Typically, climate is owned as a risk and strategic issue by the board. Directors are on a steep learning curve in determining what they consider to be important. Establishing their assurance strategy follows on from this.

Demand for assurance is often driven by regulatory needs rather than by standing back and thinking about what the organisation really needs to deliver on its strategy and achieve its goals. For example, because there is no regulatory requirement for assurance on Modern Slavery Act statements, assurance activities (both internal and external) may not be undertaken or externally reported. Directors must take greater accountability for deciding what’s important. 

There is also a question of how the board’s accountabilities are delivered and managed in practice. In Deloitte’s 2021 report, The Audit Committee Frontier – Addressing Climate Change,  61% of audit committee members surveyed believe the board has responsibility for oversight of climate risks. Beyond this, 12% say it is the responsibility of the risk committee and 8% say it is the audit committee. Another 13% suggest it would be owned by another committee, which might include ESG committees. However, 48% of audit committee chairs recognise they are responsible for the effectiveness, independence and objectivity of assurance obtained over climate-related information and disclosure.

Although this research points to only 13% of those surveyed establishing a separate board and/or executive committee for issues associated with ESG, this is a growing number, and we expect more companies to use the opportunity to have a separate forum for discussions. We believe that this provides additional prominence and time to discuss these issues, recognising also that major assurance implications and recommendations will need to be discussed with the audit committee and then, as appropriate, with the full board.

Critical to fulfilling these responsibilities is ensuring the board has the right experience and capabilities to constructively challenge the information and assurance it receives. One non-executive director (NED) told us: “To deliver on expectations, boards need more climate competence. Competence should be assessed by going beyond a desktop exercise to review experience and qualifications. In addition, it’s critical to meet specialists within the company in person and ‘kick the tyres.’”

In Deloitte’s report, 48% of audit committee members surveyed believe they were not equipped to fulfil their climate responsibilities and 34% describe a lack of climate literate talent. In addition, 87% of audit committee members suggested they need more education and 79% improved management information to support their decision processes. Strong assurance should provide a mechanism for building confidence at board level.

Audit committee chairs interviewed for ICAEW’s guidance indicated that they are searching for solutions to the questions about how to get the assurance they feel they need.

Alongside clarity at board level, there is a need to identify which executive is responsible for representing climate-related risks to the board. Authority should be delegated to executives with appropriate experience and capability, but there are challenges from the top down with how this is structured. There must be clear ownership to ensure responsibilities are understood in relation to risk management, reporting, policy setting, monitoring and independent assurance.

A portfolio NED suggested to us: “Sustainability can sit outside of finance, but the CFO has to be responsible for oversight of the annual report. However, finance people rarely have sufficient lived experience of non-financial data. We had a conversation with 11 people in a room on TCFD: it was a little bit of everyone’s job, so who is really responsible?”

It is important to be clear from the outset what the internal accountabilities and responsibilities are for managing climate-related risks and mitigating activities. The three lines of defence model is the common framework for considering this.

Companies’ levels of maturity in embedding effective lines of defence vary significantly. While many companies may believe their lines of defence are well established, the need to monitor ESG matters and information provides an opportunity to review this. 

For example, a concern raised by the CAE of a global mining company is that “lines of defence are not well established generally". The CAE added: "Climate risk is not in one place, so how do you differentiate and define accountabilities?” 

Moreover, a NED of a major utility provider told us: “We thought we had a three lines of defence model, but our experience of environmental reporting evidenced that it was not working. The first and second line were operating as one, whilst the third line was not sufficiently involved in oversight.”

We believe climate risk and assurance activities should become embedded in business as usual within organisations as part of the system of risk management and internal control and be discussed at the executive table. Larger companies have had sustainability functions for some time and companies are increasingly seeking to appoint heads of sustainability. However, the skills required are scarce and they won’t always be at an appropriate level of seniority. 

A robust, fully implemented and understandable internal framework will provide directors with a clear view on the confidence they can take from the internal lines of defence. They can then determine where external assurance is required because of regulatory or other demands, and where such assurance creates value and insight.

• Ensure all directors are clear that they carry the responsibility for managing climate risk and for all related commitments made by the company.
• Develop an appropriate board and committee structure to evidence appropriate oversight.
• Integrate climate risk and assurance within the broader audit and assurance reporting and discussions of the audit committee to meet regulatory expectations.
• Delegate authority from the top down, ensuring appropriate experience and capabilities.
• Use this opportunity to reinforce the effectiveness and assurance role of the lines of defence in providing directors with the confidence to act.