The Current State and Future Implications of Environmental, Social, and Governance Assurance

The financial press produces a variety of listings of the “most sustainable corporations.” Each of these lists is compiled using various metrics and measures to rank and compare companies’ environmental, social, and governance (ESG) information. While the effort to create these rankings is robust, including examinations of numerous disclosures, often notably absent from consideration is information on the external verification of these ESG reports. In this paper, we examine two of these lists through the lens of external assurance.

Specifically, we analyze the publicly available ESG reports of companies on The Wall Street Journal’s list of the top 100 sustainably managed companies (The Wall Street Journal 2021) and Investor’s Business Daily’s 100 best ESG companies of 2021 (Investor’s Business Daily 2021). We collect information on whether the ESG reports are assured, the type of assurance and assurance standards cited, the firm that provides the assurance, and whether this firm is the same or different from the financial statement auditor. Given the lists contain both domestic and international companies, we further examine any differences in this information by geography.

Our findings indicate that, though the listed companies are labeled as strong in sustainability, large portions, led by U.S. companies, do not have their reports assured. Specifically, statistical analysis shows specific industries, such as mining, are significantly associated with obtaining assurance, while specific stock exchanges (NASDAQ and NYSE) are negatively associated with obtaining assurance. When assurance is present, it typically takes the form of a review engagement, providing limited assurance over ESG information. Internationally, Big 4 audit firms dominate the list of assurance providers; however, in the U.S. a more diverse range of assurance providers appear. There is some overlap between financial statement auditor and ESG assurance provider.

We build on recent research conducted by the Center for Audit Quality covering ESG reporting by the S&P 500 by examining a subset of high-scoring ESG companies that include U.S. and international companies (Center for Audit Quality 2021). The aim of this study is to provide groundwork for practitioners and future academic research by summarizing important trends and information about the current state of ESG assurance in the global market.

We analyze ESG reports from the year 2020 issued by the sample companies to determine if the reports are independently assured. Assurance can be provided on the entire ESG report or on more specific portions, such as greenhouse gas emissions and energy efficiency (the “E” in ESG); gender, diversity, and employee engagement (the “S”); and anticorruption and executive compensation (the “G”). Examples of the assurance reports provided by public accounting firms and nonpublic accounting firms are included in  Appendix A.

The final sample consists of 194 companies, since six companies appear on both The Wall Street Journal and Investor’s Business Daily lists. Of the 194 companies, 113 (58 percent) voluntarily engaged an independent organization to provide external assurance services for some portion of their ESG reports. These companies cited various motivations for the third-party verification, including improving the accuracy, objectivity, or reliability of their disclosures; ensuring credibility of the data reported; and reviewing and facilitating regulatory compliance. Of the 81 companies (42 percent) that did not have their disclosures assured, some explicitly state that they do not seek any external assurance or that external assurance is not yet mandatory.

Of the 99 U.S. headquartered companies in the sample, only 39 percent obtained some level of external assurance of their ESG reports compared to 78 percent of the 95 internationally headquartered companies. Table 1 provides a breakdown of the industries and stock exchanges represented by the sample and the percentage of companies assured in each group. Companies listed on the over-the-counter market are cross-listed foreign companies. Using a regression where the dependent variable captures the probability of obtaining assurance, we find that companies in the mining industry are moderately more likely to obtain assurance than companies in other industries (p < 0.10). We also find that firms listed on the NYSE and NASDAQ and, relatedly, are headquartered in the U.S., are significantly less likely to obtain assurance (p < 0.01).

As of the date of the data collected in this paper, there was no requirement for U.S. companies to disclose much ESG information or have it assured. However, market dynamics and societal demands have motivated organizations to improve transparency in these areas. In March 2022, the Securities and Exchange Commission issued a proposal that would require companies to include data on direct greenhouse gas emissions in their public filings and have this information verified by a third party (Tysiac 2022). The European Union is ahead of the United States in this area, announcing in April 2021 its intention to require certain ESG disclosures and have this information audited (European Commission 2021).¹ Japan, which has the second largest representation in the sample (n = 15), has also announced requirements for companies to disclose emission and other climate-related information (Nikkei 2021).

A variety of organizations can provide assurance services relating to ESG areas, including accounting firms, engineering firms, and environmental consulting firms. According to the American Institute of Certified Public Accountants (AICPA), “assurance on sustainability information is a process whereby an independent practitioner performs procedures, obtains evidence, and after obtaining reasonable or limited assurance about the information, expresses a conclusion…designed to enhance the degree of confidence of decision-makers using that information” (AICPA 2020, 4). Accounting firms can provide assurance services that align with the AICPA’s Statements of Standards for Attestation Engagements (SSAEs), which only certified public accountants are qualified to use (AICPA 2020).

AICPA attestation standards define two levels of assurance services relating to companies’ ESG reports: reasonable assurance and limited assurance. Reasonable assurance is obtained in an examination engagement (SSAE 21), and limited assurance is obtained in a review engagement (SSAE 22). A review consists of more limited procedures and provides a lower level of assurance than an examination.

Internationally, standards set by the International Auditing and Assurance Standards Boards (IAASB) guide global work performed by auditing firms. The IAASB issues International Standards on Assurance Engagements (ISAEs) to cover procedures for assurance engagements other than audits or reviews. These standards also specify reasonable and limited assurance attestation engagements (IAASB 2013, ISAE 3000 Revised).

AccountAbility is a global consulting and standards firm that has created a principles-based framework to guide organizations to prepare ESG information and guide organizations to verify this information (AccountAbility 2020). AccountAbility’s AA1000 Assurance Standard (AS) is a methodology for ESG-related assurance engagements to assess whether an organization adheres to AccountAbility’s principles. These standards reference the terms high and moderate assurance. High assurance refers to extensive evidence gathering and a relatively high level of confidence, whereas moderate assurance refers to limited evidence gathering and a relatively lower level of confidence (AccountAbility 2020).

 Appendix A contains an example of a reasonable assurance engagement report conducted under ISAE by EY for Koninklijke Philips N.V., a limited assurance review engagement report conducted under AICPA standards by PwC for Nike, a reasonable assurance engagement report conducted under ISAE by Apex for Apple, a moderate level of assurance engagement report conducted under AA1000AS by Trucost for NVIDIA, and a mixed reasonable and limited assurance engagement report conducted under ISAE by Deloitte for Yara International.

Two of the 113 sample companies that obtained external assurance had reports in a foreign language; thus, 111 external assurance reports were examined in detail. Table 2 shows the type of assurance provided, with most verification consisting of review engagements with limited assurance. For both the U.S. and international subsamples, limited assurance engagements are the dominant form of verification provided on ESG reports. Five percent of reports reference both reasonable and limited assurance.

The ESG assurance reports include information about which reporting frameworks and standards are utilized to guide the external verification process. Regardless of the assurance provider, each assurance engagement in the sample was performed in accordance with a reporting framework. Table 3 shows the breakdown of standards and frameworks cited. Overall, the most commonly cited standards were ISAE 3000 (Revised) Assurance Engagements Other than Audits of Historical Financial Information, and ISAE 3410 Assurance Engagements on Greenhouse Gas Statements followed by the International Organization for Standardization’s ISO 14064-3: Greenhouse Gases—Specification with Guidance for the Validation and Verification of Greenhouse Gas Assertions. This standard “describes the process for verification or validation, including verification or validation planning, assessment procedures, and the evaluation of organizational, project and product greenhouse gas statements” (International Organization for Standardization 2019).

Interestingly, the AICPA’s AT-C Section 105 Concepts Common to All Attestation Engagements is the least often cited standard. Cited more often than the AICPA is AccountAbility’s AA1000AS. Globally recognizable companies that had these standards cited in their external assurance report include Ericsson and Nestle. Fourteen of the 15 assurance letters referencing AA1000AS were from Big 4 audit firms.

The specific assurance providers are presented in Table 4. As with financial statement audits, the Big 4 firms dominate the market for ESG assurance engagements. Big 4 firms account for 42 percent of the ESG assurance engagements examined, with Deloitte, PwC, and KPMG each making up 12 percent and EY 6 percent. This dominance is most prevalent in the international subsample, where 57 percent of the assurance engagements are conducted by Big 4 firms. In the U.S., the Big 4 comprise only 16 percent, indicating a wider distribution of assurance providers are engaged for ESG assurance services in the U.S. It is interesting to note that the only public accounting firms to assure the ESG reports in the U.S. subsample were the Big 4.

Apex was the most often used assurance provider in the U.S. subsample (26 percent of firms), assuring household names such as Apple, Facebook (Meta), eBay, Microsoft, and Intel. This was followed by ERM Certification and Verification Services (18 percent), who assured U.S. companies such as Johnson & Johnson, Caterpillar, and Eli Lilly.

Given that providing assurance over ESG reporting is relatively new, the question of “who” is the best party to provide that assurance remains salient. Ho (2021) provides evidence that large companies prefer that ESG data be assured by a provider other than financial statement auditors and that most companies currently utilize consulting or engineering firms. This, however, provides accounting firms an opportunity to expand upon their current assurance services for companies, though these firms would need to pivot their expertise to these areas. Specifically, Cohn (2021, para. 23) notes that “accounting firms have some catching up to do with the consulting firms and sustainability specialists that have been helping companies with their ESG compliance.”

Lastly, we examine whether the financial statement auditor was the same or different from the ESG assurance provider. Internationally, 39 percent of companies in the sample used the same Big 4 firm to provide both financial statement and ESG assurance, while in the U.S. that percentage drops to 13 percent. This is consistent with the Big 4 dominating the ESG assurance market globally but not in the U.S. We also find that 12 percent of the overall sample uses one Big 4 firm for the financial statement audit and a different Big 4 firm for the ESG assurance engagement.

For companies that have both their financial statements and ESG reports assured by the same public accounting firm, there could be potential negative implications, especially concerning fee dependency. Could financial statement auditors be pressured to provide clean opinions to companies to whom they are also providing ESG report assurance? The Sarbanes-Oxley Act of 2002 requires that auditors be independent of the companies they audit and prohibits auditors from engaging in other nonfinancial or consulting services to audit clients (U.S. House of Representatives 2002). This begs the question as to how ESG assurance engagements should be classified: Are they additional assurance services, or are they a type of consulting engagement? Does performing both financial statement audits and ESG assurance create an independence issue for auditors?

These analyses have implications for regulators, companies, and auditors to consider as ESG reports become more ubiquitous. Given that corporations in western Europe and parts of Asia are generally ahead of the U.S. in terms of incorporating ESG into their external reporting, U.S.-based companies should look to internationally based companies for best practices for ESG reports and assurance. Public accounting firms should consider training employees on ESG assurance and closely monitor new and emerging standards. Mid-size, small, and local public accounting firms should determine if ESG assurance is an area of specialization that will become part of their practices. Regulators should be proactive in determining whether they consider ESG assurance in conflict with financial statement audits. Future research could provide answers to questions such as whether providing both financial statement audits and ESG assurance negatively impacts audit quality.

Future research could also address the compliance costs of providing ESG assurance, as well as whether the market rewards those companies that seek to obtain external verification of their ESG reports. Specific content areas that are most often assured in ESG reports should also be examined, such as emissions data or governance metrics. Additionally, further cross-country comparisons can be made, particularly in instances where country-specific mandates regarding assurance of ESG information varies.

The variety of standards cited within the assurance reports open up interesting avenues for future research. For example, future work can explore more in depth the specific assurance standards created by nontraditional organizations, such as AccountAbility, and how this may complement or contrast with guidance from more traditional entities, such as the AICPA or IAASB. Given the majority of ESG reports in the U.S. are generated from publicly traded companies, it would be interesting to track any developments by the Public Company Accounting Oversight Board as it relates to the guidance for assurance providers. Lastly, as the push for international ESG disclosure standards continues to make progress due to the creation of the International Sustainability Standards Board by the International Financial Reporting Standards Foundation (2021), future research can explore the costs and benefits of developing a single, global ESG assurance framework.

This appendix provides examples of assurance reports over ESG information. It contains the following companies and assurance providers:

• Koninklijke Philips N.V. assured by EY

• Nike, Inc. assured by PwC

• Apple, Inc. assured by Apex Companies

• NVIDIA assured by Trucost

• Yara International assured by Deloitte