Tools for the job: Carbon countdown

I introduced the concept of environmental audits when I worked at Falkirk Council towards the end of the last century. These focused on energy, water and the disposal of waste. The finance director liked them because we uncovered duplicate payments of energy invoices and inefficiencies in the procurement and management of energy bills across hundreds of properties. His interest was purely in the money, not in protecting the environment or environmental risks. In a sense, they were value-for-money audits although we didn’t call them that at the time.

Today, everything is risk-based. We need to audit climate issues not only to save a few pounds and to help save the planet, but because climate change has become a business risk and a business opportunity. In 2020, for the first time in its history, five of the top ten global risks in the World Economic Forum’s Global Risks Report were environmental, with climate change high on the risk agenda in terms of impact and likelihood.

The biggest risks associated with climate change are business resilience (22 per cent), regulatory risks (22 per cent) and reputation (18 per cent). Climate change presents huge risks, but also great business opportunities for companies that can develop sustainable products and services that use fewer resources.

However, according to the Chartered IIA’s report Organisations’ Preparedness for Climate Change: An Internal Audit Perspective, 2020, 53 per cent of internal audit managers have not discussed climate risk with their audit committee. A similar proportion (52 per cent) say that their internal audit function is doing very limited, or no, work related to climate change.

Why this discrepancy? Few internal auditors are trained in environmental issues or climate crises. The subject can feel overwhelming because it is complex and any single issue can have multiple and far-ranging consequences. Long, complicated supply chains are often poorly understood, even by procurement teams, while reputational risks, for example, if a heatwave causes the death of workers in poorly ventilated factories, may be underappreciated – until they happen.

Meanwhile, shareholders, the public and business customers are putting companies under pressure to reduce their carbon emissions. Many multinationals are now demanding demonstrable commitment to, and action on, cutting emissions before they will award contracts. There are many competing schemes to “prove” your commitment to tackling climate change, one to mention is the Race to Zero, a global campaign to get companies, regions, investors and cities to commit to action before the COP26 climate conference in November.

All this is before you consider the direct risks of climate change on your organisation, markets and staff.

In addition to understanding the many and varied risks, internal audit has a role providing assurance on calculating and reporting carbon emissions.

• Since 2013, all UK quoted companies must report on their greenhouse gas emissions in the director’s report.

• Since April 2019, large companies, quoted companies and large LLPs are also required to disclose their energy and carbon emissions on a comply-or-explain basis.

• The UK Corporate Governance Code 2018 requires companies to report on how opportunities and risks to the future success of the business have been considered and addressed. 

•The UK Task Force on Climate Related Financial Disclosures provides guidance on voluntary reporting of climate-related risks; but governments around the world are tightening mandatory disclosure rules in this area.

In addition to mandatory reporting, many companies, including supermarkets, demand that their suppliers audit their environmental risks and provide carbon footprint data for the products they sell. If you can’t supply this data, you have little chance of winning contracts, so it is a business-critical risk. The data needs to be robust, and internal audit can provide this assurance.

Auditing carbon emissions requires similar skills to auditing financial numbers, but with more emphasis on materiality and judgment. While some figures can be checked, such as electricity consumption on your premises; others, such as the carbon, methane and nitrous oxide emissions from growing, processing and transporting crops from south-east Asia to markets in western Europe, cannot be calculated as precisely, which is where judgment comes in.

So, how can you start doing an environmental or climate-change audit?

Climate change risks in general should be considered as a part of every audit, however a specific environmental audit is likely to require education and training – if your business has staff with environmental skills, it would be worth requesting for someone to be seconded to your team for a fixed period or to undertake a particular environmental audit.

In this way, your team can develop skills for future audits and increase its awareness of the broader risks – and any opportunities – for your organisation. Key risks include strategic, compliance, financial, reputational and operational. Compliance issues will vary according to your industry sector; the rules for banks are different from those for manufacturing plants. So, as with other risks, you need to understand the regulations affecting your business, consider your global supply chains and how extreme weather could impact your business locally and overseas. 

Talk to colleagues and stakeholders in the organisation and seek their views on how climate change might impact their part of the business.

 You should also review the organisation’s risk register with climate change in mind. Have climate change risks been identified and factored into the strategic decision-making processes? Question and challenge whether management has adequately considered the global impact of climate change on the business.

Then you can audit the numbers that are available – energy and carbon emission reporting, key performance indicators, progress towards achieving net zero or equivalent targets. Accept that many will not be accurate, but question and explore the assumptions behind them. What evidence is there to support these assumptions? Are there ways to make the figures more reliable? Have all the relevant factors been included and could technology capture and analyse more data more regularly and comprehensively? What are other organisations doing – in your sector and more widely – and can you learn from them?

DEFRA publishes annual greenhouse gas conversion factors for things such as electricity and gas; business travel, flying and freight; waste disposal; and use of refrigerants. 

The University of Bath has published an inventory of carbon and energy to assist calculations of embodied energy – this can be used, for example, to calculate carbon footprints of construction materials (concrete, steel) and products made from such materials.

These databases provide underlying data for all carbon calculations. It is important to check that the correct factor has been applied (with the correct decimal points) as it is perilously easy to get it wrong by a factor of 10 or even 100 and for this to go unnoticed.  

Judgment is also necessary. The Greenhouse Gas Protocol splits carbon emissions into scope 1 “direct”, scope 2 “indirect from purchased services”, and scope 3 “other indirect”. Almost all companies include their combustion of gas and emissions from owned vehicles (scope 1) and their use of electricity (scope 2). But for those who count scope 3, there is little agreement on what is within scope. Is employee commuting included in an organisation’s carbon footprint? What about home working? If you outsource a service, can you justifiably claim that your carbon footprint has decreased overnight?  

Internal auditors need to check that what your organisation measures agrees with what is publicly announced and reported. Is it consistent and logical? Materiality is important. Carbon footprinting of products and of international supply chains can never be 100 per cent accurate – there are too many factors and variables. One product may contain dozens of components. 

A good rule of thumb is to include 90 per cent of emissions and ignore the remaining ten per cent as immaterial. In this way, carbon footprinting can be manageable and cost-effective and still provide sufficient information to be useful.

Regulations are changing rapidly in different jurisdictions and are likely to become increasingly stringent as countries struggle to meet targets. As a consequence, best practice will also evolve fast, as will new tools to limit emissions and to calculate and monitor carbon footprint. Auditing carbon and climate risks is no longer an addition to internal audit’s remit –it is essential. 

Neil Kitching qualified as an accountant, then as a member of the Chartered IIA. After 20 years in internal audit he moved into sustainable development and now works for a public agency helping the business sector to adopt new water and heat-related technologies. His book, Carbon Choices, is about commonsense solutions to climate and nature crises. One-third of profits from this will be donated to rewilding projects. He is a member of the Chartered IIA’s advisory panel contributing to a new thought-leadership project on climate change risk for internal auditors, which the Chartered IIA is running in partnership with the British Standards Institution. 

Keep checking for updates to guidance on auditing climate change risk on the institute’s website.

This article was first published in September 2021.