Navigating COSO’s Updated Sustainability Reporting Guidance

Principle 1: Demonstrate commitment to integrity and ethical values

The organization demonstrates commitment to integrity and ethical values.

An organization furthers its objectives by demonstrating to its stakeholders that it is trustworthy and acts in the public interest. An entity demonstrates its commitment to acting sustainably.

• Set the tone at the top
• Establish standards of conduct
• Evaluate adherence to standards of conduct
• Address deviations in a timely manner

Principle 2: Exercise board of directors’ oversight responsibilities

The board of directors demonstrates independence from management and exercises oversight of the development and performance of internal control.

Oversight by an independent board of directors serves as a check that management is acting in accordance with the organization’s sustainable business objectives.

• Establish oversight responsibilities
• Apply relevant expertise
• Operate independently
• Provide oversight for the system of internal control

Principle 3: Establish structures, authority, and responsibilities

Management establishes, with board oversight, structures, reporting lines, and appropriate authorities and responsibilities in the pursuit of objectives.

As it endeavors to meet its sustainable business objectives, an organization’s management, with the oversight of the board of directors, establishes internal structures that set out authority and responsibilities.

• Consider all structures of the entity
• Establish reporting lines
• Define, assign, and limit authorities and responsibilities

Principle 4: Demonstrate commitment to competent human resources

The organization demonstrates a commitment to attract, develop, and retain competent individuals in alignment with objectives.

To meet its sustainable business objectives, an organization depends on its human resources.

• Establish policies and practices
• Evaluate competence and address shortcomings
• Attract, develop, and retain individuals
• Plan and prepare for succession

Principle 5: Enforce accountability

The organization holds individuals accountable for their internal control responsibilities in the pursuit of objectives.

To meet its sustainable business objectives, an organization needs to establish and implement meaningful ways to support its human resources and, at the same time, monitor performance.

• Enforce accountability through structures, authorities, and responsibilities
• Establish performance measures, incentives, and rewards
• Evaluate performance measures, incentives, rewards, and disciplines
• Consider excessive pressures
• Evaluate performance and rewards or disciplines individuals

The organization specifies objectives with sufficient clarity to enable the identification and assessment of risks relating to objectives.

With clarity, an organization expresses its sustainable business objectives. These objectives are a means to tie the organization’s purpose or mission, values, and corporate social responsibility goals to strategy. An organization’s sustainable business objectives follow from its commitment to integrity and ethical values and are integrally linked to its objectives including operational, external financial reporting, external nonfinancial reporting, internal reporting, and compliance objectives.

Explicit expression of these objectives is a predicate to considering risks, that is, the likelihood that events will occur that may be detrimental to the organization.

Operations Objectives:

• Reflect management’s choices
• Consider tolerances for risk
• Include operations and financial performance goals
• Form a basis for committing resources

External Financial Reporting Objectives:

• Comply with applicable accounting standards
• Consider materiality
• Reflect entity activities

External Nonfinancial Reporting Objectives:

• Comply with externally established standards and frameworks
• Consider the required level of precision
• Reflect entity activities

Internal Reporting Objectives:

• Reflect management’s choices
• Consider the required level of precision
• Reflect entity activities

Compliance Objectives:

• Reflect external laws and regulations
• Consider tolerance for risk

Principle 7: Identify and analyze risks to meeting sustainable business objectives

The organization identifies risks to the achievement of its objectives across the entity and analyzes risks as a basis for determining how the risks should be managed.

To meet its sustainable business objectives, an organization needs to establish and implement meaningful ways to support its human resources and, at the same time, monitor performance.

• Include entity, subsidiary, division, operating unit, and functional levels
• Analyze internal and external factors
• Involve appropriate levels of management
• Estimate significance of risks identified
• Determine how to respond to risks

Principle 8: Assess fraud risk

The organization considers the potential for fraud in assessing risks to the achievement of objectives.

In identifying and assessing the risks to achieving its sustainable business objectives and developing an effective response, an organization considers the risk that actors will engage in fraudulent activities such as intentional misstatements or misappropriation of valuable resources.

• Consider various types of fraud
• Assess incentives and pressures
• Assess opportunities
• Assess attitudes and rationalizations

Principle 9: Identify and analyze significant changes and emerging trends

The organization identifies and assesses changes that could significantly impact the system of internal control.

As part of identifying and assessing risks to achieving its sustainable business objectives, an organization considers emerging trends. Sustainability-related risks are evaluated in an ongoing manner or periodically to respond to regulatory trends and economic drivers.

• Assess changes in the external environment
• Assess changes in the business model
• Assess changes in leadership

Principle 10. Select and develop control activities

The organization selects and develops control activities that contribute to the mitigation of risks to the achievement of objectives to acceptable levels.

Once an organization has identified and assessed risks to achieving its sustainable business objectives, it designs, develops, and implements means to counter these risks, partly or completely. This helps ensure that oversight activities are responsive to sustainable business objectives, including reporting, and related risks.

• Integrate with risk assessment
• Consider entity-specific factors
• Determine relevant business processes
• Evaluate a mix of control activity types
• Consider at what level activities are applied
• Address segregation of duties

Principle 11: Select and develop general controls over technology

The organization selects and develops general control activities over technology to support the achievement of objectives.

An organization designs its control activities to respond to risks to achieving its sustainable business objectives. In doing so, it considers the extent to which it will rely on technology. This includes leveraging existing IT systems for the collection, processing, reporting, and security of sustainable business information, such as GHG emissions, energy usage, water usage, waste management, supply chain management, and diversity.

• Determine dependency between the use of technology in business processes and technology general controls
• Establish relevant technology infrastructure control activities
• Establish relevant security management process control activities
• Establish relevant technology acquisition, development, and maintenance processes control activities

Principle 12: Deploy oversight through policies and procedures

The organization deploys control activities through policies that establish what is expected and procedures that put policies into action.

An organization uses various means of oversight to direct its sustainable business objectives. Primary among these means is established policies and procedures. These policies and procedures promote clarity in how the organization will meet its sustainable business objectives. 

• Establish policies and procedures to support deployment of management’s directives
• Establish responsibility and accountability for executing policies and procedures
• Perform in a timely manner
• Take corrective action
• Perform using competent personnel
• Reassess policies and procedures

Principle 13: Use relevant information

The organization obtains or generates and uses relevant, quality information to support the functioning of internal control.

An organization needs quality data that informs whether its processes are facilitating its ability to meet its sustainable business objectives.

• Identify information requirements
• Capture internal and external sources of data
• Process relevant data into information
• Maintain quality throughout processing
• Consider costs and benefits

Principle 14: Communicate internally

The organization internally communicates information, including objectives and responsibilities for internal control, necessary to support the functioning of internal control.

Once an organization establishes oversight structures and expresses policies and procedures, it communicates these structures and policies throughout the organization. This communication facilitates the understanding of all actors regarding their responsibilities for meeting the organization’s sustainable business objectives. 

• Communicate internal control information
• Communicate with the board of directors
• Provide separate communication lines
• Select relevant methods of communication

Principle 15: Communicate externally

The organization communicates with external parties regarding matters affecting the functioning of internal control.

Once an organization establishes oversight structures and expresses policies and procedures, it communicates these structures and processes to external parties, such as debt and equity investors and other stakeholders, that are relying on these processes for the delivery of reliable sustainable business information.

• Communicate to external parties
• Enable inbound communications
• Communicate with the board of directors
• Provide separate communication lines
• Select relevant methods of communication

Principle 16: Conduct ongoing and/or separate evaluations

The organization selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning.

Once implemented, an organization revisits its oversight structures and processes to ensure that they are effective in facilitating its ability to meet its objectives around sustainable business. These reassessments may be scheduled and ongoing, or they may be performed as specific needs arise.

• Consider a mix of ongoing and separate evaluations
• Consider rate of change
• Establish baseline understanding
• Use knowledgeable personnel
• Integrate with business processes
• Adjust scope and frequency
• Objectively evaluate

Principle 17: Evaluate and communicate deficiencies

The organization evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate.

As an organization reassesses its structures, policies, and procedures regarding its sustainable business activities, it communicates its findings so that actors better align their activities in accordance with the organization’s sustainable business objectives.

• Assess results
• Communicate deficiencies
• Monitor corrective actions