.jpeg)
At the Produrable trade show, we held a round table discussion with future CSRD auditors. Lawyers and auditors all shared their vision of the CSRD, outlined their points of vigilance and described how the audits of this new exercise should be carried out.
The CSRD audit is at the heart of companies' concerns, all the more so for this first exercise, which has left many companies perplexed as to what is expected of this new European sustainability reporting format.
According to a survey conducted by Tennaxia in June 2024 among 208 companies soon to be subject to CSRD, ⅓ of them still had doubts about how the CSRD report would be audited, not fully grasping what was going to be audited and what was expected of the auditors. At this date, a good half of respondents indicated that they would work on this subject with the Statutory Auditor who already audits their financial reports. This can easily be explained, and appears to be a simple solution. These auditors already have a good overview of the company, its activities and its structure.
But is this the view of the auditors themselves? What do they think are the best processes to adopt for successfully completing this new exercise? And what are the main points of vigilance to be taken into account during the CSRD audit?
Who can audit CSRD reports?
In France, CSRD reports must be audited by Statutory Auditors or Independent Third-Party Organizations (OTI).
In order to acquire the status of sustainability auditor, these audit professionals will have to complete a 90-hour training course dedicated to sustainability issues and ESG criteria, delivered by a duly accredited training organization.
The Haute Autorité de l'Audit (H2A) will be responsible for monitoring the missions of these professionals, and for potential sanctions in the event of non-compliance. A list of accredited sustainability auditors is available on the H2A website.
From DPEF to CSRD, a change of dimension
France's historic extra-financial reporting format has been considerably enriched by the requirements of the CSRD.
Not only is the number of subjects covered and data points much greater, but the CSRD also provides new elements that enrich the analysis to be carried out as part of the production of its extra-financial report:
- Double materiality dual materialityincluding the evaluation of material IROs (Impacts, Risks and Opportunities) for each ESRS (European Sustainability Reporting Standard),
- Taking into account the company's stakeholders and their expectations,
- Taking into account information from the green taxonomy and its link with the information required by the ESRS,
- Implementation of a tagging system to enable computerized reading of data (iXBRL format),
- Determining an acceptable margin of error for each indicator processed.
These new elements profoundly alter the auditor's work. Under the DPEF, the auditor delivers a reasoned opinion on the conformity and sincerity of the information, as well as an attestation of the presence of the report by the statutory auditor. For the CSRD, the auditor will have to analyze each of the processes that led to the creation of this report and to the correct choice of data processed by the company.
Another major change is that, whereas the DPEF used to focus mainly on the company's historical information, the CSRD is also focusing on forward-looking information. The introduction of transition plans is a prime example. Auditing these plans and attesting to their credibility is therefore an exercise to which the auditors are not accustomed.
Finally, the DPEF stopped at the limits of the group's consolidated accounts, whereas the CSRD includes all stakeholders affected by the company's impacts. The scope of analysis is therefore considerably broader, and both the company and the auditor will have to determine which link in the value chain (suppliers, subcontractors, customers, users, etc.) is relevant to take into account in the sustainability report.
In the first few years, the auditor is more likely to focus on the processes implemented by the company to produce its CSRD report than on the data collected and the information provided.
What is the company's scope of study? How did it conduct its dual materiality analysis to determine the ESRS relevant to its business? Are they consistent with those of similar companies? How were the key issues determined for each of the company's activities and sites? Have the IROs been correctly analyzed, and how?
As the auditors themselves recognize, given the complexity of the CSRD and the various ESRSs that make up this sustainability reporting standard, their posture for the first year should be that of an accompanying auditor, with a lower level of requirements and a progressive vision of sustainability reporting.
The CSRD also specifies that the information contained in the reports will be audited on a limited assurance basis until 2028, when the audit engagement should be upgraded to a reasonable assurance level.
A radical cultural shift in expected documentation
The CSRD will require the justification of each item of information contained in the sustainability report. This essential point should make it easier for auditors to verify the transparency and sincerity of companies.
For companies formerly subject to the DPEF, the process of documenting each piece of information with evidence is already well established. But the CSRD will eventually concern a much larger number of companies, who will have to integrate this notion of probative documentation.
This methodology applies not only to the various data points, but also - and this is a new point - to the analysis of double materiality. The determination of material stakes cannot be based solely on expert opinion, and the inclusion or exclusion of data points must be justified and documented.
The CSRD must make ESG reporting more observable and objective. It is therefore necessary to enrich the report with scientific analyses, data and concrete explanations of the assumptions that led to certain decisions. These documents must make it possible to explain the methods that were applied, the approaches that were followed and, ultimately, to justify any potential discrepancies observed.
The auditor will need to ensure that the reporting achieves its objectives, i.e. that it conveys information that is clear, sincere, objective, usable and comparable. The CSRD report must therefore be a "dry" report, not one to tell tall tales, one of the biases that could be found in DPEF reports. Narratives must be highly descriptive, factual, based on observable and auditable data, leading to a specific action and a precise scope. This is essential to ensure the comparability of the various reports. Point requested by the CSRD and which will not be tolerated by the auditor: communicating on non-material subjects, the risk being to dilute the material information for the future reader.
This comparability of data is essential, both from one financial year to the next and from one company to the next. Consistency of information is a key objective of this legislation, the aim of which is to enhance the transparency of ESG information provided by companies. Auditors will therefore need to ensure that the information provided is comparable. However, EFRAG's ixbrl taxonomy, which is intended to mark out data points and thus facilitate their harmonization, readability and digital processing, has not yet been finalized. The process is therefore likely to be iterative, and will be refined over time.
Finally, beyond the radical change in documentation, there is likely to be a significant cultural change in the company's organization. Given the expectations of this report, particularly with regard to the financial dimension of IROs and the transition plan, we are witnessing a pooling of leadership between the ESG department and the finance department, which is now much more involved in decision-making. This organizational change may nevertheless facilitate the work of the auditors, as CFOs are already accustomed, in the context of the financial audit, to providing evidence for each piece of data entered and decision taken.
Auditing the transition plan: a new challenge
As we mentioned earlier, one of the major differences between CSRD and DPEF is the shift from an analysis based exclusively on historical information to one also based on forward-looking information.
The most eloquent case is the implementation of the transition plan requested of companies inESRS E1, dedicated to climate change.
According to Tennaxia's survey, this ESRS is considered material by 98% of the companies questioned. A relatively unsurprising result, considering two things:
- It is difficult to justify denying the impact of our activities on the climate. Economic activity inevitably generates greenhouse gas emissions in all 3 scopes.
- This ESRS receives special treatment. It is the only one for which the company will have to duly justify its decision if it does not consider it material (and we wish it good luck in this case).
After measuring their carbon footprint and performing an IRO analysis, companies will now be required to submit full details of their transition plan. This concerns the objectives set, the timetable for implementation, the actions taken and the associated budget. However, according to the Tennaxia study, 48% of companies indicated that they still had doubts about the implementation of climate transition plans. Once again, this figure seems logical, given that this is a new exercise for many companies now involved, in the short or medium term, in CSRD, and that it is governed by a strict methodology.
These concerns seem to materialize on 2 main points that will also be scrutinized by the auditors:
- Visualize and assess the impact of the action plan in terms of GHG emissions and financial investments. This involves defining an action plan, estimating its impact and calculating the associated costs in terms of CapEx, OpEx and even savings linked to this transition.
- Comparability of data year after year. Measuring a carbon footprint in year N is relatively straightforward, but a company is not a fixed element, it changes (ERP change, plant opening or closing, change of emission factor on certain values...). Added to this is its structural complexity: different sites, different contacts... All this means that tracing the evolution of a carbon footprint becomes a real balancing act from year N+1 onwards.
The transition plan audit de facto renders obsolete the use of the traditional Excel file still often used to measure carbon footprints. The use of a dedicated tool for modeling and tracking data will become a must-have.
The auditors will scrutinize these action plans and, to ensure their sincerity, will need to have a clear vision of the associated objectives and financial estimates, and will necessarily ask about the calculation methods applied, the assumptions made and the extrapolations made. They need to be able to trace all the data back to the impact graph presented to them. Relying on a tool will therefore become essential, but it will also be necessary to ensure that this tool is as transparent as possible.
Many people are also tempted to rely on artificial intelligence tools. In this case, it is essential to use them with care. In many cases, AI is a black box that doesn't allow you to properly trace the source data and the way it was processed to build this transition plan.
Summary of the main points to watch out for
To sum up, the main points companies need to watch out for to ensure that their audit goes off without a hitch are as follows:
- Provide evidence for each item of information entered
- Demonstrate total transparency
- Remain objective in your analyses
- Describe the methodologies applied, the assumptions made and the calculation methods used
- Ensure data comparability
- Equip yourself with tools for tracking data
Justify, prove, trace.
These 3 verbs should be your leitmotiv when compiling your sustainability report.
As the complexity of the ESRS can be a hindrance, some organizations have undertaken simplification work to help companies and auditors identify the main expectations of the CSRD report. These documents include
- H2A guidelines
- Middlenext recommendations
- ANC (Autorité des Normes Comptables) FAQs on the various ESRSs
Lastly, even though the auditors have received compulsory training before being authorized to audit CSRD reports, this is also their first year auditing these reports, which promise to be particularly dense, and whose editing process is strictly regulated. It is therefore likely that they will not be at their most demanding in the first year. Nevertheless, don 't hesitate to discuss with them beforehand to validate your methodologies, whether for double-materiality analysis, IRO validation, etc. This is the best way to ensure that you're on the right track and don't risk having to repeat the whole exercise.
