Both for companies and auditors, the Corporate Sustainability Reporting Directive (CSRD) brings challenges but also opportunities. By requiring assurance on sustainability reports, auditors are expected to develop new skills and become experts on sustainability issues, while companies are expected to apply a holistic approach in assessing risks, impacts, and operations.
Sustainable business practice has become a key element of business strategies worldwide. In response to increasing stakeholder expectations regarding transparency on environmental, social, and governance (ESG) issues, one of the most important European legal regulations has been enacted – the Corporate Sustainability Reporting Directive (CSRD).
This directive is actually a revised version of the previous Non-Financial Reporting Directive, introduced by the European Union as part of the Green Deal and the Sustainable Finance Agenda. Its aim is to improve and expand sustainability reporting requirements, enabling more consistent and comparable data on ESG factors while aligning corporate disclosures with the EU’s sustainability goals. Its purpose is to fill the gaps in sustainability reporting that existed in the previous Non-Financial Reporting Directive, and it is based on global standards for sustainability-related disclosures, such as those developed by the International Sustainability Standards Board (ISSB). Key elements of the Directive include an expanded reporting scope, the concept of double materiality, the application of European Sustainability Reporting Standards, the provision of independent assurance on sustainability reports, and digitalization and accessibility. Compared to the previous Non-Financial Reporting Directive, the CSRD expands the reporting scope to all large companies regardless of whether they are listed on the stock exchange and to certain small and medium-sized enterprises.
New obligations
According to the concept of double materiality, companies are required to assess sustainability risks and impacts through the lens of double materiality. This means they must report not only on how sustainability issues affect the company (financial materiality) but also on how the company’s operations impact society and the environment (impact materiality).
—
—
Furthermore, the CSRD introduces mandatory reporting standards known as the European Sustainability Reporting Standards (ESRS), developed by the European Financial Reporting Advisory Group (EFRAG) and aligned with global frameworks such as TCFD (Task Force on Climate-related Financial Disclosures) and GRI (Global Reporting Initiative). EFRAG has since developed the first set of ESRS, which was adopted by the European Union in December 2023. The standards are divided into three groups, namely thematic, cross-sectoral, and sectoral standards. The first set of ESRS that came into effect includes two cross-sectoral standards, five thematic standards related to the environment, four thematic standards related to society, and one standard related to governance.
Additionally, one of the most important changes introduced by the Directive is the requirement for companies to seek independent assurance on sustainability information. This shifts sustainability reporting from voluntary or self-declared disclosures to more rigorous, verifiable, and reliable reports. Finally, the CSRD also requires companies to make their sustainability reports machine-readable and accessible through the European Single Access Point (ESAP), allowing stakeholders easy access to and comparison of data between individual companies and sectors. To meet this requirement, EFRAG has developed and published a taxonomy on August 30 that will enable the digital tagging of disclosures related to the first set of ESRS. This taxonomy will be transposed into EU legislation as part of the development of regulatory technical standards by the European Securities and Markets Authority (ESMA).
Even more required information
According to the Directive, companies must disclose a wide range of ESG-related information, including (but not limited to) information related to environmental factors (disclosures related to greenhouse gas emissions, water and energy consumption, impact on biodiversity, and waste management), social factors (employee welfare, diversity and inclusion, human rights, health and safety, social impacts in the company’s supply chain), and governance factors (corporate governance structure, composition of management, boards, and supervisory bodies, executive compensation, anti-corruption measures, and the company’s ethical business policy). Additionally, companies must disclose risks and opportunities related to climate change and other sustainability issues that may affect their financial performance or represent long-term strategic risks for them.
—
—
The goal of these disclosures is to provide stakeholders with a comprehensive overview of the company’s sustainability and perspectives. It is important to note that the CSRD aligns sustainability reporting with financial reporting, considering these disclosures equally important and reliable as financial data.
From limited to reasonable assurance
According to the CSRD, auditors must perform limited or reasonable assurance procedures, depending on the specific requirements set by the EU and member states. In the initial phases of the CSRD’s implementation, companies will be subject to limited assurance on their sustainability reports, which is less extensive than reasonable assurance and provides less certainty. The CSRD anticipates a transition to reasonable assurance in the future, which requires a more thorough assessment of sustainability data, systems, and processes, equivalent to the level of assurance for financial statements.
Regardless of the level of assurance, auditors are expected to follow a structured approach to ensure the integrity, accuracy, and reliability of the published information when conducting assurance procedures on sustainability reports. Therefore, auditors expect companies to meet their requirements when preparing sustainability reports.
The initial step in implementing procedures involves understanding the company’s sustainability strategy, its operations, and specific ESG-related issues it faces. Therefore, companies are expected to develop that strategy, manage sustainability-related risks, and create a methodology for assessing double materiality and related policies.
Risk assessment
After understanding sustainability strategies and related processes, auditors must identify areas in the sustainability report where there is a risk of material misstatement. This includes assessing inherent risks and control-related risks. Therefore, it is crucial for companies to have a clearly defined method for measuring relevant data and a description of the applied assessments, as well as a list of data sources used in preparing the sustainability report. To gain additional assurance in the reliability of the data used in preparing the sustainability report, auditors may assess the effectiveness of the company’s internal controls in sustainability reporting, including systems for collecting, recording, and reporting sustainability data. Companies should, therefore, have appropriate policies, procedures, and governance structures integrated into an effective internal control system that ensures the accuracy of sustainability information.
—
—
The next step in implementing procedures involves gathering evidence from various sources such as interviewing key personnel involved in preparing the report, reviewing documents and related records, observing the collection of data and sustainability reporting, and collecting certificates and/or confirmations from third parties such as suppliers or consultants providing sustainability data. After gathering evidence, auditors must test the underlying data used to prepare the sustainability report, including greenhouse gas emissions, energy consumption, diversity statistics, and other relevant data, which may include recalculating certain metrics, verifying data with external sources, and testing assumptions used in the company’s calculations. Companies should ensure an efficient and adequate process for exchanging the aforementioned documents and information.
As a final step, auditors must assess the completeness of disclosures in the prepared reports, i.e., whether the sustainability reports included all necessary disclosures according to the CSRD, relevant European Sustainability Reporting Standards, and EU taxonomy, including disclosures related to risks, opportunities, and impacts related to sustainability.
A shift in Europe
In conclusion, it can be stated that the CSRD marks a significant shift in corporate sustainability reporting in Europe. By expanding the scope of companies required to report on sustainability, introducing mandatory reporting standards, and requiring independent assurance on sustainability reports, the CSRD helps increase the quality and reliability of sustainability data.
Both for companies and auditors, the Corporate Sustainability Reporting Directive (CSRD) brings challenges but also opportunities. By requiring assurance on sustainability reports, auditors are expected to develop new skills and become experts on sustainability issues, while companies are expected to apply a holistic approach in assessing risks, impacts, and operational business. As sustainability reporting becomes increasingly integrated into corporate reporting frameworks, auditors will play a key role in ensuring that the information stakeholders rely on can be considered credible, ultimately helping to build trust and accountability in the corporate sector’s sustainability efforts.
