Control Framework ICSR

With sustainability reporting becoming more and more subject to legislation, it is time to expand your control environment. Strengthen your controls by stepping beyond the traditional internal controls over financial reporting (ICFR) and create internal controls over sustainability reporting (ICSR).

What controls do you need under CSRD?

CSRD provides only limited guidance on internal control design. This relative freedom allows you to implement a control environment that fits your needs concerning your material topics. But it also brings challenges: how do you know what controls will benefit your unique context?

Compliance with the Sarbanes-Oxley Act of 2002 (SOX) taught some organizations that adequate internal controls and robust processes are essential for reliable reporting across an organization. Other organizations need a lighter form of internal control to stay agile but still in control over their sustainability reporting processes.

How do we combine ICFR and ICSR?

Adding ICSR (Internal controls over Sustainability Reporting) to your existing ICFR (Internal Controls over Financial Reporting) is no easy feat. Keeping an agile focus while integrating scalable ESG-related internal controls into your current framework is a must. A tailored approach accelerates your organization’s ability to safeguard and combine reliable and consistent financial and non-financial reporting under CSRD.

How do we set up a control framework for sustainability reporting (ICSR)?

Implementing a comprehensive internal control environment around CSRD will be a journey, not a sprint.

We use 3 steps to establish control over sustainability reporting:

1. Position your organization
   An effective control framework starts at the top. Organizations position themselves somewhere on the continuum of a Compliance-driven to Strategy-driven framework. This is a board-level decision. What is the best answer for your situation?
2. Add sustainability to the three lines of defense
   You’re probably already using the three-lines-of-defense model for your ICFR. What sustainability responsibilities should be added to each line of defense? Do you need additional functions for ICSR?
3. Create reporting manuals and governance, internal risk & control frameworks
   Achieve effective internal control over sustainability reporting. Also, ensure consistency with financial reporting. Which reporting manuals do you need to add? What do you need to establish a comprehensive control framework (ICSR-COSO)?