Home › Pathways › Measure & Report › 1.3 Assurance
Measure & Report  ·  1.3.2

Internal Audit & Controls

Internal audit and controls over sustainability reporting ensure that GHG data and climate disclosures are accurate, complete, and consistent before they reach external audiences. As sustainability data achieves parity with financial data in regulatory and investor importance, the governance infrastructure must follow — including board oversight, management review, cross-functional accountability, and documented control frameworks.

← Back to Pathways

Self-Assessment

Select where your organization currently operates and where you want to get to. There is no obligation to reach "Leading Org." — choose the target that is right for your business context and investment capacity.

📍 Current Level
🎯 Target Level
Select your current and target levels above to map your assessment on this initiative.
Fundamental
Market Standard
Above Average
Leading Org.

Technology

  • Documented data collection process for GHG inventory with named data owners by facility and emission source
  • Basic spreadsheet controls: version control, formula checks, and cross-referencing against prior year

Process

  • Assigning named accountability for GHG data quality at facility and business unit level
  • Establishing an annual sustainability data review process before external publication
  • Briefing the sustainability committee or relevant board committee on annual GHG inventory and disclosures

Financing

  • Internal sustainability team manages data governance with no dedicated audit resource
  • Process documentation costs absorbed within sustainability function operating budget

Technology

  • Fundamental Technologies +
  • Centralized carbon accounting platform with audit trail, user access controls, and change logs
  • Automated data validation rules flagging outliers, year-over-year anomalies, and missing data

Process

  • Internal audit function conducting a first sustainability data quality review
  • Documenting key controls over GHG data collection, calculation, and reporting in a controls matrix
  • Establishing a cross-functional sustainability data governance committee (sustainability, finance, legal, IT)

Financing

  • Internal audit team capacity allocated to sustainability data review (typically 2–4 weeks annually)
  • Carbon accounting platform audit trail features reduce manual verification burden

Technology

  • Market Standard Technologies +
  • Internal controls over sustainability reporting (ICSR) framework documented and tested annually
  • Automated reconciliation between carbon accounting platform and ERP/utility data sources

Process

  • Conducting formal ICSR testing analogous to SOX controls — identifying, documenting, and testing key controls
  • Integrating sustainability controls into enterprise risk management (ERM) framework
  • Board audit committee receiving annual sustainability controls report alongside financial controls assessment

Financing

  • ICSR program cost ($50K–200K) offset by reduced external verification fees and regulatory audit preparedness
  • D&O insurance coverage reviewed to ensure climate disclosure liability is adequately addressed

Technology

  • Above Average Technologies +
  • Fully integrated financial and sustainability reporting controls under unified governance framework
  • Continuous controls monitoring with automated alerts for data quality deviations between reporting periods

Process

  • Sustainability controls assessed by external auditor as part of integrated audit engagement
  • Board audit committee receiving quarterly sustainability controls updates, not just annual review
  • Publishing internal controls framework for sustainability reporting openly to demonstrate governance leadership

Financing

  • Integrated audit approach reduces total assurance cost vs. separate financial and sustainability engagements
  • Strong controls governance recognized by ESG rating agencies and institutional investors as governance premium

Related Pathways

← All Pathways 5.3.1 Third-Party Verification 5.3.3 Registry & Attribution 5.1.1 Emissions Inventory