Corporate social responsibility and internal audit : what is the role of IA, and what opportunities for improvement exist for IA in the CSR process of an organization?

(1)

Corporate Social Responsibility and Internal Audit:

What is the role of IA, and what opportunities for improvement exist for IA in the CSR process of an organization?

Thesis - Executive Internal Audit Program 2012 – 2014

Author: Jamila Geene

Student number: 6020412

Date: 08-08-2014

(2)

Acknowledgements

In 2012 I started the Executive Internal Audit Program at the University of Amsterdam. With enthusiasm and pride I present my final thesis on a topic I hold close to my heart: Corporate Social Responsibility. This thesis marks the end of a wonderful yet challenging two year experience, during which various people have motivated and supported me. I therefore would like to take this moment to express my utmost appreciation and extreme gratitude to these wonderful people.

First of all, I would like to thank Bob van Kuijck, Annelies Vethman and my thesis coach, Jan Laan, for their guidance, useful suggestions and devoted feedback. Secondly, I would like to thank all the participants for partaking in this research. I much appreciate you for your time and your openness during the interviews which have led to these interesting and valuable results. Furthermore, I would like to thank my classmates for making this experience a wonderful one. Jack, Ingrid, Gijs and Friso, special thanks for the fun times, without it this journey would have been a lot more challenging.

Also, I would like to express my heartfelt gratitude to my beloved parents, brother, extended family and all my other wonderful friends for their support and compassion. And to my love Johan, there are no words to describe how thankful I am for the patience, love and support that you have provided me throughout this journey. Thanks for believing in me…in us.

I hope you will enjoy reading this thesis.

Jamila Geene

(3)

Executive Summary

Corporate Social Responsibility (CSR) is defined as the way companies integrate social, environmental and economic aspects in a transparent and responsible manner into their values, culture, decision, strategy and operations, and therewith contribute to the society. CSR is becoming increasingly important in the business world as investors and regulators are increasingly demanding greater visibility into what organizations are doing. As a result organizations need IA to take a broader mandate within the organization. Far from its traditional compliance roots, IA is increasingly being asked to not only provide operational business insights to the organization, but also to serve as strategic advisors – helping the organization to address today’s key business risks. Also, as strategic advisors they are requested to help in preparing for critical emerging risks, risks that the organization knows are approaching more quickly than ever before based on business strategy and continued global expansion. Amongst the top of ten of the most important emerging risks that IA is tracking is climate change and sustainability.

In 2011 the IIA and the NBA published a report based on empirical research on the role of IA in the CSR process. That research however was only based on results provided by IA functions and largely based on surveys as a method of research. In this research their findings are critically tested by addressing a different point of view, that of external auditors providing external verification on these CSR reports, and by using a different research method. Through interviewing subject matter experts (external auditors) and by performing a multiple case study research, this study aims to contribute to the awareness of internal auditors on their possible role in the CSR process, and on opportunities to add value and to improve the CSR process within their organizations. As a result, the following research question is answered: What is the role of IA, and what opportunities for improvement exist for IA in the CSR process of an organization?

Based on the findings of this research it can be concluded that leading IA functions are involved in the CSR process through assurance, and consultancy roles. Building on extant literature, this research concludes that the actual role attained by IA is indeed highly dependent upon the level of maturity of the CSR process. The role of IA tends to shift from a consultancy, and at times even a managing role, to a more assurance providing role as the CSR process matures from initial to optimizing. Activities that are decreasingly performed, as the CSR process matures, include advising on the set up and implementation of the CSR process. These activities make way for the following assurance providing activities: auditing the CSR report on scope and quality, and auditing the process of translating the strategy to the policies, procedures, models, management cycle (PDCA), and the final report. Through the development of the maturity model in this research, awareness is created on the possible activities to be performed by IA at various levels of maturity.

In contrast to the findings in the research by NBA and IIA, this research highlights that the involvement by IA in the CSR process is generally limited to its assurance role by performing data-centric and system-oriented audits. A role that is imposed by the external auditor and subsequently passively executed by IA. Also, this research concludes that only 10-15% of the IA functions are involved in the CSR process. The drastic differences between these findings with that of the IIA and NBA are either the result of less involvement by IA over the years, participation of IA functions that are front-runners in the area, or by the research method chosen by the IIA and the NBA. Either way these results directly highlight the most significant improvement points resulting from this research: increase the active involvement of IA in the CSR process, and increase the performance of consultancy related activities in the CSR process. Additional improvement points for IA include: improving IA’s CSR knowledge and skills; increasing the advisory role of IA; ensuring earlier involvement in the CSR process. Lastly, based on the field research conducted it was concluded that the performance of system-oriented audits by IA needs to increase and improve. The urge for this improvement lies in the fact that in the CSR process data is generated and extracted from various independent systems, which are often still Microsoft Excel based or in the beginning development stages. Combining this with the lower level of maturity of the CSR process, and the low frequency of data retrieval, it creates one of the biggest current risks in the CSR audit process. To reduce this risk it is important for IA to perform both data-centric as system-oriented audits to determine the reliability of the data and the systems used.

(4)

List of abbreviations

CAE: Chief Audit Executive

CSR: Corporate Social Responsibility

EA: External Audit

ERM: Enterprise Risk Management

IA: Internal Audit

IPPF: International Professional Practice Framework ISA: Internal Standard on Auditing

KPI: Key Performance Indicator

PDCA: Plan, Do, Check, Act

SME: Subject Matter Expert

SMS: Sustainability Management System

Institutions

CAR: Dutch Council for Annual Reporting

COSO: Committee of Sponsoring Organizations of the Treadway Commission GRI: Global Reporting Initiative

IAASB: International Auditing and Assurance Standards Board IIA: Institute of Internal Auditors

NBA: Dutch Institute of Chartered Accountants NIVRA: Royal Dutch Institute of Charted Accountants

List of tables

Table 2-1: Consulting and Assurance activities for IA

Table 2-2: Activities for IA to ensure good collaboration with EA Table 3-1: Subject matter experts

Table 3-2: Case Profiles

Table 3-3: Technique(s) applied to enhance credibility Table 3-4: Interviewees per case

Table 4-1: IA’s current activities in the CSR process Table 4-2: Role of IA per maturity level

Table 4-3: Collaboration procedures IA and EA Table 4-4: Risks in auditing the CSR process Table 4-5: Improvement points for IA

List of figures

Figure 1-1: Research Model

Figure 2-1: Sustainability Management System

Figure 2-2: COSO-CSR model

(5)

1 Introduction

1.1 Background

Considerable interest in Corporate Social Responsibility (CSR) has appeared in academic literature over the past decade as companies struggle to balance short-term financial viability with long-term strategic goals, and to build and preserve shareholder value while enabling future generations to meet their own needs. The literature has overall concluded that businesses should integrate CSR principles into corporate strategic policies and business processes. This integration is justified by the fact that it affects the triple-bottom line and long-term proﬁtability of a business and should, therefore, be treated as strategic assets of the business (see, e.g., Elkington, 1997; Grant, 1997; Russo and Fouts, 1997; Johnson and Scholes, 1993). Stakeholders expect boards and management to accept responsibility and implement strategies and controls to manage their impact on society and the environment, to engage stakeholders in their endeavors, and to inform the public about their results. As companies are increasingly being evaluated on not only their financial performance, but also non-financial results related to environmental and social performance, reporting on CSR at the corporate level has broadened widely and is fast becoming a critical element of reporting for listed and large non-listed companies at the global level (see, e.g., KPMG, 2008; Owen, 2006; Kolk, 2004, 2003, 2001; Kolk et al., 2001; Gray et al., 2001).

The amount of regulations on environmental and social aspects is increasing correspondingly. Regulators are near certain to create an environment in which reporting on sustainable matters will not only become the right thing to do or the smart thing to do, but also the only thing to do [PWC, 2009]. Companies are preparing to take on these mandatory and voluntary regulations, and associated challenges, in a proactive manner. The proliferation of regulation and voluntary standards has made CSR management a complex endeavor for firms in all industries.

As the social relevance of CSR in large organizations is expected to grow and as companies are continuously aligning their strategies to adapt to the increased relevance of CSR in their day-to-day business practices, the involvement of internal audit (IA) in CSR has also increased steadily in the last decade [IIA and NBA, 2011]. Furthermore, IA is expected to give increasing priority to the work field of CSR in the future as well. In this, IA performs activities with regard to both assurance and consultancy roles when it comes to CSR. The Institute of Internal Audits (IIA) states that these activities include understanding the risks and controls related to CSR objectives. In addition, the Chief Audit Executive (CAE) should plan to audit, facilitate control self-assessments, verify results, and/or consult on the various subjects where appropriate [IIA, 2010].

Extant literature exploring the role of IA with regard to CSR is available [e.g. Nieuwlands, (2006)]. However, only two research studies [Ambaum (2007); IIA and NBA (2011)] have empirically examined the role of IA with relevance to CSR in order to identify best practices in the Netherlands and to examine the actual role IA fulfills in CSR reporting. In their research studies they approached and examined IA functions of respectively 29 and 37 (out of a total of 54) large Dutch firms which have distributed a CSR report, or have visibly integrated CSR in their annual financial reports. The results indicate that 30-40% of the IA functions participating in their research are involved through either an assurance role, consultancy role of both in the CSR process. And that this involvement is only to increase in the coming years. Furthermore, the results conclude that IA adds significant value in the CSR process through a broad scope of activities including taking on a consultancy role. Both the research studies from Ambaum (2007) and the IIA and NBA (2011) however, have inferred conclusions based on results provided solely by IA, and through surveys as the main research method.

(8)

Given the professional skepticism an internal auditor is required to have in its work, this research critically examines the findings in the previous research studies by addressing a different point of view, that of external audit (EA) providing external verification on these CSR reports, and by using a different research method. Through this, it aims to identify the areas of improvement for IA, from both IA as EA perspective, when it comes to the CSR as an audit object.

1.2 Problem Definition and Research Questions

The following eight sub-questions have been constructed in this research: 1. What is the CSR process?

2. What roles can the IA function of organizations play in the CSR process?

3. How can the external auditor and the IA function of an organization work together in the CSR process? 4. What are the opportunities for improvement for IA in the CSR process?

These four sub-questions will depict the theoretical possibilities based on a literature review performed in Chapter 2. The following four sub-questions depict the actual situation in the business, and are answered by means of subject matter interviews and case study research.

5. How is the CSR process within organizations structured? 6. What roles does IA attain in the CSR process?

7. How do the external auditor and IA function of an organization work together in the CSR process? 8. What are the improvement areas for IA in the CSR process?

Based on these eight sub-questions this study aims to answer the following main research question:

What is the role of IA, and what opportunities for improvement exist for IA in the CSR process of an organization?

The results of this research further contribute to the awareness of internal auditors about their opportunities to add value and improve the CSR process within an organization.

1.3 Research Design

This research can be classified as an exploratory research that maintains a theory-testing approach. A comprehensive visualization of the research design used to answer the research questions defined above is shown in figure 1-1.

First, various literature, websites and research studies are examined. Reference is made to Chapter 6, which provides a list of literature used. Then, the role of IA and improvement points for IA are identified and discussed by means of subject matter interviews with two accountancy firms (the biggest in the field of CSR audits in the Netherlands). In order to test the actual role of IA in the CSR process and to reflect on the improvement points provided by EA a multiple case study research was performed. This research design was chosen as appropriate on the basis of theoretical replication [Yin, 2009]. To ensure convenience and efficiency, a small number of four cases are observed. The four companies selected all have CSR reports that are externally verified; are of similar size; have an IA function that plays a role in the CSR process; and have an external auditor that relies on the work of the IA function when it comes to the CSR process.

(9)

Figure 1-1: Research Model

Triangulation is achieved during data collection as data is collected through the use of CSR reports, interviews with the IA functions and interviews with the CSR audit departments of the EA firms. The selected companies are electronically approached, supported by an introduction email. In order to contact the external auditors and internal auditors, the professional and social network of colleagues and J.J.M. Laan (lecturer of the course Management Accounting at University of Amsterdam) is used.

1.4 Thesis outline

Chapter 2 of this thesis contains a literature review on the topic of CSR in general, and CSR in the Netherlands in particular. Through the examination of literature, it identifies the structure of the CSR process, the roles IA can play when it comes to CSR, and on how EA and IA can work together in this process. This is followed by Chapter 3, which elaborates on the research design. In Chapter 4, the findings of this research are presented and analyzed. Chapter 5 concludes on the role of IA and the opportunities for IA for improving the CSR process within an organization and it also discusses limitations of this research and recommendations for future research. Please refer to Chapter 6 for a list of all literature used as part of this research.

(10)

2 Literature Review

The purpose of this thesis is to identify what the role of IA is in the CSR process, and which opportunities for improving the CSR process exist for the IA function within an organization. In order to answer this question, some background literature is presented in this chapter to expand knowledge on the topic of CSR in general and CSR in the Netherlands in particular. In order to answer sub-questions 1-4 formulated in Chapter 1 it also discusses existing literature on the structure of the CSR process, the roles IA can play when it comes to CSR and on the relationship between EA and IA with regard to this process.

2.1 Corporate Social Responsibility

2.1.1 Definition of CSR

Climate change, natural resource depletion, pollution, increased waste, and sweatshops are environmental and social events that are changing people’s behavior, requirements and business practices. As a result of these events stakeholders are increasingly focusing on environmental, social and governmental issues, while expecting a better performance and more disclosure. Stakeholders continuously require transparency and accountability. This is in accordance with the stakeholder approach that believes that companies are responsible to all groups that can be affected or are affected by their business, and should therefore balance the large quantity of interest of these stakeholders [Freeman, 1984; Geene, 2011].

In the beginning organizations denied any responsibility to these societal issues, however increasing regulations relating to the environment and the workplace are leading organizations to adopt a policy-based compliance approach to these issues as a cost of doing business. An increasing amount of organizations are even accepting these new responsibilities as part of daily business operations. They replied by adopting a managerial approach and are consequently embedding the societal issues into the organization’s core business processes, resulting in new practices and management systems. Global leaders are even moving at a faster pace; acknowledging the strategic approach in which the societal issues are integrated into the core business processes as they realize it provides a competitive edge [Zadek, 2004]. In response, organizations are developing performance targets, measurement systems, and reporting systems related to CSR strategies.

In short, Corporate Social Responsibility (CSR) is becoming an increasingly crucial concept for businesses today. The concept of CSR (“Maatschappelijk Verantwoord Ondernemen” in Dutch) however, is one that has been defined in existing literature in manifold. In literature it appears that there is not one unequivocal definition of CSR in the literature [McWilliams et al, 2006; IIA and NBA, 2011]. The reason for the diversity in the definition of CSR is the fact that CSR interfaces with various disciplines resulting in it being viewed through different perspectives [McWilliams, Siegel and Wright, 2006]. CSR is a topic that is often related with concepts such as Sustainability, Triple Bottom Line, and Corporate Citizenship. In this research the term Corporate Social Responsibility will be used. Essential in all these definitions is the statement that a company must look beyond its own economic interests, as it should be profitable for both the company and the society.

IIA noted that CSR can be interpreted as the way companies integrate social, environmental and economic aspects in a transparent and responsible manner in their values, culture, decision, strategy and operations, and therewith contribute to the society [IIA, 2010]. For this research the definition by IIA is used. This definition connects the three dimensions social, environmental and economic and accentuates how these three dimensions should be adapted to the needs and expectations of the stakeholders of a company.

(11)

2.1.2 CSR reporting in the Netherlands

To demonstrate their stance in being socially responsible, both listed and large non-listed companies at global level started publishing CSR reports in addition to their financial reports [KPMG, 2008; Owen, 2006; Kolk, 2004, 2003, 2001; Kolk et al., 2001; Gray et al., 2001]. These reports are based on the three elements: social, environmental and economic performance. A research by KPMG in 2008 stated that in 1999 roughly 39% of the Global Fortune 250 companies reported on their social, ecological and economic activities, while this number augmented to 80% in 2008.

The Global Reporting Initiative (GRI) explained the purpose of a CSR report as follows: “Sustainability reporting is the practice measuring, disclosing and being accountable for organization performance towards the goal of sustainable development” [GRI, 2002]. A CSR report should provide a balanced and reasonable representation of the sustainability performance of the reporting organization – including both positive and negative contributions [Nieuwlands, 2006].

As the importance of CSR has increased globally, the European government has explored regulatory approaches to CSR reporting. In the Netherlands however, CSR reporting remains voluntary and is not enforced by legislative requirements. Nevertheless, there are some compulsory CSR reporting prescriptions for annual reports. In the Dutch Civil code article 2:391 section 1 states that companies are required to give some information (financial and non-financial) about the environment, employees and risks in their annual reports. It is mandatory for all listed companies independent of their size and for all large non-listed companies. Further specification on what kind of information can be disclosed in relation to a company’s CSR is given in the Annual Reporting Guideline 400 (in Dutch referred to as “Het jaarverslag”) published by the Dutch Council for Annual Reporting (CAR). CAR also published the Guide to Sustainability Reporting (in Dutch called the “Handreiking voor Maatschappelijke Verslaggeving”).

The most important institution in the field of international guidelines for reporting is currently the GRI. GRI is an international, multi-stakeholder process and independent institution founded in 1977 whose function is to develop and disseminate global sustainability reporting guidelines. The GRI framework provides the principles and indicators that an organization can use to report on its performance in the field of measuring people, planet and profit. More than 450 multinationals across 40 countries adhere to the GRI guidelines, including the vast majority of the companies listed at the AEX - a stock market index composed of Dutch companies that trade on NYSE Euronext Amsterdam. Initially CSR reports were fragmented and covered only certain aspects, based on the purpose of these reports, however, through the use of the GRI reporting guidelines the quality of the reports has increase significantly in de first years of the new millennium [Nieuwlands, 2006].

Standard guidelines may not meet all information needs of all users, and therefore companies should always use a structured dialogue with stakeholders to further determine specific information needs. The guidelines AA1000, AA1000APS (Accountability principle standards) and AA1000SES (stakeholder engagement standards) in particular, are developed specifically for the accountability process in which the dialogue with stakeholders has an important place. The outcomes of the dialogue define the contents of the CSR report and topics to be determined within the company and highlights actions that must be taken. The guidelines therefore place no explicit demands on the contents of the CSR report.

In the Netherlands the number of companies that published CSR reports has gradually increased over recent years, as well as the number of independently verified CSR reports, however externally verified CSR reports are still not common practice in the Netherlands. However, a recent article by KPMG shows that getting external assurance on CSR reports is becoming standard practice. The tipping point has been crossed, with over 59% of

(12)

the world of the world’s largest companies (Global 250) now investing in CSR assurance (2012: 46%). As the largest companies tend to set the trend, it can be presumed that soon the other companies will follow [KPMG, 2013]. However, even when these reports are externally verified the level of assurance provided by the auditor is mostly limited (i.e. a moderate level of assurance) [Prikken, 2010].

2.2 CSR process

The board and senior management of an organization have overall responsibility for the effectiveness of governance, risk management and internal control processes. As part of these responsibilities it is also accountable for guarantying that CSR objectives are established, risks are managed, performance is measured, and activities are appropriately monitored and reported. Furthermore, management is responsible for ensuring that the organization’s CSR principles are communicated, understood, and integrated into decision-making processes [IIA, 2010]. Management however, has trouble ensuring that CSR activities are coordinated and aligned with strategic initiatives and principles throughout the organization, with appropriate risk/reward decisions being made. Organizations realized that they need a management system, structuring formerly scattered elements of CSR information gathering and repairing missing links between them. An advantage of a management system is that it sets an auditable framework for assuming economic, environmental, and social responsibility in a systematic, transparent, consistent, and credible manner.

In his book “Sustainability and Internal Auditing” Nieuwlands (2006) informs that setting up a sustainability management system (SMS) is the best approach to implementing CSR in an organization. The SMS described contains the following steps as illustrated in figure 2-1:

Figure 2-1: Sustainability Management System (modified by author) In the research by the IIA and NBA in 2011 the COSO-model is used as the control model for CSR. It is argued that even though initially used by organizations to control for activities and processes required for meeting the organizations strategic goals and objectives, this model can be applied to control for CSR activities and processes required to meet and organization’s CSR goals and objectives as well [IIA and NBA, 2011]. The COSO-CSR model as described in the IIA and NBA research is illustrated in figure 2-2 [COSO, 2012].

(13)

Figure 2-2: COSO-CSR model (modified by author) Both models can be seen as a loping process in which continuous improvement is strived for and the same elements are covered in both models. However, based on the fact that Nieuwlands’ SMS is based on the widely accepted model for management systems, namely Dr. W. Edwards Deming’s Plan-Do-Check-Act (PDCA) cycle, which consists out of the four steps Plan, Do, Check, and Act, the detailed SMS is expected to be used in practice. The following proposition is formulated to be tested in this research:

P1: The CSR process within an organization is organized according to the PDCA cycle and therefore strongly

resembles Nieuwlands’ Sustainability Management System.

2.2.1 Sustainability Management System

The start of the management cycle as described by Nieuwlands is (re)formulating a CSR policy and strategy that is appropriate to the nature, scale and CSR impacts of the organization’s activities, products or service and are consistent with the organizational strategic plan and other organizational policies. To ensure accuracy of the documents both the strategy and the policy are to be periodically reviewed and revised if necessary.

The next step includes of a planning phase, a risk management phase, and the setup of information systems and a CSR management program. The planning phase of the management cycle links the CSR policy and strategy to predefined objectives and targets. Furthermore, the organization defines roles and responsibilities of employees based on the CSR policy and strategy. Adequate resources are made available to employees to realize these roles and responsibilities and relevant objectives and targets. In order to identify aspects that have significant impacts on CSR performance, the organization establishes and maintains procedures to identify aspects for the entire lifecycle of a product over which the organization has direct influence. CSR presents significant risks and opportunities for many organizations and CSR objectives are therefore included in the organization’s risk managementi process which is often based on the COSO-ERM frameworkii. As part of the risk management phase, the board and management are responsible for performing a risk assessment and determining what is important to their organization and the controls they will implement to manage those risks. It is also vital for an organization to set up a CSR management information system, designed to provide adequate, reliable and timely information to the organization so it can control the SMS and monitor actual performance against objectives and targets. Finally, a CSR management program needs to be set up for achieving its objectives and targets. The program should include the designation of responsibility for achieving objectives and targets at each relevant function and level of the organization [IIA, 2010; Nieuwlands, 2006].

(14)

The third step regards structure and responsibilities, training and awareness, communication and documentation of the SMS. In order to ensure proper implementation and maintenance of the SMS senior management appoints a program manager responsible for its establishment, implementation and maintenance, and for reporting on its performance. All responsibilities and resources related to the SMS are defined and communicated to ensure effective implementation. The importance of sustainable thinking is communicated both internally as externally to create awareness within and outside of the firm with regards to the CSR strategy, plans, results and challenges [IIA, 2010]. To facilitate awareness and to ensure capability amongst its employees, trainings are given and procedures are defined for creating awareness for the importance of conformance with CSR policies and procedures. To show an organization’s progress in realizing its CSR objectives management designs a communication process that sets the objectives of external communication, the information that needs to be shared, and the channels to be used. The effectiveness of the communication efforts are then measured and evaluated. The CSR report is the most widely used vehicle to communicate the outcomes and results that occurred within the reporting period in the context of the organization’s commitments, strategy, and management approach. The organization described core processes, uses flow charts to enhance understanding, and clarifies interaction between the different processes. This documentation forms the basis for an external review and can be used for training purposes [Nieuwlands, 2006].

In order to obtain assurance on the effectiveness and efficiency of the CSR-initiatives in an organization it is key to continuously monitor (through the three lines of defenseiii) the internal controls relating to CSR/ SMS process [IIA, 2010]. As part of the fourth step ‘checking and corrective action’, monitoring and measurement processes are documented so that they are clear and implemented properly. On a periodic basis the adequacy and effectiveness of the system is monitored based on the objectives and targets set. Timely follow-up and processes for proactive and corrective actions are designed and implemented. Additionally, the organization set up a process to ensure that the SMS is subject to a periodic (internal) audit, with the objective to determine whether the system has been set up adequately and is implemented effectively. The results of this system audit are communicated to senior management [Nieuwlands, 2006].

Finally, management periodically reviews the SMS to ensure its continuing suitability, adequacy and effectiveness. Based on the outcome of the management review, management should act to improve the system and thereby improve CSR performance [IIA, 2010; Nieuwlands, 2006].

2.3 The role of IA in CSR

2.3.1 Internal Audit and CSR

As investors and regulators are increasingly demanding greater visibility into what organizations are doing, organizations need IA to take a broader mandate within the organization. Far from its traditional compliance roots, IA is increasingly being asked to not only provide operational business insights to the organization, but also to serve as strategic advisors – helping the organization to address today’s key business risks and prepare for critical emerging risks that the organization knows are approaching more quickly than ever before based on business strategy and continued global expansion [EY, 2013]. Amongst the top of ten of the most important emerging risks that IA is tracking is climate change and sustainability.

The board and senior management of an organization is responsible for guarantying that CSR objectives are established, risks are managed, performance is measured, and activities are appropriately monitored and reported, and for ensuring that the organization’s CSR principles are communicated, understood, and integrated into decision-making processes [IIA, 2010]. However, as previously mentioned, management has trouble

(15)

ensuring that CSR activities are coordinated and aligned with strategic initiatives and principles throughout the organization. IA is well positioned to support management to implement a SMS and perform system audits after the implementation phase as long as they maintain their independence and objectivity, and hence they never assume line-management responsibilities [Nieuwlands, 2006]. Supporting this statement is a research performed by the Dutch Institute of Chartered Accountants (NBA: “Nederlandse Beroepsorganisatie van Accountants” in Dutch) and the Institute of Internal auditors (IIA) in the Netherlands (2011) who jointly investigated the relationship between internal audit and Corporate Social Responsibility (CSR) which highlights that the IA has an important and growing role to play in the governance of organizations when it comes to CSR. Not only during the reporting of results but also in embedding CSR throughout the organizations. They conclude that the IA will be able to add value to the process of defining policies, criteria, standards and controls, and in evaluating and reporting on the organization’s performance in the field of CSR [IIA and NBA, 2011].

The IIA has developed an International Professional Practice Framework (IPPF) on evaluating CSR in 2010. An IA function that conforms to this IPPF is qualified to audit and provide assurance to the board and management on CSR programs and reporting. The IPPF practice guide on evaluating CSR as well as Nieuwlands believe that in order to express and opinion on the adequacy and effectiveness of the SMS of an organization, IA should perform work in all phases of the system.

According to the definition of internal auditingiv as defined by the Institute of Internal Auditors (IIA) – the recognized authority, acknowledged leader and chief advocate of the internal auditing profession – internal auditing consists out of two services: consultingv and assurancevi.

The research by the IIA and NBA in 2011, state that IA coordinates its efforts to the maturity level of the CSR process within the organization. Depending on the maturity of the CSR process within the organization IA will take up a more supporting, consulting and/ or assurance role, while not jeopardizing their independence and objectivity. In order to determine the correct role for IA, the IA function considers the expectations of the Board, management and its stakeholders, the level of expertise within the IA function and within line management, availability of information regarding the CSR maturity in the industry, and also the involvement of the external audits or other advisors [IIA and NBA, 2011]. Important to note is that internal audit should always maintain it objective and independent position, and should therefore not assume management responsibility of CSR. With regards to this, please refer to in figure 2-2 [IIA, 2010] below visualizing which roles can be undertaken by IA with or without additional safeguards, and more importantly, which roles IA should not undertake to maintain its objectivity and independence.

(16)

The Business Process Maturity Model describes that processes mature in the following five levels: Initial (chaotic), Repeatable, Defined, Managed and Optimized. Processes in the initial level are typically undocumented and in the state of dynamic change, tending to be driven in an ad hoc, uncontrolled, and reactive manner by users or events. This provides a chaotic or unstable environment for the processes. In the Repeatable level, some processes are repeatable, possibly with consistent results. Process discipline is unlikely to be rigorous, but where it exists it may help to ensure that existing processes are maintained during times of stress. In the Defined level standard processes are defined, documented and established and have been subject to some degree of improvement over time. These standard processes are in place (i.e., they are the core processes) and used to establish consistency of process performance across the organization. It is characteristic of processes at the Managed level that, using process metrics, management can effectively control the core process (e.g., for software development). In particular, management can identify ways to adjust and adapt the process to particular projects without measurable losses of quality or deviations from specifications. Process Capability is established from this level. Finally, the Optimized level, where the focus is on continually improving process performance through both incremental and innovative technological changes/improvements. Given that designing, implementing and executing CSR in an organization can also be defined as a process, the following proposition was constructed based on literature described above:

P2: As the CSR process becomes more mature IA will increasingly take on an assurance role and will less

frequently take on the role of consultant.

2.3.2 Consulting

Standard 2130 on Governance states that “the internal audit activity should assess and make appropriate recommendations for improving the governance process…”. PA 2130-1 also states that IA should take an active role in support of the organization’s ethical culture, as they have a high level of trust and integrity within the organization as well as the skills to be effective advocated of ethical conduct [IIA, 2012]. As CSR is highly linked to ethics, IA should be involved in the whole process of implementing CSR in an organization [Nieuwlands, 2006; IIA and NBA, 2011]. The design and implementation of the CSR process within organization is a difficult task for many organizations as it requires knowledge and experience in multiple areas. However, as these areas are within the expertise of IA, the IA function fulfills a significant consulting and supporting role in the implementation of CSR.

The research by the IIA and NBA (2011) highlights that IA is closely involved as consultant in the design of the CSR process within an organization, as it maintains knowledge of the organization, risks and control of processes as well as the relating reporting standards and guidelines. As the CSR process matures, IA helps the organization to take the CSR process up to a higher level by not only fulfilling a consultancy role but also that of an assessor.

2.3.3 Assurance

IA may choose to evaluate the CSR programs as a whole and determine whether the organization has adequate controls to achieve its CSR objectives. Generally, the CAE would develop a one-to-three-year plan to obtain sufficient and reliable information about the various elements of CSR within the organization. Upon completion of the CSR-related audit programs, an opinion of the overall CSR controls can be developed [IIA, 2010]. In order to establish a complete and accurate risk-based audit plan, internal audit have to understand the risks identified by management in the planning and risk assessment phase of CSR and should use that knowledge

(17)

when considering and establishing CSR activities in the audit universe, audit plan, and audit approaches [IIA, 2010].

The main activity performed by IA as part of this role is giving assurance on the CSR report, the CSR process, and other related processes by auditing these processes, and its underlying controls and risks. The results of these audits provide IA with the opportunity to offer the audit committee with an independent opinion on the level of control with regard to the CSR objectives of the organization, and will also be able to indicate where additional oversight is required; and to identify potential process improvements and gaps in control, which are especially of added value for line management and senior management.

In the research by the IIA and the NBA (2011) several audits are qualified as best practice and should be included in the audit plan of the IA function. Reference is made to table 2-1 for an overview of activities that can be performed by IA as part of the two roles: consulting and assurance.

2.4 Coordination of EA and IA

2.4.1 EA and IA

Externally verifying an annual integrated report or individual CSR report increases the credibility of the report. When making decisions regarding the level of assurance, depth and scope of the CSR report, internal audit can play an essential role by providing their knowledge on the material and organization. Additionally the external auditor can also add value to the internal audit team by providing industry-wide knowledge and subject matter expertise. Through collaboration the quality of the CSR process and report will increase significantly. In the research by IIA and NBA another best practice was highlighted, as follows: “The internal auditor and the external auditor work closely together, especially when auditing the CSR report. The internal auditor coordinates his activities with that of the external auditor, and vice versa” [IIA and NBA, 2011]. Based on this literature, the following proposition is described:

P3: The internal auditor and the external auditor work closely together, especially when auditing the CSR

report. The internal auditor coordinates his activities with that of the external auditor, and vice versa.

Prior to discussing the ways in which these two parties can effectively work together, the relationship and collaboration with EA is to be discussed in more detail.

The coordination between EA and IA in general is one that has been widely discussed from both IA’s perspective as that of EA. In many organizations, the activities carried out by IA constitute an important part of the system of internal controls. If the work performed is adequate for the purpose of the accountant’s audit, the external auditor may use the work in getting control information. The framework for cooperation between IA and EA is stated in ‘ISA 610: Using the work of the IA’, but is specific to the audit of financial statements. This includes using the work of IA in obtaining audit evidence [IAASB, 2013]. The external auditor is allowed to use the work of IA when the internal auditor is sufficiently objective, proficient and maintains a robust audit approach.

If EA decides to use the work of the IA, the audit file of the external auditor is required to maintain at a minimum an evaluation of the objectivity, proficiency and robustness of the IA function, the nature and scope of the work performed by IA an used by EA, and all procedures performed by EA to evaluate the work performed by IA on which the external auditor relies [IAASB, 2013].

(18)

For IA the IIA Standard 2050 and the accompanying Practice Advisory exist and provides rules for coordination and exchange of information on the activities of the internal auditor and the external auditor. Included are measures ensuring an efficient (limited duplication) and effective cooperation between the internal auditor and the external auditor [IIA, 2012].

2.4.2 Best practices for IA

An article in the Dutch magazine ‘De Accountant’ based on a research performed by the Royal Dutch Institute of Chartered Accountants (NIVRA: “Koninklijk Nederlands Instituut van Registeraccountants” in Dutch) and IIA in the Netherlands summarized the following best practices for an efficient and effective coordination between the internal auditor and the external auditor [Dekker, 2009]. The first best practice mentioned in the article is full transparency between the IA function and the external auditor and open communication with the audit teams and stakeholders. Secondly, optimal use of existing knowledge and skills should be aimed for to ensure the correct attitude. This can be achieved by borrowing expertise from one another, by giving IA an important role in the selection and appointment of the external auditor, and by requesting advice from EA prior to the selection and dismissal of the CAE. Another best practice is ensuring an effective audit coverage and audit impact by developing a shared vision for cooperation and by defining and documenting these objectives on an annual basis. Critically discussing risk assessments as a basis for audit planning will also contribute to ensuring an effective audit coverage and impact. The fourth best practice indicated in the article relates to promoting an even more efficient work performance. Activities that will enhance efficient work performance includes the use of the same audit methodology, -techniques, -tools and -terminology; evaluating each hour spend and budgeted; and the use of each other's work when possible. Fifthly, on forehand agreeing on the issues and reports to be presented to the audit committee and presenting an integrated audit approach and planning to the audit committee is mentioned as a best practice. These activities will strengthen the relationship with, and increase support provided to, the audit committee. The sixth best practice stated is further improving the coordination of the audit work for the organization, which can be achieved by having IA coordinate the internal and external audit activities, or by critically evaluating the draft management letters and reports prepared by EA. And lastly, the coordination between IA and EA should be subject to continuous improvement. This can be achieved by jointly developing a plan to improve the effectiveness and efficiency of the cooperation, and by informing each other on received complaints and suggestions for improvement. The best practices mentioned in the article can be transmitted into improvement areas for both the external auditor and the internal auditor when it comes to the relationship between the two parties.

Improvement areas also exist when looking at specific procedures that can largely be performed by the IA to contribute to the efficiency and effectiveness of the coordination. Please refer to the Table 2-2 for an overview of these procedures.

A research performed by Ambaum (2007) where the role of IA with relevance to CSR in the Netherlands was empirically tested by means of a survey on 29 IA functions it was concluded that there is much potential to add value as internal auditors when it comes to consulting on CSR related issues as his research shows that only 17% of the IA functions involved performed active market research in the field of CSR and that only 38% monitored the integration of CSR in the annual risk analysis. This research concludes that not only the development phase but all phases of the CSR process, including the creation of the design, implementation in the organization and strengthening the operational effectiveness are ideally suited for a good contribution from IA by means of a consultancy role.

(19)

CSR Process Step Role of IA

(Re)formulating CSR policy and strategy

-

Information, Risk Management and Planning

 Assessment of the scope of the report (i.e. which entities). Knowledge of the organization and expertise in the field of accounting can be used and of added value here

Implementation and operation  Support the organization by providing training regarding the verifiability requirements and design of the audit files;

 Advising the Board with respect to the contents of the engagement with the external auditor, as IA has a broad understanding of the organization and underlying processes, and its possession of materials and knowledge of work performed on which the external auditor may be able to rely. Also, IA can advise on the appointment of the external auditor, where it regards the experience and expertise in the field of CSR reporting.

Checking and corrective action  Perform an assessment of the internal reporting and data collection process;  Assessment of the content of the report, especially with regard to relevance,

materiality and prioritization of the issues being reported. As part of this, the internal auditor will evaluate and advice on the continuous involvement of stakeholders, as well as the care for the completeness and prioritization of topics;  Assessment of the quality of the report, where quality features such as balance,

comparability, accuracy, timeliness, clarity and reliability are important;

 To achieve efficiency, the internal auditors take over a great part of the data-centric and system-oriented work from the external auditor. The internal auditors’ in-depth knowledge of the organization and its processes will be embayed here. The internal auditor will work closely with the external auditors (perhaps in the form of integrated audit teams). The internal auditor also performs the check on control guidelines for the organization;

 The joint preparation of the (draft) assurance report and management letter;  Monitoring of the follow-up on audit findings.

Management review and continual improvement

-

Table 2-2: Activities for IA to ensure efficient and effective collaboration with EA

2.5 Chapter summary

Based on existing literature and extant research performed the following propositions are formulated for practical research.

 P1: The CSR process within an organization is organized according to the PDCA cycle and therefore strongly resembles Nieuwlands’ Sustainability Management System.

 P2: As the CSR process becomes more mature IA will increasingly take on an assurance role and will less frequently take on the role of consultant.

 P3: The internal auditor and the external auditor work closely together, especially when auditing the CSR report. The internal auditor coordinates his activities with that of the external auditor, and vice versa.

The main focus of empirical research performed in this area has not yet been the improvement areas for IA in the CSR process. Additional research is therefore required to determine what these improvement areas are.

(20)

CSR Process Step Role of IA

Summary Consulting Assurance

(Re)formulating CSR policy and strategy

 Consulting on CSR developments  Facilitating

identification of objectives and risks

 Identifying relevant CSR-topics with regard to social developments and adjustments in the field of laws and regulations [IIA and NBA, 2011].

 Consulting on operationalizing of these relevant CSR-topics. This includes supporting management when defining CSR, implementing CSR in the strategy (or setting up the CSR policy and developing the CSR strategy), and defining objectives, standards and norms [Nieuwlands, 2006; IIA, 2010; IIA and NBA, 2011]. - Information, Risk Management and Planning  Facilitating identification of objectives and risks

 Assist management in identifying, evaluating and implementing risk management methodologies and controls to address CSR risks [IIA, 2009; IIA and NBA, 2011].

 Advising management for setting-up, implementing and managing an effective SMS and CSR program [Nieuwlands, 2006; IIA and NBA, 2011].

 Giving advice on the design of an information system [IIA and NBA, 2011]. - Implementation and operation  Guiding external assurance  Consulting on CSR controls  Consulting on CSR-framework

 Act as an advisor to management during the set-up and implementation of a risk and control framework and effective control procedures, which are based on an assessment of critical risk in the field of CSR [IIA, 2009; IIA and NBA, 2011].  Assisting management in determining the evaluation criteria to

measure whether CSR objectives are achieved [IIA and NBA, 2011].

 Advising management on the allocation and communication on roles and responsibilities, and clear guidelines to ensure an effective SMS. This includes advising management on an organizational structure, responsibilities and composition staffing required for the effective CSR organization [Nieuwlands, 2006; IIA and NBA, 2011].

 Consulting management during the selection of the external verifier of the CSR report, and scope of the CSR report. IA can

(21)

also guide EA during the external audit to ensure effective and efficient communication between EA and the CSR department/ manager throughout the audit [IIA and NBA, 2011].

 Giving advice on internal and external accountability and communication regarding CSR-performance, especially when it regards the implementation of an information system [IIA and NBA, 2011]. Checking and corrective action  Assurance of CSR data  Assurance of CSR related processes  Evaluate CSR-Risk Management  Evaluate CSR reports  Review of CSR management

-  Audits on the creation process of the CSR policy [IIA and

NBA, 2011].

 Performing separate audits of third party for contractual compliance with CSR terms and conditions [IIA, 2010].  (System) audits to provide assurance on the translation from

the strategy to the policies, procedures, models, management cycle (PDCA) and the final report [IIA, 2009; IIA, 2010; IIA, 2011; Nieuwlands, 2006].

 Evaluating the extent to which CSR ambitions of the organization are included in the organization core processes and management processes [IIA and NBA, 2011].

 Audits regarding the adequacy of the internal control and evaluation mechanisms [IIA and NBA, 2011].

 Evaluating the reliability of performance measures [IIA and NBA, 2011].

 Audits on the effectiveness of embedding CSR in the organization and processes [IIA and NBA, 2011].

 Ensuring proper follow-up of the recommendations made as a result of the internal and external audits.

Management review and continual improvement

- - -

(22)

3 Research design

This chapter presents the methodology used in order to answer the research questions that were presented in Chapter 1. First, the research approach is discussed, and then the data analysis method will be elaborated on.

3.1 Research methodology

The main objective of this research is to contribute to the awareness of internal auditors about their possible role in the CSR process and about improvement opportunities for IA in the CSR process. Robson (2002) defined exploratory research as a valuable means of finding out ‘what is happening; to seek new insights; to ask questions and to assess phenomena in a new light’. This research aims to explore what the role of IA is in the CSR process and what opportunities for improvement exist in this process for IA. Additionally, it aims to explore this by obtaining an objective point of view from the external auditors. This research can therefore be classified as an exploratory research that maintains a theory-testing approach [Geene, 2011].

3.1.1 Literature

Various literature, websites and research studies with regard to the topic of CSR in general are studied in order to answer the theoretical research sub questions defined in Chapter 1. Reference is made to Chapter 6, which provides a list of literature used.

3.1.2 Subject matter interviews

Subject matter interviews are selected as a first method of research as it is a valuable manner to easily collect knowledge in a new and unknown field [Audehoven, 2007]. In this study subject matter interviews are used as an exploratory approach helping the researcher to gain a better understanding of the CSR process in general and about the role of IA and its improvement areas in particular. An expert possesses knowledge in three dimensions: technical knowledge (specific and detailed knowledge in a particular field), process knowledge (knowledge from direct interaction), and explanatory knowledge (own ideas and subjective opinion) [Audehoven, 2007]. By means of the interviews with the subject matter experts (SME) the researcher tried to elicit all three types of knowledge to obtain a thorough insight. For the subject matter interviews, two interviews are conducted with external verifiers of CSR reports working in two separate accountancy firms. This selection of accountancy firms is based on the predicted assumption that these two accountancy firms are the biggest in the field of CSR audits in the Netherlands. These respondents all represent experts as they all are all highly experienced professionals, with at least ten years of experience in the field CSR. The table below illustrates the expert interviews conducted. All interviews took place face-to-face.

Table 3-1: Subject matter experts

Company Interview ID no

Function CSR experience

Location Duration Audio-recording

EA 1 I1 CleanTech & Sustainability Senior Manager Audit

13 years Groningen 30 minutes Yes EA 2 I2 Global Head of Sustainability

Assurance

(23)

3.1.3 Case Studies

As this research is classified as an exploratory research that maintains a theory-testing approach, the following possible research methods are recommended: case studies, histories and experiments [Yin, 2009]. In this research study case studies are the method of choice as it evaluates contemporary events that cannot be manipulated and controlled. Furthermore, case studies have been proposed by authors such as Robert et al (2006) and Ciliberti et al (2008) as the method to advance the mainstreaming of CSR, as they can be very effective to study complicated subjects as CSR. Finally, Schramm (1971) stated that “the essence of a case study, the central tendency among all types of case study, is that it tries to illuminate a decision or set of decisions: why they were taken, how they were implemented, and with what result”. This statement shows the close resemblance with the main questions of this research and thus clearly illustrates the choice in the research method of case study [Geene, 2011].

A multiple-case study design is chosen as the appropriate research design on the basis of theoretical replication. To ensure convenience and efficiency, a small number of cases are observed. Using multiple cases increases the robustness of the research, as the evidence from these multiple cases is more compelling, that that of a single case study [Geene, 2011]. This research involves a field study of four IA functions and their respective external auditors. The four companies selected all have CSR reports that are externally verified, have an IA function that is plays a role in the CSR process of their organization; and have an external auditor that relies on the work of IA when it comes to the CSR audit process.

The sample was restricted to the Netherlands because of practical reasons involved with data collection. For the case selection the decision was made to focus on companies of only the two biggest external verifiers in the field of CSR. Furthermore, selected only two of the four largest accountancy firms enables a better cross-case comparison due to stability in the use of methodologies by the external auditor, while still gaining insight based on the perspective of more than one external auditor. The large accountancy firms were used as a study by KPMG International amongst the 250 largest organizations showed that two thirds of the companies that get their reports externally verified choose to engage a major accountancy firm [KPMG, 2013]. From the six remaining possible case selections, the following four cases were selected in Table 3-2. These cases were selected based on their characteristics. It was assumed that companies in Financial Services would have a more mature CSR process given the pressures to communicate on all types of performance, including CSR performance. Also, as the Dutch government obligates all organizations of which they are a primary shareholder to report on CSR, it is therefore assumed that these organizations will have a more mature CSR process. And finally, as previously mentioned in Chapter 2, AEX listed companies are normally frontrunners when it comes to CSR. Hence, these companies were selected as it was expected that they have a higher level of maturity of the CSR process. Furthermore, IA has been involved in the antecedent maturity levels as well. These cases therefore provide a best practice and hence improvement points for other IA functions in less mature CSR processes. Reference is made to table 3-2 for the case profiles with characteristics of the organization. Please refer to Appendix D for a short case description.

Company ID name

Industry CSR in strategy

Type Shareholders External auditor

# of auditors in IA (in CSR audits)

Case A Financial Services Y Niche player Dutch State EA 1 5 (1)

Case B Consumer Products Y Market leader AEX listed EA 2 55 (5)

Case C Transportation Y Market leader Dutch State EA 1 3 (3)

Case D Financial Services Y Market leader Cooperation of farmers

(24)

3.1.4 Data Collection

“One of the unique strengths of a case study is its ability to deal with a full variety of evidence – documents, artifacts, interviews, and observations…” [Yin, 2009].

The data collection aims for triangulation, encouraging the collection of information from multiple sources while collaborating the same fact. Saunders described data triangulation as: “…the use of different data collection techniques within one study to ensure that the data are telling you what you think they are telling you” [Saunders et al., 2009]. The different methods of data collection used include the internal and external documentation, interviews with the IA functions and interviews with the CSR audit departments of the EA firms in order to offer a complete picture and to increase construct validity. As part of the case study research triangulation was also used as a method to obtain the needed information. First, all available internal and external documents relevant to the research objective were analyzed, these included: CSR reports, company websites, and/or financial statements of the organizations. Also semi-structured interviews were conducted with the internal auditor responsible for CSR in the selected cases after which they were requested to fill in a maturity model (see appendix C) used.

The general description of the research and its purpose were presented to the companies with an introduction email (see appendix A, to convince them of participation in this research by means of an interview. In order to contact participants, the professional and social network of colleagues and J.J.M. Laan (lecturer of the course Management Accounting at University of Amsterdam) and myself were used. All interviews lasted approximately one hour which enabled the interviewees to speak freely. Interviews ensured an in-depth understanding of the obstacles for improvement, and underlying reasons for decisions and motives when it comes to the role of IA in the CSR process. The research model described above is illustrated in figure 1.

3.3 Data analysis

The aim of this thesis is to provide an answer to the research question: What is the role of IA, and what opportunities for improvement exist for IA in the CSR process of an organization?

In order to answer this question based on the interviews held during the multiple case study research pattern matching is used as a data analysis technique [Sarker, & Lee, 2003; Trochim, 1989]. By means of pattern matching theoretical patterns are matched with the findings from the case studies (observational patterns). Pattern Matching is a very strong method to ensure strong internal validity [Yin, 2009; Sarker, & Lee, 2003; Trochim, 1989; Lee, 1989].

Data organization is an important step in the pattern matching technique. Especially for the interviews it is important that the information obtained in the interviews is organized and analyzed in a systematic way in order to make relevant conclusions. Therefore, interview scripts (appendix B) with a consistent topic list were used. And almost all interviews were audio-recorded and transcribed with the permission of the respondents (the transcriptions and audio files of the interviews are available upon request). This allowed the interviewer to listen carefully and to capture all relevant and essential information. Moreover the records and transcripts keep the entire conversation intact and does not allow for alterations. Consequently it increases the reliability of the research [Stewart et al., 2007]. One interviewee however did not agree to audio-recording. This interview was written out immediately after the interview to minimize data loss, and then sent to the interviewee for verification. All transcriptions were sent back to the interviewee for their consent on correctness of the data. Thereafter, the transcribed interviews were used to create coding tables, that capture and group all the important expressions, quotes or sentences by the respondents based on the main issues

Corporate social responsibility and internal audit : what is the role of IA, and what opportunities for improvement exist for IA in the CSR process of an organization?