Roadmap to robust non-financial information. The why, what and how of NFI data management, reporting and assurance

Transcription

1 Roadmap to robust non-financial information The why, what and how of NFI data management, reporting and assurance

2 1 Management summary Non-Financial Information (NFI) is increasingly taken into account in decision making. This holds for shareholder decisions as well as internal decision making within companies. Management and stakeholders want to rely on robust data for their decision making and hence, data management, reporting and disclosure of nonfinancial information is gaining momentum, with many companies today. An increasing number of organizations has defined an ambition to make their reporting of NFI as robust and as reliable as their financial information, including reasonable external assurance. The journey companies are undertaking is tedious, complex and time-consuming as data is coming from numerous sources and even from outside the company boundaries. Barriers to overcome include professionalizing and automating data management and internal audit processes to create strong lines of defense similar to the principles that are common within the world of financial management & reporting. In this paper we present the roadmap to robust NFI. It covers the why, what and how of NFI data management, reporting and assurance.

3 2 What happened? Over the past decades, there has been a strong increase in the number of sustainability disclosures being reported. More and more companies adopted external reporting standards such as the Global Reporting Initiative while at the same time improved their internal management accounting systems for non-financial information (NFI). This trend went hand-in-hand with the improvements that were made concerning the reliability of these disclosures. It has now been about years since the initial external social and environmental reports started to be released by early adopters. It was followed by the development of several standards such as the Global Reporting Initiative in 2000, the Green House Gas protocol in 2001, and the Integrated Reporting framework in Although these standards have an external reporting focus, they also enable companies to standardize their management accounting systems through standardization of internal management reporting. The availability of standards was followed by a strong adoption of sustainability and eventually integrated reporting. The progress that was made is evidenced by the number of organizations that releases a sustainability report 1 : a vast majority (95%) of the world s largest organizations discloses sustainability information in the form of a sustainability or integrated report. Since 2002, this number has more than doubled. The percentage of reports that received external assurance has in addition progressed significantly over the past years (from 29% in 2002 to 59% in 2013). The latter underlines that organizations have a strong drive to disclose this information in a reliable way. We have also witnessed the trend to move to a higher level of assurance: the number of reports that received reasonable assurance has almost quadrupled over the past years. Sustainability reports of G250 companies Level of assurance 100% 50% 80% 40% 60% 30% 40% 20% 20% 10% 0% % Sustainability report published Limited Reasonable Not specified Sustainability report assured 1 The external assurance of sustainability reporting Global Reporting Initiative 2013 Roadmap to robust non-financial information 1

4 2. What happened? It is not just the bigger companies that are making progress. Middle market companies are disclosing more and more information on their sustainability impacts. In addition, in April 2014 the EU commission released their new directive 2 on required disclosures of non-financial information which will take effect in 2016 for companies with more than 500 employees. Those companies will need to disclose information on policies, risks and results regarding environmental matters, social and employee-related aspects, respect for human rights, anti-corruption and bribery issues, and diversity on boards of directors. Additionally, as some or even most of these companies will want to increase sustainability within their supply chain, the impact of this EU directive will most likely also affect smaller companies than the ones directly in scope of the EU directive. 2

5 3 Why is this happening? More and more organizations are aware of the fact that NFI is vital in managing their (shared) value creation. As organizations have an impact on their internal ánd external capitals such as financial, social and environmental capital, it is crucial that they have detailed insight in the way they affect those capitals. Such impacts could include e.g. human rights impacts within their supply chain, emissions of the company s operations or environmental impacts as a consequence of the downstream use of their products. As companies get more detailed insights in these impacts, they also start to manage these impacts driven by the fact that what gets measured, gets managed. Unilevers sustainable living plan 3 is a good example of shared value creation. This plan defines a clear ambition to double Unilevers impact by improving health & wellbeing while simultaneously reducing the negative environmental impacts with 50% by 2020 (e.g. greenhouse gas emissions). Shared value creation is additionally illustrated by more and more leading companies which carefully measure and manage their supply chain externalities. IKEA, for instance, has put strong controls in place for their suppliers to reduce their negative social and environmental impacts 4. In addition, AKZO Nobel put, for the first time, a target in place in 2014 concerning their scope 3 emissions (being the emissions of its suppliers) 5. Although these aforementioned impacts go beyond the boundaries of these companies, they certainly can be improved and managed by the company involved. Such ambitious plans cannot be executed without sufficient management information available at hand. In analogy with financial management, performance metrics are required to provide management with support for decisions on defining ambitions, performing analysis and taking corrective actions. NFI has therefore entered the arena of management accounts and financial managers. However, management of NFI in comparison to financial information is emerging in most organizations; and in most cases still in its infancy. This is evidenced by the fact that many companies have manual processes with manual controls in place which are reporting through MS Office applications. However, as more and more companies placed more emphasis on sustainability impacts, they also adopted the principles and good practices that are common in financial reporting & management, leveraging technology and internal audit. As a consequence, leading companies invested in making their reporting processes more robust followed by seeking external assurance. The latter is the closing piece enabling continuous improvement in the timelines, accuracy and completeness of a company s sustainability disclosures. The involvement of finance is a critical element in this respect. This is evidenced by a quote from Henk de Bruin, head of corporate sustainability of Philips: There are synergies elements between the finance discipline and the sustainability discipline. The finance discipline has learned to be high-quality data oriented, while the sustainability discipline emphasizes communication and a stakeholder approach IKEA sustainability report AKZO Nobel integrated report Integrated assurance at Philips Electronics, Robert Eccles, Harvard Business school, 2013 Roadmap to robust non-financial information 3

6 4 What is next? Over the next years we will witness more and more companies establishing robust NFI data management and making the transition to reasonable external assurance, following the steps that several frontrunners already took. This step requires companies to strengthen their lines of defense by further developing their people, processes and technology. As a result internal controls will be created that are equally robust as financial controls. The context of internal controls is structured along four lines of defense as follows: First line of defense: Operations and management naturally serve as the first line of defense for NFI performance management. This is due to the fact that NFI related controls are executed by operations and overseen and approved by management. Additionally, there should be adequate managerial and supervisory controls in place to ensure compliance to standards and adequate execution of processes. For NFI data management, typical controls include segregation of duties in reporting (e.g. data approval) and definition of corrective actions based on NFI performance (through performance dashboards). Second line of defense: Control functions that monitor reporting issues serve as second line of defense. This could include local control functions but also corporate consolidation functions that perform smart data analytics controls. In many cases the second line of defense is responsible for supporting management policies (i.e. definitions for NFI KPI s or external disclosures) and defining roles and responsibilities for NFI data management. Third line of defense: Internal or operational auditors provide the governing body and senior management with comprehensive assurance based on the highest level of independence and objectivity within the organization. In practice, internal auditors perform audits to e.g. test the effectiveness of NFI data management and compliance to standards & definitions. Fourth line of defense: external auditors provide independent assurance over reported NFI disclosures, usually as part of a sustainability or integrated assurance engagement. At present, the majority of sustainability / NFI assurance engagements are performed at limited assurance level, but more and more organizations are moving to reasonable assurance. The difference between a limited and a reasonable assurance engagement is explained in the next paragraph. LoD 4 External audit LoD 3 Internal audit LoD 2 Control functions LoD 1 Business Lines of Defense Delivery of sustainability performance data Management approvals of reported sustainability data Reporting processes including segregation of duties Plan-do-check approach using performance dashboards Sustainability dashboards Data analytics & verifications Data consolidation including workflow enabled ICT Quality reviews Maintenance of standards & definitions Independent verification of data trail Check conformance to standards & definitions Independent external assurance procedures (limited / reasonable) 4 EY All rights reserved

7 5 Improving your lines of defense As the lines of defense are specific to each organization, there is no such thing as a blueprint. There are, however, many good practices available that are being adopted today by frontrunners in sustainability and NFI. In this section we highlight several of those key elements. A. First line of defense: performance dashboards The value of NFI cannot be unlocked unless it is made available to the users of the information that are able to analyze the data and support the performance improvements. Today, frontrunners in sustainability create performance dashboards to provide full transparency to all the internal users including operations and management of the information and to external auditors. Such performance dashboards allow users to e.g. benchmark the performance of their manufacturing site to the company s comparable operations. In addition, data can be sliced and diced including reviewing of past information of previous reporting periods. These dashboards enable management to make interventions similar to practices common to the finance discipline. Example safety dashboard The growing importance of technology Imagine a world where you would have all company data at your fingertips in an integrated dashboard, including both financial and non-financial information. It would enable you to e.g. intervene in your supply chain to overcome human rights risks with one of your suppliers. In addition, as you changed the design of your product, you managed to get real-time insight in the environmental improvements of the product in its use-phase. The insights provide you with a powerful tool to make balanced and integrated decisions with the fastest response time possible as you are able to slice-and-dice economic, social and environmental data. It enables the organization to pro-actively develop the creation of more value from its products and services enabling it to build lasting value for the organization and its stakeholders. Although the above may be fiction to any company as per today, technology is emerging fast to create such readily-available and easy-to-access data enabling management decision making. Roadmap to robust non-financial information 5

8 5. Improving your lines of defense B. Second line of defense: smart data analytics Data analytics is a strongly emerging discipline and it is also receiving more and more attention in relation to NFI. Smart analytics can reveal reporting errors in NFI, thereby supporting the continuous improvements in a company s journey to more robust NFI. Smart analytics is based on smart business rules that have been set to perform the analysis. For instance, consider a company with global operations (>100 sites) that report on energy consumption and greenhouse gas and other emissions i.e. NOx, organic emissions and SO2. The energy consumption types involved range from oils and coals, to gas and electricity. The combustion of coal results in NOx content as a consequence of the chemical content of coal. Therefore, sites that use coal as energy source, also emit NOx. Smart data analytics may reveal sites that use coal as energy source, but do not report on NOx emissions. Smart data analytics is especially powerful as it provides a full coverage of the data rather than a simple data sample. C. Third line of defense: internal audits role in assuring NFI The role of internal audit in assuring NFI is strongly under development within most companies. Traditionally, internal audit departments have an established role in areas such as Health, Safety & Environment (HSE) compliance. In reality, however, internal audit is rarely involved in verifying the accuracy and completeness of NFI information. Internal audit can play a critical role in the NFI reporting and data management including the following: 1. Providing recommendations regarding the improvement of controls for assuring the accuracy and completeness of non-financial data. Internal Audit s role should be focused on the most material disclosures (see next bullet). 2. Providing recommendations regarding the types of disclosures made (in external and internal reporting) and whether the information is material and meets stakeholder needs. 3. Evaluating the information to ensure it is consistent with available external reporting standards.

9 5. Improving your lines of defense D. The fourth line of defense: limited versus reasonable assurance A limited assurance engagement (review) is focused on the plausibility of the information while a reasonable assurance engagement (audit) enables the auditor to express a conclusion that the sustainability information is, in all material respects, correctly presented in accordance with the applicable criteria, for instance GRI. Procedures to obtain a limited level of assurance are less extensive in relation to both the risk assessment procedures (including understanding of internal control) and the procedures performed in response to the assessed risks, than those for reasonable level of assurance. As a result less assurance is provided when a client adopts limited assurance. It should be noted that there are additional procedures aimed at demonstrating the effectiveness of internal controls such as application controls, IT general controls and entity level controls (such as internal audit) in a reasonable assurance engagement. Also, the extent of testing the accuracy and completeness of reported NFI is higher in a reasonable assurance engagement. The extent of testing is decided based on the auditors risk assessment, which is highly dependent on the effectiveness of the company s internal controls. The business value of a limited assurance engagement is also distinctly different from a reasonable assurance engagement. The extensive testing procedures of a reasonable assurance engagement provide a stronger confidence to stakeholders that NFI is free from material misstatements. At the same time, the enhanced audit coverage provides organizations with more in depth management letter feedback enabling the organization to further strengthen its internal controls. Finally, a reasonable assurance engagement provides more visibility, credibility and awareness to businesses and stakeholders, accelerating change and differentiation from competitors. Limited assurance Objective: to conclude that nothing came to the auditors attention that could lead to the conclusion that the sustainability information is not prepared, in all material respects, in accordance with the applicable criteria (negative assurance statement / review) Reasonable assurance Objective: to provide an opinion that the sustainability information is free from material misstatement and that the sustainability information is prepared, in all material respects, in accordance with the applicable criteria (positive assurance statement / audit) Procedures: review / little emphasis on effectiveness of internal controls. Procedures: audit / emphasis on design and effectiveness of internal controls (e.g. including IT generals controls testing) and extent of testing data dependent on auditors risk assessment Business value: 1. Initial step in enhanced reporting reliability & maturity on sustainability disclosures Business value: 1. No difference in reliability of financial and non-financial information 2. More in-depth management letter audit findings enable further enhancement of reporting reliability & maturity of NFI disclosures 3. Visibility and awareness of importance of NFI results in further embedding of sustainability within business 4. Differentiate from competitors Roadmap to robust non-financial information 7

10 6 NFI challenges The challenges of NFI performance management generally depend on the maturity of the organization. Starters organizations that commence with NFI performance management typically face challenges related to definitions, governance and organizational competence. Frontrunners being advanced users of NFI typically face challenges related to preparing for reasonable assurance and the reporting of complex supply chain disclosures (e.g. scope 3 supply chain emissions). A more comprehensive overview of the challenges is provided in the table below. Below we address a couple critical elements in more detail. Starters Organizations that commence with NFI performance management and external reporting Typical challenges & required initiatives Setting uniform definitions, boundaries, scope and align these to available standards such as GRI, GHG, and <IR> Defining governance & controls Mobilizing NFI competence within remote operations Setting management targets Peleton Organizations that typically have the ambition to take further steps in monitoring NFI performance and external reporting including e.g. adopting the global reporting initiative reporting standard (GRI G4) Typical challenges & required initiatives Involvement of finance & controlling functions Building an effective third line of defense (Internal Audit) through enablement of terms of reference for audits for material operations and disclosures Technology enablement for NFI data management including performance dashboard and smart data analytics Limited assurance Efficiency of reporting Organizational change and Integrated Thinking Frontrunners Leaders in sustainability and advance users of NFI with the ambition to achieve maturity for NFI at the same level as their financial information Typical challenges & required initiatives Preparing for reasonable assurance including completeness of audit trails and effective processes and IT general controls Management and implementation of (complex) supply chain performance (e.g. scope 3 GHG reporting) Integration financial information and NFI to enable integrated thinking & acting Firstly, looking at the journey companies are undertaking, it is interesting to see what the role of Finance is in general and of Group Finance in particular. In the infant stage, most companies treat NFI reporting as a separate discipline, from a process and technology perspective. While maturing, most companies realize that leveraging Group Finance s experience, discipline and systems with data gathering for internal- and external reporting purposes, is beneficial to the entire organization. The need for integration is encouraged by the growing demand of external stakeholders for different, more frequent and more detailed information, driving the process towards integrated reporting. Also from an NFI assurance perspective, the need for Segregation of Duties (SoD), internal controls, audit trails and transparency perfectly fits the Group Finance function. 8 EY All rights reserved

11 6. NFI challenges Secondly, the efficiency of data management & reporting is critical to organizations. As organizations move to higher maturity in their NFI, they potentially experience higher costs mainly imposed by time spent by employees in data management and reporting. Hence, organizations need to consider more than just reporting effectiveness alone. They need to strike a careful balance to prevent the risk of being over- or under controlled as they are putting controls in place to make their NFI more robust. Thirdly, there is an increasing adoption of technology to enable NFI data management and this raises the question what ICT & process architecture delivers most value to the organization. More and more organizations realize that the manual reporting processes most often enabled by MS Office applications- are error-prone and labor intensive. Technology is critical in implementing segregation of duties controls, consolidation and disclosure of the reported information to the users. Automation can enable reporting templates and calculations according the various reporting protocols such as the Global Reporting Initiative and the WBCSD Green House Gas protocol. Pre-built conversion calculation rules allow companies to e.g. report on calculated NFI such as greenhouse gas emissions which is derived from direct emissions and energy consumption from electricity, coal, heat or other sources. Systems also typically enable complete audit trails (e.g. utility invoices) to ensure confidence and accuracy in the collection and consolidation of NFI, followed potentially by an external audit which utilizes this information as supporting evidence. Over the past years, niche software vendors have brought applications to the market that are focused purely on NFI. However, more recently, also the large ERP vendors have entered the market with NFI modules with similar functionality. This allows companies to embed NFI reporting & data management within their existing ERP infrastructure and processes. Finally, we mention the complexity of several NFI disclosures. For instance, reporting on scope 3 emissions is a struggle in terms of reporting for many organizations. The reason is that scope 3 emissions data is coming from a variety of (external) sources, including company s suppliers and information on the use of the products it produces. Example: Scope 3 reporting and data management The Green House Gas protocol defines scope 3 emission as indirect emissions that occur in the value chain of the reporting company, including both upstream and downstream emissions. Although these emissions do not occur within the boundaries of the company, they certainly can be influenced. For instance, companies can innovate their products in order to reduce the environmental or social footprint for their consumers. In addition, the upstream supply chain emissions, can be influenced as companies manage their source of supply. Reporting on scope 3 emissions is, however, complex and time consuming as it requires data to be collected from a variety of sources. Below we mention typical examples of scope 3 emissions and their data sources. Emissions as a consequence of transporting goods (supply chain management department) Business travel resulting in emissions from car or airplane travel (business travel department) Emissions during use-phase of products manufactured by the company (innovation department) Emissions of suppliers to produce incoming materials (procurement department) Roadmap to robust non-financial information 9

12 7 The journey of NFI in practice In this section we present a real-life case of a company that went through a journey of improving NFI and which has the ambition to keep developing NFI. The company laid the foundation in 2008 by defining ambitions for non-financial performance including the adoption of the Global Reporting Initiative standard. In that same year, KPI definitions were set, resources were mobilized and a manual reporting process was installed. Two years later, the reporting and data management was further developed by e.g. implementing segregation of duties, involvement of the finance function and the enablement of ICT for reporting. In that same year, limited assurance was obtained on the reported NFI from the external auditor. Over the years that followed, internal audit was mobilized as a third line of defense for NFI and more advanced controls were installed such as smart data analytics and the release of performance dashboards to operations. The latter was an important step to enhance the awareness for NFI as it enabled operations to further analyze and benchmark their performance. At the moment, the company is preparing for obtaining reasonable assurance which will take effect over the year The current focus is to enhance the effectiveness of internal controls, realize further compliance to definitions, and to document the full audit trail of social and environmental performance. The latter includes e.g. storage of utilities invoices and registration of chemicals mass balance information to account for the volatile organic emissions. An overview of the steps taken is visualized below. 1 st 1 st line of defense business & management controls 2 nd 2 nd line of defense finance & control functions 3 rd 3 rd line of defense internal audit 4 th 4 th line of defense external assurance Initial consolidation & review process installed Limited assurance MS Office based reporting Limited assurance readiness review Internal Audit program & procedures Global champions network established for deployment Segregation of duties installed Internal Audit Training Reasonable assurance gap analysis Uniform KPI definitions Finance function involved in NFI reporting Cascaded performance management system Internal audit effectiveness review Reasonable & Integrated assurance Manual & periodic reporting installed incl. training Bi-annual NFI performance review Board remuneration on NFI performance Enhanced automation of consolidation & review process Internal audit scope & effectiveness improvements Ambition & management directive defined Reporting process documented Smart data analytics enabled Sharing of good practices between sites & businesses Release of quarterly management reporting & review cycle Reporting scope and boundaries defined Workflow enabled ICT solution for NFI reporting implemented NFI performance dashboards released to business & sites New supply chain disclosures (e.g. scope 3) Continuous improvement of processes & definitions EY All rights reserved

13 8 How we can help The transformation of NFI to create robust and reliable performance, is an investment to organizations that unlocks significant business value. Like the finance and ERP transformation that companies went through, the NFI journey is not a standalone project but rather a transformation consisting of several initiatives including organizational change. EY has supported organizations in their journey to enable more robust NFI. Our services include those that are helpful for organizations that start with NFI, as well as those that support organizations that want to e.g. take the step to reasonable assurance or the enablement of specialized technology for environmental or social reporting. A limited overview of how we can help is provided below: Phase EY support Starters Definitions, scope and boundaries for NFI disclosures (e.g. based on GRI) Reporting processes Governance Limited assurance gap analysis Peleton Technology enablement for NFI reporting including data conversion and definition of process & controls Internal audit enablement (procedures & training) or co-sourcing of internal audit activities Limited assurance Frontrunners Reasonable assurance gap analysis, roadmap to reasonable assurance, reasonable assurance Scope 3 or other complex supply chain disclosures- reporting process and controls including scope, boundaries and definitions Integrated reporting support Impact measurement & reporting e.g. social and environmental impact Roadmap to robust non-financial information 11

14 9 Key questions to ask Organizations need to assess whether their management of NFI is optimized in the sense that is delivers the right information in a reliable and efficient manner. Several key questions are presented below to help organizations on their journey to optimize their management of NFI: 1 What is the current status of NFI management in your organization? 2 Do you get sufficient business value from NFI and do you have all the information to make business decisions? 3 Are you confident that NFI governance, processes and definitions are sufficiently robust? 4 Is the finance discipline involved in the management of NFI? 5 Do you leverage technology and is NFI management efficient? 6 Are skills and competencies within the various lines of defence at the desired level? 7 What are your ambitions for NFI and do you have a roadmap available to optimize the business value of NFI for your organization? Contact information Arno Scheepens arno.scheepens@nl.ey.com Jan Niewold jan.niewold@nl.ey.com Roy Linthorst roy.linthorst@nl.ey.com Nancy Kamp-Roelands nancy.kamp@nl.ey.com EY All rights reserved

15

16 EY Assurance Tax Transactions Advisory About EY EY is a global leader in assurance, tax, transaction and advisory services. The insights and quality services we deliver help build trust and confidence in the capital markets and in economies the world over. We develop outstanding leaders who team to deliver on our promises to all of our stakeholders. In so doing, we play a critical role in building a better working world for our people, for our clients and for our communities. EY refers to the global organization and may refer to one or more of the member firms of Ernst & Young Global Limited, each of which is a separate Legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients. For more information about our organization, please visit ey.com Ernst & Young Accountants LLP All Rights Reserved. ED none This material has been prepared for general informational purposes only and is not intended to be relied upon as accounting, tax, or other professional advice. Please refer to your advisors for specific advice. ey.com/nl