessments undertaken. Reporting organisations are 7

also subjected to verification by the government in assessing compliance with the program. Similar initiatives have also been introduced by the New South Wales government in relation to water and energy (Savings Action Plans) for large users to identify usage saving opportunities and report to the government. Despite these regulatory developments, and their associated compliance and reporting requirements, there is limited evidence of IAFs’ involvement in providing assurance and/or consulting on water management and energy usage issues within their organisations. Greenhouse gas emissions, in particular, has gained significant attention internationally (see Kauffmann, Less and Teichmann (2012) for a comprehensive review of international reporting requirements). In Australia, the enactment of the National Greenhouse and Energy Reporting (NGER) Act in 2007 introduced reporting obligations for organisations meeting certain NGER thresholds in relation to greenhouse gas emissions, energy production and consumption and other nonfinancial information specified by the NGER Act. With increasing importance of effective carbon management, and reporting and assurance internationally (Simnett et al., 2009; Green & Li, 2012), there is emerging evidence that mandatory reporting requirements have prompted organisations to engage assurance on both compliance and performance aspects of greenhouse gas emissions reporting (Martinov-Bennie et al., 2012; Martinov-Bennie & Hoffman, 2012). While the IAASB has issued an assurance standard on greenhouse gas emissions, the issue has received relatively less attention by the IIA and the internal audit profession. However, there is broad evidence that organisations rely on internal audits as part of the environmental management system (Darnall et al., 2009). It is therefore timely to investigate the nature and extent of IAFs’ involvement in environmental issues including those outlined above, and others such as hazardous waste management and biodiversity impacts. 2.2 Social issues As the stakeholder view of the organisation continues to gain traction, expectations around corporate transparency and accountability have increased over time (Danker, 2013). Against the backdrop of migration towards greater reliance on e-business models (PwC, 2012) and greater stakeholder engagement and activism (Danker, 2013), there have been various regulatory reforms in relation to the governance and reporting of social issues in Australia and internationally. The following outlines a number of these reforms to illustrate the growing importance of social issues in the current corporate landscape. With rising frequency and severity of data security breaches (PwC, 2012), information security and privacy has received significant attention in recent times (Weidenmier & Ramamoorti, 2006; IIA, 2012b). In Australia, the Privacy Amendment (Enhancing Privacy Protection) Act 2012 commenced in 8

March 2014 and increased organisations’ accountability for protecting customer privacy by substantially increasing requirements to secure customer data such as in the disclosure of crossborder information (Tucker, 2013). Given the significant financial and reputational losses associated with data security and privacy breaches, it has been suggested that IAFs should be involved in providing assurance to the board on the adequacy of information security controls and compliance with privacy regulations (Weidenmier & Ramamoorti, 2006; IIA, 2012b), although internal auditors need to be equipped with new skills in undertaking these engagements (PwC, 2012). Occupational health and safety (OHS) is a key issue for organisations given various regulatory requirements and its impact across all levels of an organisation’s operations and management (Blewett & O’Keeffe, 2011). There are incentives, both external (reputation, insurance costs, etc.) and internal (e.g. increased productivity), for organisations to implement OHS risk management systems (Frick, 2011), as well as to engage audits of these systems (e.g. assurance of regulatory compliance, continuous compliance, etc.) (Blewett & O’Keeffe, 2011; Robson et al., 2012). Investigation into the nature and extent of IAFs’ involvement in providing assurance and consulting on health and safety is timely in the Australian context given that new legislation introduced in Australia in 2011, and adopted in most states, has elevated the prominence of OHS as a governance issue by mandating the officers’ due diligence to ensure and verify the use and provision of resources and processes to eliminate or minimise risks to health and safety (Work Health and Safety Act 2011 s27(5)). While it has been suggested that IAFs may be providing assurance and consulting on OHS management (PwC, 2011), there has been limited evidence of such involvement reported in the extant literature. Human rights and supply chain issues have gained prominence recently with the increasingly global nature of business and supply chains (Cascone et al., 2010), and significant international public and media attention after incidents such as the Rana Plaza tragedy in Bangladesh in 2013 (Tyson, 2014). In the US, California passed the California Transparency in Supply Chains Act of 2010 requiring retail sellers and manufacturers doing business in California with annual worldwide revenue in excess of $100 million to disclose their efforts to eradicate slavery and human trafficking from its direct supply chain for goods offered for sale. These disclosures include whether, and the extent to which, these organisations have undertaken verification of product and supply chains and audits of suppliers. There are also ongoing efforts to introduce similar legislation at the federal government level (Darragh, 2011). The Securities and Exchange Commission in the US have also introduced requirements in the Dodd Frank Act for organisations to disclose whether conflict minerals used originate from the Democratic Republic of Congo or surrounding regions, and if so, describe due

9

diligence measures on the chain of custody, including obtaining an independent audit (Rosenhouse, 2012). In the aftermath of the Rana Plaza tragedy, a legally binding Accord on Fire and Building Safety including the requirement for safety inspections at factories and the disclosure of the findings of these inspections was introduced in Bangladesh. The Accord has since been signed by over 150 companies across 21 countries (Accord on Fire and Building Safety in Bangladesh, 2014). While IAFs may have been involved in supply chain issues for accreditation purposes in the past (Martinov-Bennie et al., 2012), it is likely that the significant reputational and legal risks will see supply chain issues being escalated to the board which will consequently demand assurance on the adequacy of the organisation’s response to these risks (Tyson, 2014; Turker & Altuntas, 2014). The IIA has issued a practice guide on auditing external business relationships (IIA, 2009), although evidence of IAFs’ involvement in this area has been limited. With the rapidly increasing prominence of social issues such as those outlined above, and others including employee retention and turnover and product responsibility, investigation into the nature and extent of IAFs’ involvement in providing assurance and consulting on a comprehensive range of social issues is timely. 2.3 Governance issues In addition to specific disclosures required by corporate governance codes and stock exchange listing rules, prior evidence indicates that companies voluntarily choose to disclose additional corporate governance information to mitigate agency conflicts (Allegrini & Greco, 2013). The value of engaging assurance to increase the credibility of these disclosures has also been noted (FEE, 2009). While the involvement of the external auditor in relation to corporate governance-related disclosures is generally limited to considering whether there are material inconsistencies with audited financial statements under the ISAs, there are specific requirements in the IIA standards for IAFs to consider governance issues. For example, the IAF is required to assess and make appropriate recommendations for improving governance processes to ensure effective organisational performance management and accountability (Performance Standard 2110). Further, the IAF must evaluate the design, implementation, and effectiveness of the organisation’s ethics-related objectives, programs and activities (IIA, 2012a; IIA, 2012c). Given their position, access and knowledge across the organisation, internal auditors have also been suggested to be experts in providing comfort to the audit committee in relation to governance issues (Sarens et al., 2009). Whilst IAFs’ involvement in governance issues has received relatively greater attention in the prior literature (see, e.g. Gramling et al., 2004) compared to environmental and social issues, a substantial proportion of these studies have been concerned with investigations into its relation to financial reporting quality or more specifically in several instances, the external auditor’s reliance on the IAF 10

(see, e.g. Cohen et al., 2004). In light of evidence of the evolving role of the IAF and increasing emphasis on its consulting role (Stewart & Subramaniam, 2010; Soh & Martinov-Bennie, 2011), it is timely to investigate IAFs’ current involvement in providing assurance and consulting on a comprehensive range of specific governance issues. The following discussion briefly outlines emergent governance issues of importance that have received relatively limited attention in the extant internal audit literature. 2.3.1

Organisational culture and business ethics

In the aftermath of corporate scandals and collapses, whether due to excessive risk-taking or fraudulent accounting practices, there has been increasing attention and scrutiny of the ethics of corporate behaviour and organisational culture. There is now increased pressure from various stakeholders ranging from shareholders to the government, and the wider community for organisations to manage unethical behaviour (Treviño et al., 2006; Kaptein, 2008; PwC, 2009; Davies et al., 2010). There is also evidence linking organisational culture and organisations’ long-term financial performance (Foley & Lardner LLP, 2007). Prior research also suggests that organisational culture is a key factor in contributing to successful enterprise risk management implementation (Kimbrough & Componation, 2009; Aon, 2010). Given its increasing involvement in risk management (Sarens et al., 2009; Stewart & Subramaniam, 2010; Soh & Martinov-Bennie, 2011), it would be useful for the IAF to assist in evaluating organisational culture. However, there is limited evidence of IAFs’ involvement in providing assurance and consulting on organisational (risk) culture despite growing recognition of its importance and potential repercussions, and the role that the IAF can perform in this regard (PwC, 2009; IIA, 2010b). For example, it has been suggested that a risk culture audit “constitutes a major opportunity for internal auditors. An assessment of the culture identifies the actions and practices in the company that may directly contribute to issues arising in the future. By providing predictive insights to the board and senior management, and by reinforcing desirable cultural traits and practices, Internal Audit can make a significant contribution to corporate performance and integrity... However, risk culture audits are uncharted territory for most internal auditors: There are no established standards and, as yet, no generally accepted practices” (PwC, 2009, p.2) 2.3.2

Anti-bribery and corruption activities

Bribery and corruption are also key issues that have received recent regulatory attention internationally (KPMG, 2011; EY, 2012; Ioannou & Serafeim, 2012; KPMG, 2012). For example, the UK Bribery Act 2010 applies to all UK companies and foreign companies with a presence in the UK. The Act has extra-territorial application and criminalises not only the paying and receiving of bribes, 11

including the bribery of foreign officials, but also the failure of commercial organisations to prevent bribery. In the US, the significance of the Foreign Corrupt Practices Act to the regulatory agenda has been highlighted by the growing number of prominent cases and increased investment towards enforcements under the Act announced by the Securities Exchange Commission and the Department of Justice (Mahoney, 2013; Scholer & Conway-Hatcher, 2013). There is emerging evidence of IAFs being involved in anti-bribery and corruption activities. For example, internal audit initiatives have been reported to be most commonly utilised in anti-bribery and corruption program compliance efforts in various global surveys (KPMG, 2011; EY, 2012). While a similar recent Australian survey reported that risk and compliance/internal audit review processes were well-defined (KPMG, 2012), the nature of internal audit’s role in terms of assurance vs. consulting was not specifically examined. In light of the above discussion, the expanding and evolving role of the IAF (Spira & Page, 2003; Carcello et al., 2005; Smith et al., 2010; Allegrini et al., 2011; Soh & Martinov-Bennie, 2011), and calls for more comprehensive descriptions of the type of work IAFs undertake (Carey et al., 2000; Holt & DeZoort, 2009), this study investigates the nature and extent of IAFs’ involvement in providing ESG assurance and consulting services. The distinction between assurance and consulting activities is explicitly made to gain a better understanding of the nature of IAFs’ involvement in these areas given the lack of attention given to this distinction, particularly in relation to environmental and social issues, in prior literature. To identify emerging issues to the internal audit profession, perceptions of the current and future importance of these issues to IAFs are also examined. These issues are investigated through the following research questions: RQ1:

What is the IAFs’ involvement in ESG assurance and consulting activities?

RQ2:

What is the perceived importance of ESG issues to IAFs currently, and over the next five years?

2.4 Skills and expertise Being resourced with appropriate skills and competencies is critical to an effective IAF in meeting stakeholders’ needs and gaining their confidence (Arena & Azzone, 2009; Soh & Martinov-Bennie, 2011). It has been noted that while IAFs are uniquely positioned to be able to contribute to the implementation of and provision of assurance on ESG management systems, this would require internal auditors to be equipped with the appropriate skills, expertise and techniques (Nieuwlands, 2007). This was reinforced by the finding of a recent survey of chief audit executives (CAEs) of an increased requirement for environment and sustainability skills within IAFs (Protiviti & IIA-Australia,

12

2011). It was suggested that this may be attributable to IAFs transitioning from a compliance driven approach to a strategic risk perspective (Protiviti & IIA-Australia, 2011). The investigation of the current and required skills and competencies in relation to ESG issues is timely given IAFs’ evolving role, emphasis shifts, and the resulting skill misalignment (Clemmons, 2009; Anderson & Svare, 2011; Protiviti & IIA-Australia, 2011; Jackson, 2013; Millman, 2013; PwC, 2013). Extant literature and guidance on internal audit’s involvement in ESG areas either suggests that external specialists or consultants may be required in supplementing IAFs’ skills (e.g. Foley & Lardner LLP, 2007; PwC 2009), or broadly indicate that IAF skills are in need of improvement without providing clear indications of specific areas which require improvement (Nieuwlands, 2007). The current level of IAF skills and competencies in relation to ESG issues and their adequacy are examined through the following research questions: RQ3:

What is the perceived current level of IAF skills and competencies in relation to ESG issues?

RQ4:

Are IAFs’ skills and competencies perceived to be adequate for their involvement in ESG assurance and consulting engagements?

2.5 Standards and guidance A key issue in ESG assurance is the development and use of standards to guide the engagement. It is recognised that mere provision of assurance on ESG reports does not automatically lend credibility to these reports, and that the assurance process may be subject to managerial capture (Owen et al., 2000). It has consequently been suggested that the development and application of consistent assurance guidelines or standards is a way to ensure assurance services contribute to the credibility of the reports (Adams, 2004; AccountAbility, 2008). A number of ESG assurance (and reporting) standards have gained prominence in recent years, such as the Institute of Social and Ethical Accountability’s (AccountAbility) AA1000 Assurance Standard, the IAASB’s International Framework for Assurance Engagements (Framework) and International Standard on Assurance Engagements (ISAE) 3000 Assurance Engagements Other Than Audits or Reviews of Historical Financial Information, as well as the Global Reporting Initiative’s (GRI) Sustainability Reporting Guidelines (Martinov-Bennie et al., 2012). While it is acknowledged that IAFs may use these standards when performing ESG assurance engagements (e.g. footnote 1 in the Framework), there is limited evidence as to the relevance of these standards to IAFs or whether IAFs in fact use these standards. The IIA’s International Professional Practices Framework (IPPF) provides guidance for internal auditors who are members of the IIA. It contains mandatory guidance, including the International 13

Standards for the Professional Practice of Internal Auditing (ISPPIA), and strongly recommended guidance. The ISPPIA are authoritative professional standards which all Certified Internal Auditors internationally (and all IIA-Australia members) are required to adhere to in performing their duties. The ISPPIA provide guidance on assurance engagements in areas such as governance, risk management and compliance, and hence “by association, CSR” (IIA, 2008, p.1). In recent years, the IIA has issued several ESG-related practice guides, as part of the strongly recommended guidance within the IPPF, on various subject matters including privacy risks (2012b), integrated auditing (2012d), ethics-related programs and activities (2012c), corporate social responsibility/sustainable development (2010c) and external business relationships (2009), amongst others. The IIA’s corporate social responsibility/sustainable development practice guide refers to the potential use of AccountAbility’s AA1000 standards, ISO or SA8000 standards in ESG assurance engagements. While the overall use of the IPPF/ISPPIA has been investigated in the literature (Leung et al., 2011), there is limited evidence as to the relevance and use of the IPPF and wider ESG guidance by IAFs in undertaking ESG assurance and consulting engagements. The issue of which standards and guidance IAFs employ in performing ESG engagements is investigated through the following research question: RQ5:

What standards or guidelines do IAFs use when undertaking ESG engagements?

3. Methodology Data for the study were collected through a survey conducted in mid-2012 using the Institute of Internal Auditors – Australia’s (IIA-Australia’s) CAE and internal audit service provider partner database. These participants were selected as the target population given their position within the organisation and their overall responsibility for the IAF. CAEs and service provider partners are also likely to be aware of and understand ESG issues under investigation at a broad level, as well as specifically within their (clients’) organisations as it has been suggested that internal auditors are perceived as “more ‘informed’, and potentially more influential” than ESG managers in embedding sustainability assurance within organisations (O'Dwyer et al., 2011, p.49). A total of 103 responses to the survey were received, of which 100 complete responses were usable. The response rate of 34% is slightly higher compared to recent surveys of CAEs conducted within Australia (Leung et al., 2004; Christopher et al., 2009; Leung et al., 2011). The slightly higher response rate in this study may be attributable to the inclusion of internal audit service provider partners (16 respondents) in the sample who were asked to respond to the survey in relation to their single largest client organisation, consistent with the approach applied by the IIA in its Global 14

Internal Audit Survey (IIA 2010a). Table 1 provides an overview of the distribution of respondent type, industry and experience. The distribution of the sample of respondent organisations’ industries is consistent with recent surveys of CAEs undertaken in Australia (Protiviti & IIA-Australia, 2009, 2010, 2011, 2013). The survey instrument was designed based on a review of the existing IAF and ESG assurance literature, as well as IIA surveys of the internal audit profession to facilitate comparisons of the findings to these studies. A cross section of ESG indicators was drawn from the GRI sustainability reporting guidelines (GRI, 2011), the United Nations-backed Principles for Responsible Investing (PRI) Initiative’s indicators (PRI Initiative, 2011) and the IIA’s Evaluating Corporate Social Responsibility/Sustainable Development Practice Guide (IIA, 2010c) and categorised into each ESG category. The GRI and PRI indicators were selected to ensure that both organisations’ and investors’ perspectives were considered as well as to reflect the dominant use of the GRI in ESG reporting and the growth of sustainable investing (Bendell, 2010; EY & BCCCC, 2014). The survey instrument was then discussed and pre-tested with five academics and seven practitioners, including the IIA-Australia’s technical committee and technical staff. Refinements to the survey instrument were based on these discussions and pilot-testing results. The final list of issues was streamlined as a result for practical reasons (time constraints), but also to balance the relevance of the issues presented in the survey with the need to provide a comprehensive set of indicators to capture a holistic view of present and emerging issues of importance. While the final list of issues examined was not intended to be an exhaustive list, it was considered to cover a comprehensive range of key issues within each ESG category provided within these guidelines. Given the nature of ESG information, it was not possible to definitively categorise a number of issues (PRI Initiative, 2013) as the categories are not mutually exclusive. For example, culture and ethics are two overlapping topics and could equally be categorised under social or governance issues. The final list of issues included in each ESG category in the survey is provided in Appendix 1.

15

Table 1: Demographic data Respondent type Chief audit executive Internal audit service provider partner Industry Resources and utilities Construction and manufacturing Transport, postal and warehousing Consumer discretionary Financials Public administration and other services Experience Internal auditing CAE/Partner in current organisation

n

%

84 16

84 16

18 5 9 10 13 45 Mean 16.24 years 5 years

18 5 9 10 13 45 SD 6.71 3.78

4. Results Research questions 1 examined IAFs’ involvement in ESG assurance and consulting, while RQ 2 examined the perceived current and expected importance of ESG issues over the next five years. RQs 3 and 4 examined the perceived current skill and competency level of IAFs in relation to ESG issues, and their adequacy. Finally, RQ 5 examined IAFs’ usage of standards and guidance in the performance of ESG engagement. The presentation of the results is structured according to ESG category for RQs 1 to 4. That is, the findings for these RQs in relation to environmental issues are presented before those for social issues and governance issues. The section concludes with the findings for RQ5. 4.1 Environmental issues 4.1.1

IAF involvement in assurance and consulting over environmental issues

40% of respondents reported undertaking assurance and/or consulting engagements in relation to at least one of the six environmental issues examined in this study. Only 7% reported being involved in providing both assurance and consulting on at least one environmental issue, while 21% undertake assurance only, and 12% are involved in consulting on at least one environmental issue. The scope of IAF activities carried out in relation to environmental issues is largely restricted to a small number of issues, rather than broad‐ranging across all six issues examined. Of the IAFs involved in providing assurance and consulting over environmental issues, most covered three or fewer issues in terms of assurance (68% of respondents) and consulting (53%) activities. This is likely partly attributable to activities being undertaken in relation to environmental issues being more industry specific. For instance, hazardous waste management would be of limited relevance to a financial institution. 16

Greenhouse gas emissions is the most common issue in which IAFs are involved in providing assurance (20%), while energy usage is the most common issue for IAF consulting activities (14%). Table 2 provides details on IAF involvement in assurance and consulting on environmental issues. Table 2: IAF involvement in environmental assurance and consulting Assurance* Environmental issue Mean SD Energy usage 0.16 0.37 Materials usage 0.11 0.31 Greenhouse gas emissions 0.20 0.40 Hazardous waste management 0.14 0. 35 Water management 0.15 0.36 Impacts on biodiversity 0.09 0.29 * 1=Involved in providing assurance/consulting on issues, 0 otherwise

4.1.2

Consulting* Mean SD 0.14 0.35 0.10 0.30 0.12 0.33 0.10 0.30 0.11 0.31 0.08 0.27

Current and future importance of environmental issues to the IAF

Overall, environmental issues are regarded as being of slight to moderate current importance to respondent IAFs with a mean score of 2.68 (on a scale of one to five) across the six issues examined. Energy usage and hazardous waste management are the most highly rated of the environmental issues examined, with mean scores of 2.88 and 2.84 (on a scale of one to five) respectively. Despite the relatively low current importance attached to environmental issues compared to social and governance issues respondents were most likely to report expectations of environmental issues increasing in importance in coming years. In particular, energy usage (70% of respondents) and greenhouse gas emissions (67%) are most commonly expected to increase in importance over the next five years, in addition to materials usage (61%). These results are most likely explained by the rising cost of energy, and recent legislation in relation to greenhouse gas emissions and energy usage, which impose greater compliance and reporting costs on organisations. Table 3 provides details on the perceived current importance of the environmental issues covered in this study, as well as expectations of their importance over the next five years. Table 3: Perceived importance of environmental issues currently and over next 5 years Current importance* Next 5 years Environmental issue Mean SD Decreasing Constant Increasing Energy usage 2.88 1.10 2% 28% 70% Materials usage 2.68 1.08 1% 38% 61% Greenhouse gas emissions 2.65 1.19 1% 33% 67% Hazardous waste management 2.84 1.34 0% 55% 45% Water management 2.62 1.23 0% 54% 46% Impacts on biodiversity 2.43 1.17 1% 54% 45% *Measured on a five-point rating scale (1=Not important at all, 5=Very important)

17

4.1.3

IAF skills and competencies in relation to environmental issues

Respondents generally rated their IAFs’ competency and skills in relation to the environmental issues examined in this study as average, with an overall mean of 2.65 (on a scale of one to five). Roughly half the respondents reported that IAF skills and expertise need improvement across all environmental issues examined. This is consistent with the increased need for environment and sustainability skills reported by Protiviti and IIA-Australia (2011). Areas of greatest need for improvement are greenhouse gas emissions (49% of respondents), energy usage (45%) and materials usage (44%). Table 4 provides details of the perceived skills and competencies of respondent IAFs in relation to environmental issued examined in this study, as well as their adequacy. Table 4: Perceived competency and adequacy of IAF skills and expertise for environmental issues Competency* Adequacy** Environmental issue Mean SD Mean SD Energy usage 2.81 0.98 0.55 0.50 Materials usage 2.76 0.90 0.56 0.50 Greenhouse gas emissions 2.64 1.01 0.51 0.50 Hazardous waste management 2.66 0.95 0.63 0.49 Water management 2.68 0.98 0.70 0.46 Impacts on biodiversity 2.32 0.99 0.58 0.50 *Measured on a five-point rating scale (1= Extremely poor, 5=Excellent) **1=Adequate, 0=Needs to improve

4.2 Social issues 4.2.1

IAF involvement in assurance and consulting over social issues

Almost all (98%) respondent IAFs undertake assurance and/or consulting activities in relation to at least one of the nine social issues examined in this study. IAFs’ involvement in social issues is predominantly in relation to the provision of assurance with 95% of respondent IAFs conducting assurance activities on at least one social issue covered by the survey. In comparison, 45% of respondent IAFs conduct consulting activities on at least one of the social issues covered by this study. 42% of respondents reported being involved in both assurance and consulting on social issues examined in this study. Among IAFs which conduct assurance activities on social issues, a majority (56%) cover three to five issues. In comparison, consulting activities are skewed toward covering fewer social issues: 29% are in relation to only one social issue and a further 53% are in relation to two to four social issues. OHS is clearly the most common social issue for which IAFs undertake assurance and consulting activities (79% and 23% respectively). A majority of respondent IAFs are also involved in providing

18

assurance on customer privacy (67%), supply chain issues (63%) and donations and sponsorships (59%). Following OHS, the next most common issues which IAFs are involved in consulting on are community impacts and relations (19%) and supply chain issues (18%). Table 5 provides details on the nature of IAFs’ involvement in providing assurance and consulting on social issues examined in this study. Table 5: IAF involvement in social assurance and consulting Assurance* Social issue Mean SD OHS 0.79 0.41 Employee retention and turnover 0.43 0.50 Training and education 0.46 0.50 Supply chain issues 0.63 0.49 Human rights issues 0.15 0.36 Community impacts and relations 0.31 0.46 Donations and sponsorships 0.59 0.49 Product responsibility 0.25 0.44 Customer privacy 0.67 0.47 * 1=Involved in providing assurance/consulting on issues, 0 otherwise

4.2.2

Consulting* Mean SD 0.23 0.42 0.16 0.37 0.12 0.33 0.18 0.39 0.08 0.27 0.19 0.39 0.11 0.31 0.09 0.29 0.20 0.40

Current and future importance of social issues to the IAF

Overall, social issues are regarded as being of moderate current importance to respondent IAFs with a mean score of 3.46 (on a scale of one to five) across the nine issues examined. OHS is perceived to be of the greatest current importance to IAFs (mean: 4.32), followed by customer privacy (3.90). With the exception three of the nine social issues examined, the future importance of social issues in the coming years is largely expected to remain stable. Employee turnover and retention is perceived to be a key emerging area of importance over the next five years, with 61% of respondents expecting it will increase in importance in this period, more than for OHS (55%). Half the respondents also expect customer privacy to increase in importance in coming years. Table 6 provides details on respondents’ perceptions of the importance of social issues to IAFs currently and over next five years.

19

Table 6: Perceived importance of social issues currently and over next 5 years Current* Next 5 years Social issue Mean SD Decreasing Constant Increasing OHS 4.31 0.90 0% 45% 55% Employee retention and turnover 3.57 1.08 0% 39% 61% Training and education 3.38 0.99 1% 61% 38% Supply chain issues 3.49 0.92 1% 64% 35% Human rights issues 2.76 1.12 3% 77% 20% Community impacts and relations 3.60 1.11 1% 59% 40% Donations and sponsorships 2.87 1.09 4% 76% 20% Product responsibility 3.23 1.13 3% 68% 29% Customer privacy 3.90 1.04 0% 50% 50% *Measured on a five-point rating scale (1=Not important at all, 5=Very important)

4.2.3

IAF skills and competencies in relation to social issues

Respondents rated their IAFs as fairly competent in their ability to undertake engagements involving social issues with a mean score of 3.36 (on a scale of one to five) across all nine social issues examined in this study. Areas of greatest reported competence are OHS (mean: 3.74), customer privacy (3.73) and supply chain issues (3.60), while areas of greatest need for further development in IAF skills are human rights (27% of respondents), community impacts and relations (23%) and supply chain issues (19%). Given the high levels of IAFs’ involvement in OHS assurance reported above and the high level of perceived adequacy of IAFs’ skills and expertise, it would appear that the IAFs have already upskilled to meet the needs and expectations of stakeholders in relation to providing assurance on OHS. The growing importance of wider stakeholder engagement and supply chain issues and IAFs’ involvement in these areas is highlighted by the findings of this study. Community impacts and relations ranks third highest in terms of perceived current importance and also ranks second highest in need for further development in IAF skills and expertise (23% of respondents). Supply chain issues rank highly in reported IAF competence, but also have a relatively high reported need for improvement in IAF skills (19%) compared to other social issues examined. Table 7 provides details of respondents’ perceptions of the skill and competency level of IAFs, and their adequacy, in relation to social issues examined in this study.

20

Table 7: Perceived competency and adequacy of IAF skills and expertise for social issues Competency* Adequacy** Social issue Mean SD Mean SD OHS 3.74 0.75 0.82 0.39 Employee retention and turnover 3.25 0.72 0.89 0.31 Training and education 3.35 0.78 0.92 0.27 Supply chain issues 3.60 0.77 0.81 0.39 Human rights issues 2.74 0.86 0.73 0.45 Community impacts and relations 3.05 0.95 0.77 0.42 Donations and sponsorships 3.45 0.77 0.88 0.33 Product responsibility 3.29 0.80 0.83 0.38 Customer privacy 3.73 0.83 0.86 0.35 *Measured on a five-point rating scale (1= Extremely poor, 5=Excellent) **1=Adequate, 0=Needs to improve

4.3 Governance issues 4.3.1

IAF involvement in assurance and consulting over governance issues

97% of respondents reported involvement in assurance and/or consulting activities in relation to at least one of the 13 governance issues examined in this study with high levels of involvement in both assurance and consulting activities. 96% of respondents conduct assurance activities, whilst 70% conduct consulting activities, in relation to at least one of the governance issues. IAFs are typically involved in providing assurance on a large proportion of governance issues examined. Of IAFs which conduct assurance activities on governance issues, a majority (67%) cover seven or more issues. In comparison, the distribution of IAF consulting activities is more wide‐ ranging and evenly distributed in terms of the number of issues covered. IAF coverage of governance issues is therefore more comprehensive relative to environmental and social issues. This supports the expectation of the important role that the IAF plays in organisational governance regardless of organisation type or sector. The results indicate that risk management is the key governance issue in which IAFs are involved both in terms of assurance (85% of respondents) and consulting (55%), consistent with findings from recent studies (Sarens et al., 2009; Stewart & Subramaniam, 2010; Soh & Martinov-Bennie, 2011). Following risk management, other key areas in which IAFs are involved in providing assurance are fraud (also 85% of respondents), corruption and bribery (78%) and conflicts of interest (76%). IAFs most commonly undertake consulting activities in relation to governance structure (52%) and strategic risks (43%) after risk management (55%). The high level of IAFs’ involvement in providing assurance on corruption and bribery is consistent with prior international surveys reporting the prevalent use of IAFs in monitoring compliance in relation to anti-bribery and anti-corruption laws 21

(KPMG, 2011; EY, 2012; KPMG, 2012). The findings from this study suggest that the IAF’s role in this regard is predominantly an assurance rather than a consulting role. Table 8 provides details in relation to respondent IAFs’ involvement in providing assurance and consulting on governance issues examined in this study. Table 8: IAF involvement in governance assurance and consulting Assurance* Governance issue Mean SD Governance structure 0.70 0.46 Organisation culture 0.40 0.49 Business ethics 0.58 0.50 Conflicts of interest 0.76 0.43 Remuneration structures 0.35 0.48 Diversity and equal opportunity 0.21 0.41 Stakeholder dialogue 0.21 0.41 Risk management 0.85 0.36 Strategic risks 0.62 0.49 Corruption and bribery 0.78 0.42 Anti-money laundering 0.34 0.48 Fraud 0.85 0.36 Whistleblower schemes 0.61 0.49 * 1=Involved in providing assurance/consulting on issues, 0 otherwise

4.3.2

Consulting* Mean SD 0.52 0.50 0.35 0.48 0.32 0.47 0.37 0.49 0.12 0.33 0.16 0.37 0.14 0.35 0.55 0.50 0.43 0.50 0.40 0.49 0.17 0.38 0.40 0.49 0.40 0.49

Current and future importance of governance issues to the IAF

Consistent with being the issue with the highest level of assurance and consulting involvement by respondent IAFs, risk management is perceived to be of greatest importance (mean of 4.60 on a scale of one to five) of the governance issues examined in this study. It is also widely expected to continue to increase in importance over the next five years (68% of respondents), just behind strategic risks (69%). Organisation culture is also expected to increase in importance in coming years by a majority (62%) of respondents. In terms of current importance, following risk management, strategic risks and conflicts of interest are rated as being of greatest current importance to the IAF, with mean scores of 4.54 and 4.25 respectively. These results are consistent with the IIA’s global Pulse of the Profession Survey (2013a) finding of an increasing IAF focus on providing assurance on strategic risks and risk management. Table 9 provides details of the perceived importance and importance of governance issues to IAFs currently and over the next five years.

22

Table 9: Perceived importance of governance issues currently and over next 5 years Current* Next 5 years Governance issue Mean SD Decreasing Constant Increasing Governance structure 4.30 0.78 0% 50% 50% Organisation culture 4.21 0.81 0% 38% 62% Business ethics 4.24 0.82 0% 55% 45% Conflicts of interest 4.25 0.82 0% 59% 41% Remuneration structures 3.12 1.04 2% 75% 23% Diversity and equal opportunity 3.13 1.03 0% 64% 36% Stakeholder dialogue 3.55 1.02 1% 51% 48% Risk management 4.60 0.62 1% 31% 68% Strategic risks 4.54 0.67 1% 30% 69% Corruption and bribery 4.10 0.86 0% 55% 45% Anti-money laundering 2.89 1.26 3% 78% 19% Fraud 4.24 0.75 0% 51% 49% Whistleblower schemes 3.72 0.93 3% 66% 31% *Measured on a five-point rating scale (1=Not important at all, 5=Very important)

4.3.3

IAF skills and competencies in relation to governance issues

IAF competence ratings are generally higher for governance issues than for environmental and social issues, with a mean score of 3.74 (on a scale of one to five) across all governance issues examined in this study. Areas of greatest competence are risk management (mean: 4.22), strategic risks (4.12) and governance structure (4.11). Despite high levels of expertise in strategic risk reported by respondents, the issue ranked relatively highly in terms if need for further development (23% of respondents). This is in line with indications of IAFs increasingly adopting a strategic perspective (Protiviti & IIA-Australia, 2011) and the expected increase in the importance of the issue to IAFs in coming years reported above. Areas of relative weakness in terms of IAFs’ competency levels are remuneration structures, stakeholder dialogue and anti‐money laundering. In addition to strategic risks (23% of respondents), governance issues reported to be in greatest need of further development of IAFs’ skills and expertise are stakeholder dialogue (25%), corruption and bribery and anti‐money laundering (23% each). Table 10 provides details of the perceived skills and competencies of IAFs, and their adequacy, in relation to governance issues covered in this study.

23

Table 10: Perceived competency and adequacy of IAF skills and expertise for governance issues Competency* Adequacy** Governance issue Mean SD Mean SD Governance structure 4.11 0.68 0.90 0.30 Organisation culture 3.67 0.75 0.80 0.40 Business ethics 3.91 0.71 0.92 0.27 Conflicts of interest 4.07 0.76 0.92 0.27 Remuneration structures 3.20 0.80 0.82 0.39 Diversity and equal opportunity 3.23 0.79 0.80 0.40 Stakeholder dialogue 3.20 0.83 0.75 0.44 Risk management 4.22 0.64 0.84 0.37 Strategic risks 4.12 0.71 0.77 0.42 Corruption and bribery 3.83 0.82 0.77 0.42 Anti-money laundering 3.20 0.90 0.77 0.42 Fraud 3.96 0.72 0.79 0.41 Whistleblower schemes 3.86 0.79 0.86 0.35 *Measured on a five-point rating scale (1= Extremely poor, 5=Excellent) **1=Adequate, 0=Needs to improve

4.4 Standards and guidance The study finds the highest level of usage for the IIA’s ISPPIA, followed by the IIA’s ESG-specific practice guide Evaluating Corporate Social Development/Sustainable Development. 34% of respondents also reported usage of ISO 140100 Environmental Management. The least commonly used standard in the sample is Social Accountability International’s SA8000 standard (4% of respondents) and AccountAbility’s AA1000 standards (5% of respondents). Usage of ISAE (or the Australian equivalent) 3000 and GRI guidelines are also relatively low with 20% and 18% of respondents indicating they use these standards respectively. Table 11 reports details of respondent IAFs’ usage of standards and guidance in undertaking ESG assurance and consulting engagements. A number of respondents also indicated that they used other standards not provided in the survey instrument. These included government issued code of ethics or best practice guidelines, ISO 31000:2009 Risk management – Principles and guidelines, ISO 19011:2003 Guidelines for quality and/or environmental management systems auditing and the AS 8000 corporate governance series of standards. These findings differ considerably from Frost & Martinov-Bennie’s (2010) investigation of standards governing the work of external ESG service providers in the Australian context, where it was found that service providers predominantly use AA1000 standards, GRI guidelines and ISAE 3000. The findings from this study suggest that standards specific to internal management/assurance purposes (IIA/ISO standards) are of greater relevance to IAFs in conducting ESG assurance and consulting engagements. It will be of interest to observe whether this divergence in usage of standards by 24

external and internal assurance providers continues into the future as integrated reporting and integrated assurance are further developed and adopted. Table 11: Standards and guidance used in ESG engagements Standard/Guidance Mean* IIA’s IPPF: International Standards for the Professional Practice 0.91 of Internal Auditing (ISPPIA) IIA’s IPPF Practice Guide: Evaluating Corporate Social 0.41 Responsibility/Sustainable Development ISAE/ASAE 3000 0.20 AccountAbility’s AA1000 standards 0.05 Social Accountability International’s SA8000 standard 0.04 GRI guidelines 0.18 ISO14000 Environmental Management 0.34 Open Compliance and Ethics Group (OCEG) standards 0.08 * 1=Standard used in ESG assurance and consulting engagements, 0 otherwise

SD 0.29 0.49 0.40 0.23 0.20 0.38 0.48 0.27

5. Discussion and conclusion 5.1 Discussion The findings from this study provide evidence of IAFs’ involvement in ESG assurance and consulting activities. In particular, the results suggest that IAFs’ ESG activities are largely focused on social and governance issues rather than environmental issues at present, with IAFs currently performing a very limited role in relation to environmental issues. While environmental issues are perceived to be of less current importance relative to social and governance issues, they are more commonly expected to increase in importance over coming years. With IAF skills and competence ratings in environmental issues also distinctly lower than for social and governance issues, respondents reported the greatest need for further development of IAFs’ skills and expertise in relation to environmental issues. The expected increase in future importance of environmental issues to the IAF is consistent with the increased public and regulatory prominence of environmental issues in recent years. In general, environmental and social issues which respondents reported the greatest level of involvement in were areas which had seen recent legislative requirements being imposed, such as the National Greenhouse and Energy Reporting Act 2007 in Australia. While it is beyond the scope of this paper to directly investigate drivers for IAFs’ involvement in ESG areas, the findings of the study are indicative of greater IAF involvement and perceived current and future importance in specific ESG issues where there have been recent regulatory attention and changes. This suggests a level of isomorphism of IAFs’ involvement in ESG areas being driven by coercive pressure (DiMaggio & Powell, 1983). While further research is required to validate this, it raises the question of whether

25

(and to what extent) IAFs’ involvement in these areas are decoupled from management systems in directing and improving ESG operations (Modell, 2007; Blewett & O’Keeffe, 2011). The substance of IAFs’ role in ESG areas and whether their involvement contributes to improved ESG governance, operations and reporting requires further attention given the finding that IAFs are more involved in ESG assurance activities than consulting activities, and prior research pointing to increasing emphasis on the consulting and value adding role of the IAF (Stewart & Subramaniam, 2010; Soh & Martinov-Bennie, 2011). The findings of this study on the current involvement of IAFs in ESG assurance and consulting are consistent with Deloitte’s (2011) characterisation of the IAF’s role in the early stages of organisations’ sustainability maturity, and perhaps indicative of respondent organisations being in the early stages of the ESG maturity model described by the IIA (2010c). In light of this, it is timely to consider the implications of the findings from this study in terms of issues and challenges for the internal audit profession and practitioners associated with expanding involvement in ESG areas, and for researchers in undertaking future research in this area. The results of this study provide further evidence the expansion of IAFs’ scope and growing demands in terms of IAF coverage and skill and expertise requirements. While there are indications that internal audit resourcing is starting to return to pre-economic downturn levels (IIA, 2013b), the expanding scope and expectations of the function raises issues of whether and how IAFs will remain adequately resourced in meeting the expanding demands of stakeholders in an increasing number of areas outside of the function’s traditional financial and compliance focus. The corollary issue that IAFs will need to address is how the function will measure and demonstrate value to various stakeholders to secure resources and cooperation from these stakeholders in expanding the IAF’s scope to include ESG issues. This is pertinent given evidence of diverging demands and perceptions of the IAF’s value of different stakeholders (PwC, 2013; Protiviti & IIA-Australia, 2013). In addition to securing financial resources, it is also imperative that IAFs and the internal audit profession address the issue of the emerging skills gap as IAFs expand their work outside their traditional skill domain (Deloitte, 2011). While the appropriate skill mix for specific ESG engagements may be obtained by supplementing the IAF with external subject-matter specialists as required in the short term, the fundamental issue of IAFs’ adaptability in upskilling to ensure their continued relevance and ability to meet stakeholders’ needs and expectations in providing effective integrated assurance and consulting needs to be addressed . With ongoing rapid change in the corporate landscape and the IAF’s role, internal auditors will increasingly need to be equipped with generic transferable skills such as critical thinking and analysis and communication skills (PwC, 2010) while developing their adaptability through continually learning and retraining themselves. 26

The IIA and the internal audit profession will need to contemplate how it might best respond to this need in updating the skills of its current member base and reconsider the educational requirements for the future generation of internal auditors. The IIA in will also need to consider how to provide continued leadership in defining areas and means by which IAFs provide value to organisations and their stakeholders. This will be arguably more difficult with ESG issues, particularly in relation to environmental and social issues, than with financial reporting and compliance as members in different organisation types and industries will likely have varying priorities. It is also the case that societal expectations and environmental issues are at varying stages of maturity in different countries. The ability to allocate limited resources in responding to diverse needs of members will be potentially challenging for the IIA, but these are vital questions that will need to be examined relatively quickly to ensure that the IIA, and indeed, the IAF remains relevant in the rapidly evolving corporate environment. Many issues that have been examined in the context of external assurance of ESG information will also need to be (re)considered in the internal audit context. For example, the results of this study show that IAFs’ pattern of usage of standards in performing ESG engagements differs from that of external assurance providers reported by prior studies (Martinov-Bennie et al., 2012). The study finds that internal audit standards are predominantly used by IAFs. This raises questions of whether they are fit for purpose for extending them into new areas of involvement, and whether there are implications for the coordination between ESG assurance providers. It has been suggested that the internal auditing standards are closely aligned with the IIRC’s integrated reporting framework (Druckman, 2013), although there is limited evidence of the applicability and adequacy of these standards in practice as IAFs expand their scope to include ESG issues. There are several issues unique to the internal audit context that will also need to be considered in relation to IAFs’ involvement in ESG areas. The communication of the outcomes of ESG assurance (and consulting) engagements and the form and content of these and their impact is of interest. It would be relevant to consider whether ratings and/or opinions for ESG engagements (where provided) impact on board and management visibility of specific ESG issues and whether subsequent actions (where taken) lead to improvements, both in terms of internal operations and external reporting. While assurance services presently dominate IAFs’ activities, it is evident that many IAFs undertake consulting services, particularly in relation to governance issues. As the importance of environmental and social issues continue to escalate, the consulting role of IAFs in relation to these areas is likely to increase. This will require a more nuanced view of internal auditing research. The various forms that 27

consulting engagements take, and tracking the effectiveness of IAFs in driving organisational change and improvement in ESG areas will require attention. The role of IAFs vis-à-vis risk management functions and management in relation to ESG issues will also require specific attention to ensure that established roles and responsibilities remain appropriate. Finally, issues examined in the prior literature from the perspective of the external auditor’s reliance on the IAF will need to be revisited and expanded upon in light of developments in integrated reporting and assurance. In particular, the development and implementation of combined assurance models and coordination amongst various assurance providers in mitigating assurance gaps (Sarens et al., 2012) is a critical issues that needs to be examined. 5.2 Conclusion Given its unique position within the organisation, prior literature has made the case for internal audit’s involvement in ESG assurance and/or consulting (Nieuwlands, 2007; Cascone et al., 2010; Deloitte, 2011; PwC, 2011; Ridley et al., 2011; IIA, 2013c), or referred to IAFs performing a role in this regard (Paape et al., 2003; Darnall et al., 2009; Leung et al., 2011; Soh & Martinov-Bennie, 2011). This paper provides initial evidence of the nature and extent of IAFs’ involvement in providing assurance and consulting on a comprehensive range of specific ESG issues. This study also investigates internal audit professionals’ perceptions of current and future importance of ESG issues to IAFs, the current levels of IAFs’ skills and competencies in performing ESG engagements, and their adequacy, in supporting the IAF’s role in these areas. The standards used to guide IAFs’ ESG assurance and consulting engagements are also examined. The study finds very high levels of IAF involvement in governance issues, perceptions that governance issues are of the greatest current importance to IAFs, and also that respondents rate highly their IAFs’ skills and competencies in terms of their ability to undertake engagements relating to governance issues. A number of governance issues are widely expected to increase in importance to IAFs over the next five years, including strategic risks, risk management and organisational culture. Respondents are moderately involved in providing assurance on social issues, and rate their IAFs as fairly competent in their ability to undertake engagements involving social issues. OHS and customer privacy are key social issues for IAFs with high current and future expected levels of importance of these issues. In addition, employee retention and turnover is expected to increase in importance in the coming years. The importance of other social issues examined in this study is expected to remain stable in the near future.

28

Environmental issues are currently perceived as less important than governance and social issues, with respondent IAFs least involved in providing assurance and consulting on environmental issues at present. However, environmental issues are most commonly expected to increase in importance to IAFs over the next five years. Respondents also reported the greatest need for further development in IAFs’ skills and competencies in relation to environmental issues. Finally, the findings indicate divergence in usage of standards by IAFs when performing ESG engagements, compared to those used by external assurance providers reported in prior studies. This study provides evidence that the internal audit profession needs to address the current perceived skills gap in their ability to provide assurance and consulting on ESG issues to ensure their continued relevance and ability to meet stakeholders’ needs and expectations in providing effective integrated assurance (Deloitte, 2011; Druckman, 2013; PwC, 2013; IIA, 2013c). This evidence should be useful to policy makers, professional bodies and practitioners. Practitioners should be able to benchmark their activities against the reported results. The findings, particularly in relation to perceived future importance of issues and adequacy of IAF skills and competencies, should provide useful input to professional bodies in developing their professional education offerings. The results also provide input to policy makers in relation to the role of the IAF in providing assurance on ESG issues, such as in the context of integrated reporting and assurance. Finally, the initial evidence of IAFs’ involvement in ESG assurance and consulting provides a platform for future research to leverage and build upon. 5.3 Limitations and future research opportunities The objective of this study was limited to providing initial evidence on the nature and extent of IAFs’ involvement in ESG assurance and consulting, including the standards used in performing these engagements, and CAEs’ and internal audit service provider partners’ perceptions on the importance and competency of the IAFs in relation to specific ESG issues. There remains a significant amount of research to be undertaken in relation to internal auditing and ESG assurance and consulting. This area is likely to continue to receive increasing attention and become more important as integrated reporting continues to develop and gain traction internationally. There are a number of limitations to consider in interpreting the findings of this study. The data reported in this study were obtained through a self-report survey and are therefore potentially affected by response bias and social desirability bias. The survey instrument was carefully worded and subjected to rigorous pilot testing, and contained assurance of the anonymity of respondents in order to mitigate these biases. Self-selection bias may also be present in the sample. More

29

importantly, it should be noted that sample of respondents was limited to a specific subset of the membership of the IIA in Australia. Caution should therefore be exercised in generalising the results of this study. This study was also limited to CAEs’ and internal audit service provider partners’ perceptions in relation to issues examined. Future research examining IAFs’ involvement from the perspective of other stakeholders, including management, audit and risk committees and sustainability committees would also be beneficial in facilitating a more holistic view on IAFs’ effectiveness in conducting these engagements, and the extent to which they are meeting the needs of various stakeholders. As noted in section 4 above, while the list of ESG issues examined is comprehensive, it was not exhaustive, and it is likely that IAFs may be involved in ESG issues not covered in this study. Future studies may examine whether this is the case. Alternative research methods, including interviews, would be useful in exploring specific issues in greater depth, such as the conduct of specific subject matter engagements, and challenges faced by IAFs as they become more involved in ESG areas. Research extending the study to other jurisdictions would also prove useful in examining the consistency of the results reported in this study. Future research may investigate the drivers, both external (e.g. institutional pressures) and internal (e.g. management support), of IAFs’ involvement in providing assurance and consulting on ESG issues. It would also be fruitful to examine the dichotomy between assurance and consulting activities of the IAF in relation to ESG areas in greater depth. This study did not provide specific definitions of both services as the aim was to point to the divergent objectives of services undertaken by IAFs rather than to identify specific activities that IAFs undertake in relation to ESG issues. It is likely that dichotomy between assurance and consulting activities is nuanced in practice with potential for both to contribute to improved ESG governance, operations and reporting. Different organisational stakeholders may also have divergent perceptions of the value in IAFs’ involvement in these activities as suggested in prior research (PwC, 2013). Qualitative research methods are particularly apposite for investigations into these issues. Finally, the interface between IAFs and external assurance providers and subject matter specialists, is a fruitful area for future research. As IAFs’ scopes expand to include assurance and consulting on ESG issues, the development of combined assurance models will be an important area to examine (Baker, 2010; Sarens et al., 2012). The ability of IAFs to supplement their skill and competency base with subject matter specialists in effectively and efficiently conducting ESG assurance and consulting engagements also warrants investigation. Further, in moving towards integrated reporting, it will

30

also be necessary to examine the responsibilities of external assurance providers, and the extent to which they are able to rely on the work of IAFs in ESG areas.

31

APPENDIX 1 Environmental issues Energy usage Materials usage Greenhouse gas emissions Hazardous waste management Water management Impacts on biodiversity Social issues Occupational health and safety (OHS) Employee retention and turnover Training and education Supply chain issues Human rights issues Community impacts and relations Donations and sponsorships Product responsibility Customer privacy Governance issues Governance structure Organisation culture Business ethics Conflicts of interest Remuneration structures Diversity and equal opportunity Stakeholder dialogue Risk management Strategic risks Corruption and bribery Anti-money laundering Fraud Whistleblower schemes

32

REFERENCES Adams, C.A. (2004), "The ethical, social and environmental reporting-performance portrayal gap", Accounting, Auditing & Accountability Journal, Vol. 17 No. 5, pp. 731-757. Adams, C.A. and Frost, G.R. (2008), "Integrating sustainability reporting into management practices", Accounting Forum, Vol. 32 No. 4, pp. 288-302. Allegrini, M., D'Onza, G., Melville, R., Sarens, G. and Selim, G.M. (2011), What's Next for Internal Auditing?, The IIA’S Global Internal Audit Survey: A Component of the CBOK Study, The Institute of Internal Auditors Research Foundation, Altamonte Springs. Allegrini, M. and Greco, G. (2013), "Corporate boards, audit committees and voluntary disclosure: evidence from Italian Listed Companies", Journal of Management & Governance, Vol. 17 No. 1, pp. 187-216. Anderson, R.J. and Svare, J.C. (2011), Imperatives for Change: The IIA’s Global Internal Audit Survey in Action, The IIA’S Global Internal Audit Survey: A Component of the CBOK Study, The Institute of Internal Auditors Research Foundation, Altamonte Springs. Aon (2010), Global Enterprise Risk Management Survey '10, Aon Corporation, Chicago. Arena, M. and Azzone, G. (2009), "Identifying Organizational Drivers of Internal Audit Effectiveness", International Journal of Auditing, Vol. 13 No. 3, pp. 43-60. ASX Corporate Governance Council (CGC) (2014), Corporate Governance Principles and Recommendations, ASX Corporate Governance Council. Auditing and Assurance Standards Board (AUASB) and Water Accounting Standards Board (WASB)/the Bureau of Meteorology (2014), Standard on Assurance Engagements ASAE 3610 and Australia Water Accounting Standard AWAS 2: Assurance Engagements on General Purpose Water Accounting Reports, Auditing and Assurance Standards Board (AUASB) and the Bureau of Meteorology. Australian Institute of Company Directors (AICD) (2011), Institutional Share Voting and Engagement: Exploring the Links Between Directors, Institutional Shareholders and Proxy Advisers, Australian Institute of Company Directors (AICD), Sydney. Bae, S. and Seol, I. (2006), "An exploratory empirical investigation of environmental audit programs in S&P 500 companies", Management Research News, Vol. 29 No. 9, pp. 573-579. Baker, N. (2010), "Equipped for Governance", Internal Auditor, Vol. 67 No. 1, pp. 28-32. Banasik, E., Barut, M. and Kloot, L. (2010), "Socially Responsible Investment: Labour Standards and Environmental, Social and Ethical Disclosures within the SRI Industry", Australian Accounting Review, Vol. 20 No. 4, pp. 387-399. Bendell, J. (2010), "World Review", Journal of Corporate Citizenship, Iss. 40, pp. 6-25. Blewett, V. and O’Keeffe, V. (2011), "Weighing the pig never made it heavier: Auditing OHS, social auditing as verification of process in Australia", Safety Science, Vol. 49 No. 7, pp. 1014-1021. Carcello, J.V., Hermanson, D.R. and Raghunandan, K. (2005), "Changes in Internal Auditing During the Time of the Major US Accounting Scandals", International Journal of Auditing, Vol. 9 No. 2, pp. 117-127. Carey, P., Simnett, R. and Tanewski, G. (2000), "Voluntary Demand for Internal and External Auditing by Family Businesses", Auditing: A Journal of Practice & Theory, Vol. 19 No. 1, pp. 37-51.

33

Cascone, J., Derose, J. and Nefedova, A. (2010), "Equipped to sustain: is your audit plan comprehensive enough to help the organization meet today's sustainability needs?", Internal Auditor, Vol. 67 No. 6, pp. 49-52. Chartres, C. and Williams, J. (2006), "Can Australia Overcome its Water Scarcity Problems?", Journal of Developments in Sustainable Agriculture, Vol. 1 No. 1, pp. 17-24. Christopher, J., Sarens, G. and Leung, P. (2009), "A critical analysis of the independence of the internal audit function: evidence from Australia", Accounting, Auditing & Accountability Journal, Vol. 22 No. 2, pp. 200-220. Clemmons, D. (2009), "Internal Auditors Need Broader Focus and Skills", Internal Auditor, Vol. 66 No. 1, pp. 13-14. Cohen, J., Krishnamoorthy, G. and Wright, A. (2004), "The corporate governance mosaic and financial reporting quality", Journal of Accounting Literature, Vol. 23, pp. 87-152. Cohen, J., Krishnamoorthy, G. and Wright, A. (2010), "Corporate Governance in the Post-SarbanesOxley Era: Auditors’ Experiences", Contemporary Accounting Research, Vol. 27 No. 3, pp. 751-786. Danker, M. (2013), "Understanding Stakeholder Activism, Managing Transparency Risk", in Crowther, D. and Aras, G. (Eds.), The Governance of Risk (Developments in Corporate Governance and Responsibility), Emerald Group Publishing Limited, pp. 33-72. Darnall, N., Seol, I. and Sarkis, J. (2009), "Perceived stakeholder influences and organizations’ use of environmental audits", Accounting, Organizations and Society, Vol. 34 No. 2, pp. 170-187. Darragh, R. (2011), "California's New Supply Chain Transparency Law", Compliance Week, Vol. 8 No. 93, pp. 12-13. Davies, J., Moxey, P. and Welch, I. (2010), Risk and reward: tempering the pursuit of profit, Accountants for Business, The Association of Chartered Certified Accountants (ACCA), London. Deloitte (2011), The role of Internal Audit in Integrated Reporting: A blend of the right ingredients, Deloitte & Touche, Johannesburg. DiMaggio, P.J. and Powell, W.W. (1983), "The Iron Cage Revisited: Institutional Isomorphism and Collective Rationality in Organizational Fields", American Sociological Review, Vol. 48 No. 2, pp. 147-160. Druckman, P. (2013). "Internal audit is the glue", available at: http://www.theiirc.org/2013/07/29/paul-druckman-internal-audit-is-the-glue/ (accessed 14 August 2013). Ernst & Young (EY) (2012), Growing Beyond: a place for integrity. 12th Global Fraud Survey, EYGM Limited. Ernst & Young (EY) and Boston College Center for Corporate Citizenship (BCCCC) (2014), Value of sustainability reporting: A study by EY and Boston College Center for Corporate Citizenship, Ernst & Young and Boston College Center for Corporate Citizenship. Esquer-Peralta, J., Velazquez, L. and Munguia, N. (2008), "Perceptions of core elements for sustainability management systems (SMS)", Management Decision, Vol. 46 No. 7, pp. 10271038. European Commission (2014), Improving corporate governance: Europe's largest companies will have to be more transparent about how they operate, European Commission, Brussels. 34

Federation of European Accountants (FEE) (2009), Discussion Paper for Auditor’s Role Regarding Providing Assurance on Corporate Governance Statements, Company Law and Corporate Governance Subgroup on Assurance on Corporate Governance Statements, Brussels. Foley & Lardner LLP (2007), Board Oversight of Corporate Culture, Foley & Lardner LLP, Chicago. Frick, K. (2011), "Worker influence on voluntary OHS management systems – A review of its ends and means", Safety Science, Vol. 49 No. 7, pp. 974-987. Frost, G. and Martinov-Bennie, N. (2010), Sustainability reporting assurance: market trends and information content, CPA Australia, Melbourne. Global Reporting Initiative (GRI) (2011), G3.1 Guidelines and Protocols, GRI, Amsterdam. Gramling, A.A., Maletta, M.J., Schneider, A. and Church, B.K. (2004), "The Role of the Internal Audit Function in Corporate Governance: A Synthesis of the Extant Internal Auditing Literature and Directions for Future Research", Journal of Accounting Literature, Vol. 23, pp. 194-244. Green, W. and Li, Q. (2012), "Evidence of an expectation gap for greenhouse gas emissions assurance", Accounting, Auditing & Accountability Journal, Vol. 25 No. 1, pp. 146-173. Haque, S. and Deegan, C. (2010), "Corporate Climate Change-Related Governance Practices and Related Disclosures: Evidence from Australia", Australian Accounting Review, Vol. 20 No. 4, pp. 317-333. Holt, T.P. and DeZoort, T. (2009), "The Effects of Internal Audit Report Disclosure on Investor Confidence and Investment Decisions", International Journal of Auditing, Vol. 13 No. 1, pp. 61-77. Institute of Social and Ethical Accountability (AccountAbility) (2008), AA1000 Assurance Standard (AA1000AS) 2008, AccountAbility, London, Washington D.C. Integrated Reporting Committee of South Africa (IRC) (2011), Framework for integrated reporting and the integrated report: Discussion paper, Integrated Reporting Committee (IRC) of South Africa. International Auditing and Assurance Standards Board (IAASB) (2013), International Standard on Auditing (ISA) 610 (Revised 2013) Using the Work of Internal Auditors, International Federation of Accountants (IFAC), New York. International Integrated Reporting Council (IIRC) (2011). http://www.theiirc.org/the-iirc/ (accessed 24 May 2011).

"The

IIRC",

available

at:

International Integrated Reporting Council (IIRC) (2013), The International Framework, International Integrated Reporting Council (IIRC). Ioannou, I. and Serafeim, G. (2012), "The Consequences of Mandatory Corporate Sustainability Reporting.", Working Paper 11-100, Harvard Business School, Boston. Jackson, R.A. (2013), "Internal Audit in 2020", Internal Auditor, Vol. 70 No. 6, pp. 34-41. Jones, M.J. and Solomon, J.F. (2010), "Social and environmental report assurance: Some interview evidence", Accounting Forum, Vol. 34 No. 1, pp. 20-31. Kaptein, M. (2008), "Developing a Measure of Unethical Behavior in the Workplace: A Stakeholder Perspective", Journal of Management, Vol. 34 No. 5, pp. 978-1008.

35

Kauffmann, C., Less, C.T. and Teichmann, D. (2012), "Corporate Greenhouse Gas Emission Reporting: A Stocktaking of Government Schemes", OECD Working Papers on International Investment, No. 2012/1, OECD Investment Division, available at: www.oecd.org/daf/investment/workingpapers (accessed 15 December 2013). Kendall, M. (2013), "Drought and its Role in Shaping Water Policy in Australia", in Schwabe, K., Albiac, J., Connor, J. D., Hassan, R. M. and Meza González, L. (Eds.), Drought in Arid and Semi-Arid Regions, Springer Netherlands, pp. 451-467. Kimbrough, R.L. and Componation, P.J. (2009), "The Relationship Between Organizational Culture and Enterprise Risk Management", Engineering Management Journal, Vol. 21 No. 2, pp. 1826. KPMG (2011), Global Anti-Bribery and Corruption Survey, KPMG. KPMG (2012), A survey of fraud, bribery and corruption in Australia & New Zealand 2012, KPMG. Leung, P., Cooper, B.J. and Perera, L. (2011), "Accountability structures and management relationships of internal audit: An Australian study", Managerial Auditing Journal, Vol. 26 No. 9, pp. 794-816. Leung, P., Cooper, B.J. and Robertson, P. (2004), The Role of Internal Audit in Corporate Governance, RMIT University Press, Melbourne. Mahoney, B. (2013), Expect More Big FCPA Cases In 2014: DOJ, SEC Officials, Law360, available at: http://www.law360.com/articles/489940/expect-more-big-fcpa-cases-in-2014-doj-secofficials (accessed 7 April 2014). Martinov-Bennie, N., Frost, G. and Soh, D.S.B. (2012), "Assurance on Sustainability Reporting: State of Play and Future Directions", in Jones, S. and Ratnatunga, J. (Eds.), Contemporary Issues in Sustainability Accounting, Assurance and Reporting, Emerald Group Publishing Limited, Bradford, pp. 267-283. Martinov-Bennie, N. and Hoffman, R. (2012), "Greenhouse Gas and Energy Audits under the Newly Legislated Australian Audit Determination: Perceptions of Initial Impact", Australian Accounting Review, Vol. 61 No. 22, pp. 195-207. Millman, G., J. (2013, 19 November 2013). "Internal Auditors’ Skills Not Up To New Job Demands", available at: http://blogs.wsj.com/riskandcompliance/2013/11/07/internal-auditors-skillsnot-up-to-new-job-demands/ (accessed 15 December 2013). Mock, T.J., Strohm, C. and Swartz, K.M. (2007), "An Examination of Worldwide Assured Sustainability Reporting", Australian Accounting Review, Vol. 17 No. 41, pp. 67-77. Modell, S. (2007), "Managing accounting change", in Hopper, T., Northcott, D. and Scapens, R. W. (Eds.), Issues in Management Accounting, Pearson, London, pp. 335-355. NetBalance Foundation (NetBalance) (2008), Resource Efficiency & Reporting, Net Balance Foundation Limited. Nieuwlands, H. (2007), "Auditing Sustainable Development", Internal Auditor, Vol. 64 No. 2, pp. 9193. O'Dwyer, B., Owen, D. and Unerman, J. (2011), "Seeking legitimacy for new assurance forms: The case of assurance on sustainability reporting", Accounting, Organizations and Society, Vol. 36 No. 1, pp. 31-52.

36

Owen, D.L., Swift, T.A., Humphrey, C. and Bowerman, M. (2000), "The new social audits: accountability, managerial capture or the agenda of social champions?", European Accounting Review, Vol. 9 No. 1, pp. 81 - 98. Paape, L., Scheffe, J. and Snoep, P. (2003), "The Relationship Between the Internal Audit Function and Corporate Governance in the EU – a Survey", International Journal of Auditing, Vol. 7 No. 3, pp. 247-262. PricewaterhouseCoopers (PwC) (2009), PricewaterhouseCoopers, Australia.

Auditing

PricewaterhouseCoopers (PwC) (2010), State PricewaterhouseCoopers (PwC) LLP.

of

risk the

culture:

internal

audit

Art

or

science?,

profession

study,

PricewaterhouseCoopers (PwC) (2011), Internal Audit 2.0: Sustainability, PricewaterhouseCoopers LLP. PricewaterhouseCoopers (PwC) (2012), Fortifying your defenses: The role of internal audit in assuring data security and privacy, PricewaterhouseCoopers LLP. PricewaterhouseCoopers (PwC) (2013), PricewaterhouseCoopers LLP.

State

of

the

internal

audit

profession

study,

Principles for Responsible Investment (PRI) Initiative (2011), Offline Survey (Questions, answer options and notes). Reporting and Assessment survey, 2011, Principles for Responsible Investment (PRI) Initiative, London. Principles for Responsible Investment (PRI) Initiative (2013), Integrated Analysis: How Investors are Addressing Environmental, Social and Governance Factors in Fundamental Equity Valuation, Principles for Responsible Investment (PRI) Association, London. Protiviti (2008), Environmental Sustainability: The Head of Internal Audit's Responsibility, Protiviti. Protiviti and The Institute of Internal Auditors Australia (IIA Australia) (2009), Achieving High Performance in Internal Audit, Sydney. Protiviti and The Institute of Internal Auditors Australia (IIA Australia) (2010), Achieving High Performance in Internal Audit, Sydney. Protiviti and The Institute of Internal Auditors Australia (IIA-Australia) (2011), Achieving High Performance in Internal Audit, Protiviti Pty Ltd, Sydney. Protiviti and The Institute of Internal Auditors Australia (IIA-Australia) (2013), Achieving High Performance in Internal Audit, Protiviti Pty Ltd, Sydney. Ridley, J., D'Silva, K. and Szombathelyi, M. (2011), "Sustainability assurance and internal auditing in emerging markets", Corporate Governance, Vol. 11 No. 4, pp. 475-488. Robson, L.S., Macdonald, S., Gray, G.C., Van Eerd, D.L. and Bigelow, P.L. (2012), "A descriptive study of the OHS management auditing methods used by public sector organizations conducting audits of workplaces: Implications for audit reliability and validity", Safety Science, Vol. 50 No. 2, pp. 181-189. Rosenhouse, M.A. (2012), "SEC Adopts Final Rule on Disclosing Use of Conflict Minerals", SEC Accounting Report, Vol. 38 No. 11, pp. 1-5. Sarens, G., De Beelde, I. and Everaert, P. (2009), "Internal audit: A comfort provider to the audit committee", The British Accounting Review, Vol. 41 No. 2, pp. 90-106.

37

Sarens, G., Decaux, L. and Lenz, R. (2012), Combined Assurance: Case Studies on a Holistic Approach to Organizational Governance, The IIA Research Foundation, Altamonte Springs. Scholer, K. and Conway-Hatcher, A.J. (2013), The government speaks: FCPA enforcement is here to stay, Lexology, available at: http://www.lexology.com/library/detail.aspx?g=9258aab6-d5a743b7-ac97-59ce5a1c38fd (accessed 7 April 2014). Simnett, R., Nugent, M. and Huggins, A.L. (2009), "Developing an International Assurance Standard on Greenhouse Gas Statements", Accounting Horizons, Vol. 23 No. 4, pp. 347-363. Smith, M.L., Drake, M.S. and Shaub, M.K. (2010), "Pivotal change in US policy: how the SarbanesOxley Act affected internal auditing and its relationship to external auditing", International Journal of Accounting, Auditing and Performance Evaluation, Vol. 6 No. 4, pp. 346-367. Soh, D.S.B. and Martinov-Bennie, N. (2011), "The internal audit function: Perceptions of internal audit roles, effectiveness, and evaluation", Managerial Auditing Journal, Vol. 26 No. 7, pp. 605-622. Spira, L.F. and Page, M. (2003), "Risk management: The reinvention of internal control and the changing role of internal audit", Accounting, Auditing & Accountability Journal, Vol. 16 No. 4, pp. 640-661. Stewart, J. and Subramaniam, N. (2010), "Internal audit independence and objectivity: emerging research opportunities", Managerial Auditing Journal, Vol. 25 No. 4, pp. 328-360. The Institute of Chartered Accountants in Australia (ICAA) and Kiewa Consulting (Kiewa) (2011), Integrating sustainability into business practices: A Case Study Approach, The Institute of Chartered Accountants in Australia (ICAA) and Kiewa Consulting Pty Ltd, Sydney. The Institute of Internal Auditors (IIA) (2008), Auditing Corporate Responsibility: Today's internal auditor has an important role to play in ensuring CSR policies are successful, IIA Insight, The Institute of Internal Auditors (IIA), Altamonte Springs. The Institute of Internal Auditors (IIA) (2009), IPPF - Practice Guide: Auditing External Business Relationships, The Institute of Internal Auditors (IIA), Altamonte Springs. The Institute of Internal Auditors (IIA) (2010a), The 2010 IIA’s Global Internal Audit Survey: A Component of the CBOK Study, The IIA Research Foundation, Altamonte Springs. The Institute of Internal Auditors (IIA) (2010b), A Culture of Risk, Tone at the Top, The Institute of Internal Auditors (IIA), Altamonte Springs. The Institute of Internal Auditors (IIA) (2010c), IPPF - Practice Guide: Evaluating Corporate Social Responsibility/Sustainable Development, The Institute of Internal Auditors, Altamonte Springs. The Institute of Internal Auditors (IIA) (2012a), International Standards for the Professional Practice of Internal Auditing, International Professional Practices Framework. Altamonte Springs, The IIA Research Foundation. The Institute of Internal Auditors (IIA) (2012b), IPPF - Practice Guide: Auditing Privacy Risks, The Institute of Internal Auditors, Altamonte Springs. The Institute of Internal Auditors (IIA) (2012c), IPPF - Practice Guide: Evaluating Ethics-related Programs and Activities, The Institute of Internal Auditors (IIA), Altamonte Springs. The Institute of Internal Auditors (IIA) (2012d), IPPF - Practice Guide: Integrated Auditing, The Institute of Internal Auditors (IIA), Altamonte Springs.

38

The Institute of Internal Auditors (IIA) (2013a), 2013: Time to Seize the Opportunity (Global Report), The Pulse of the Profession, The Institute of Internal Auditors (IIA) Audit Executive Center, Altamonte Springs. The Institute of Internal Auditors (IIA) (2013b), Defining Our Role in a Changing Landscape (North American Report), The Pulse of the Profession, The Institute of Internal Auditors (IIA) Audit Executive Center, Altamonte Springs. The Institute of Internal Auditors (IIA) (2013c), Integrated Reporting and the Emerging Role of Internal Auditing, Flash Alert, The Institute of Internal Auditors (IIA) Audit Executive Center, Altamonte Springs. Treviño, L.K., Weaver, G.R. and Reynolds, S.J. (2006), "Behavioral Ethics in Organizations: A Review", Journal of Management, Vol. 32 No. 6, pp. 951-990. Tucker, G. (2013). "Are Australian organisations ready for new Privacy laws?", available at: http://www.businessspectator.com.au/article/2013/12/10/technology/are-australianorganisations-ready-new-privacy-laws (accessed 15 December 2013). Turker, D. and Altuntas, C. (Forthcoming, 2014), "Sustainable supply chain management in the fast fashion industry: An analysis of corporate reports", European Management Journal, available at: http://dx.doi.org/10.1016/j.emj.2014.02.001 (accessed 7 April 2014). Tyson, L.D.A. (2014), The Challenges of Running Responsible Supply Chains, Economix, available at: http://economix.blogs.nytimes.com/2014/02/07/the-challenges-of-running-responsiblesupply-chains/ (accessed 7 April 2014). United Nations Environment Programme (UNEP), KPMG, Global Reporting Initiative (GRI) and Unit for Corporate Governance in Africa (UCGA) (2010), Carrots and Sticks - Promoting Transparency and Sustainability, KPMG Advisory N.V., United Nations Environment Programme, Global Reporting Initiative, Unit for Corporate Governance in Africa. Water Accounting Standards Board (WASB) (2009), Water Accounting Conceptual Framework for the Preparation and Presentation of General Purpose Water Accounting Reports, Commonwealth of Australia, Canberra. Water Accounting Standards Board (WASB) (2012), Australian Water Accounting Standard 1: Preparation and Presentation of General Purpose Water Accounting Reports, Commonwealth of Australia (Bureau of Meteorology). Weidenmier, M.L. and Ramamoorti, S. (2006), "Research Opportunities in Information Technology and Internal Auditing", Journal of Information Systems, Vol. 20 No. 1, pp. 205-219.

39