ESG Audit

An ESG audit assesses an organisation's performance in the environmental (E), social (S) and governance (G) domains together with the data it discloses publicly in those domains. The scope has two sides: whether the practices are real, and whether the reported data are accurate.

The aim is to show that the sustainability information presented to investors, customers and regulators is well founded, and to reduce the risk of greenwashing.

• Companies publishing a sustainability report
• Businesses subject to investors' and lenders' ESG requirements
• Groups within scope of corporate sustainability reporting
• Suppliers whose supply chain requires ESG performance
• Companies ahead of a public offering or investment process

The criteria are the reporting framework applied: GRI, ESRS, ISSB/IFRS S1-S2, SASB, or the investor's own ESG questionnaire. On the data-accuracy side, ISO 14064 and related measurement standards are used.

• The ESG governance structure and board oversight
• The materiality analysis and stakeholder engagement
• Environmental data: energy, water, waste, emissions
• The greenhouse gas inventory and calculation method
• Social data: employment, diversity, occupational safety, training
• Supply-chain social and environmental performance
• Business ethics, anti-bribery and compliance
• Targets, commitments and progress tracking
• Data-collection processes and internal controls
• Traceability of the reported data back to its source
• The completeness of the disclosures the framework requires
• The basis for environmental claims and greenwashing risk

• GRI Standards
• ESRS
• IFRS S1 / S2
• ISO 14064
• ISAE 3000
• ISO 19011

1. 1Selecting the Criteria to ApplyThe standard, scheme or legislation against which the audit will be performed is determined; in subject-specific audits the choice of criteria directly determines what the result means.
2. 2Risk Assessment and ScopeRisk areas are identified according to the organisation's activity and location; the number of audit days is planned accordingly.
3. 3Review of Documents and RecordsPolicies, procedures, permits, measurement records and the results of previous audits are examined.
4. 4On-site AuditThe relevant areas are walked; subject-specific measurements, observations and record checks are made.
5. 5Worker InterviewsWhere the subject requires it, confidential interviews with workers are held independently of management; statements are compared with the records.
6. 6Assessment of Legal ComplianceCompliance with the legislation in force is checked separately; a legal nonconformity is the most serious category of finding in every scheme.
7. 7Reporting of FindingsFindings are classified by severity and compiled into a report.
8. 8Corrective Action and Follow-upA corrective action plan is obtained; its close-out within the period prescribed by the scheme is followed up.

Findings fall into two categories: performance findings (gaps in practice) and data findings (reported data lacking a basis, calculation error, scope inconsistency). Data findings carry higher risk when a publicly disclosed report is involved.

• Details of the audit body, the auditor and the auditee
• Standard, scheme or legislation applied
• Date, duration and scope of the audit
• Findings from the review of documents and records
• On-site observations and measurement results
• Findings from worker interviews, where held
• Assessment of legal compliance
• Findings, their severity and the supporting evidence
• Corrective action plan and time limits

An ESG audit and sustainability report ASSURANCE are different engagements. Assurance is carried out under an assurance standard such as ISAE 3000 and produces a limited or reasonable assurance statement; an ESG audit produces a findings report. An ESG audit is also not a rating; it should not be confused with the score given by ESG rating agencies.

Accreditation differs with the type of audit. Third-party audits underpinning management system certification are carried out under ISO/IEC 17021-1 and those underpinning product certification under ISO/IEC 17065; these scopes are subject to accreditation. First- and second-party audits, and audits governed by a scheme owner's own rules (such as SMETA or amfori BSCI), do not fall within accredited certification; they are conducted following the ISO 19011 guidance and produce a report. EUROLAB holds internationally recognised accreditation under ISO/IEC 17021-1 and ISO/IEC 17065, granted by accreditation bodies that are signatories to the IAF multilateral recognition arrangement; which audits can be offered within accredited scope is confirmed in writing at the quotation stage.

• Social Compliance Audit
• Environmental Audit
• OHS Audit
• Energy Audit
• Cybersecurity Audit
• Data Protection Audit