The Role of Auditors in ESG Compliance: What Businesses Need to Know
Environmental, social, and governance (ESG) considerations are becoming an increasingly important part of corporate reporting and decision-making. Investors, regulators, customers, employees, and other stakeholders want more than financial information. They also want to understand how a company manages environmental risks, treats its people, governs its operations, and prepares for long-term challenges.
This shift has expanded the role of auditors. While traditional financial audits focus primarily on financial statements, auditors can also contribute to the reliability, consistency, and credibility of ESG information through risk assessment, controls evaluation, data validation, and assurance engagements.
For businesses, ESG compliance is not simply about publishing a sustainability report. It requires reliable information, appropriate policies and controls, clear accountability, and processes that support accurate and transparent disclosures.
Image Credit: Magnific
What Is ESG Compliance?
ESG compliance refers to an organization's ability to meet applicable regulatory requirements, reporting expectations, internal policies, and recognized standards relating to environmental, social, and governance matters.
The three ESG areas generally cover:
Environmental: Greenhouse gas emissions, energy consumption, waste management, water use, climate-related risks, biodiversity, and resource management.
Social: Employee welfare, workplace safety, human rights, diversity and inclusion, community impact, customer protection, and supply-chain practices.
Governance: Board oversight, ethics, anti-corruption measures, risk management, internal controls, executive accountability, and corporate transparency.
ESG requirements vary by jurisdiction, industry, company size, and stakeholder expectations. In the Philippines, publicly listed companies have been subject to sustainability reporting requirements issued by the Securities and Exchange Commission (SEC). The SEC's Sustainability Reporting Guidelines were designed to help publicly listed companies identify, evaluate, and manage material sustainability risks and opportunities and communicate relevant information to stakeholders.
As ESG reporting develops, the quality of the information behind these disclosures becomes increasingly important.
Why Do Auditors Matter in ESG Compliance?
ESG reports can contain hundreds of data points, including energy consumption, employee statistics, emissions, workplace incidents, governance indicators, and sustainability targets.
Like financial information, ESG information can be affected by incomplete records, inconsistent methodologies, calculation errors, weak controls, or inadequate documentation.
Auditors bring a structured approach to identifying and addressing these risks.
Their role can include:
Assessing ESG-related risks.
Reviewing internal controls over ESG data.
Testing the accuracy and completeness of selected information.
Evaluating reporting processes and documentation.
Identifying gaps in policies and controls.
Supporting management in improving ESG reporting readiness.
Providing independent assurance over sustainability information when appropriately engaged.
The objective is not simply to determine whether a company has an ESG report. The objective is to help establish whether the processes and information supporting that report are reliable and fit for purpose.
How Do Auditors Support ESG Compliance?
1. Auditors Identify ESG-Related Risks
The first step is understanding where ESG risks could affect the organization.
For example, a manufacturing company may face risks related to:
Energy consumption
Carbon emissions
Waste disposal
Occupational safety
Labor practices
Supply-chain compliance
Environmental regulations
A financial services company may face different risks, such as data privacy, responsible lending, financial inclusion, cybersecurity, employee practices, and governance.
Auditors can assess these risks and consider how they may affect operations, reporting, compliance, reputation, and financial performance.
This risk-based approach helps management focus resources on the ESG matters that are most significant to the organization.
2. Auditors Review Internal Controls Over ESG Data
Reliable ESG reporting depends on reliable data.
Consider a company reporting its annual energy consumption. The figure may come from utility bills, facility records, spreadsheets, estimates, and information submitted by different departments.
Without appropriate controls, errors can occur.
Auditors can evaluate controls such as:
Who collects ESG data?
Who reviews the information?
What documentation supports the figures?
How are calculations performed?
Are estimates clearly identified?
Are changes to data properly documented?
Is there an approval process before information is reported?
Are data sources consistent from one reporting period to another?
These controls are important because ESG information can originate outside the finance department and may not traditionally be subject to the same control environment as financial data.
3. Auditors Test ESG Information
Auditors can perform procedures to determine whether selected ESG information is supported by appropriate evidence.
For example, an auditor may compare reported energy consumption against utility records or examine whether employee statistics reconcile with human resources records.
Depending on the engagement, procedures may include:
Inspection of supporting documents
Recalculation of reported metrics
Reconciliation of data between systems
Analytical procedures
Interviews with responsible personnel
Sampling and testing
Review of calculation methodologies
Verification of selected source data
The extent and nature of testing depend on the engagement's objective and applicable assurance standards.
4. Auditors Evaluate ESG Reporting Processes
An effective ESG program requires more than collecting data once a year.
Organizations need repeatable processes for identifying material topics, collecting information, reviewing performance, documenting decisions, and preparing disclosures.
Auditors can help management identify weaknesses in these processes.
For example, an organization may have strong environmental initiatives but lack a formal process for determining which environmental metrics should be reported.
Another company may have extensive employee data but no documented methodology for calculating workforce-related ESG indicators.
A review of these processes can help organizations move from informal sustainability activities to a more structured ESG reporting system.
5. Auditors Assess Governance and Accountability
The "G" in ESG is particularly relevant to auditors because governance determines how an organization manages risks and makes decisions.
Auditors may examine areas such as:
Board oversight
Management accountability
Risk management
Internal controls
Ethics policies
Anti-bribery and anti-corruption controls
Whistleblowing mechanisms
Conflict-of-interest procedures
Compliance monitoring
Internal audit activities
Strong governance helps ensure that ESG responsibilities are assigned to appropriate people and that significant issues reach management and the board.
6. Auditors Help Identify Gaps Before Reporting
One of the most valuable roles of an auditor can occur before a sustainability report is finalized.
A readiness assessment can identify gaps between the organization's current practices and its reporting objectives.
For example, an organization may discover that:
Certain ESG metrics lack supporting documentation.
Different departments use different definitions for the same metric.
Responsibility for ESG reporting is unclear.
ESG data is maintained manually across multiple spreadsheets.
Sustainability targets are not linked to measurable indicators.
Climate-related risks are not incorporated into the broader risk management process.
Identifying these issues early gives management time to correct them before information is formally disclosed.
Image Credit: Magnific
What Is the Difference Between an ESG Audit and ESG Assurance?
The terms ESG audit, ESG review, and ESG assurance are sometimes used interchangeably. They should not automatically be treated as the same engagement.
An ESG-related audit or internal review may focus on an organization's processes, controls, policies, or compliance with specific requirements.
An assurance engagement, on the other hand, is designed to provide a conclusion that increases users' confidence in sustainability information.
The Philippines has also taken steps toward formal sustainability assurance standards. The Auditing and Assurance Standards Council (AASC) approved the adoption of International Standard on Sustainability Assurance 5000 as the Philippine Standard on Sustainability Assurance 5000 (PSSA 5000) in 2025. The standard establishes general requirements for sustainability assurance engagements.
This development reflects the growing importance of credible sustainability information and independent assurance.
Businesses should therefore clearly define the objective of an ESG engagement before selecting the appropriate procedures or level of assurance.
How Can Companies Prepare for an ESG Audit?
Organizations can take several practical steps to improve ESG compliance and audit readiness.
Establish Clear ESG Responsibilities
Assign responsibility for ESG reporting and define the roles of management, finance, internal audit, compliance, human resources, operations, and other relevant departments.
ESG reporting should not become the responsibility of one individual or department alone.
Develop an ESG Data Inventory
Identify the ESG metrics the organization currently tracks and the metrics it may need to report in the future.
For each metric, document:
Data source
Responsible department
Calculation methodology
Reporting frequency
Review process
Supporting documentation
Strengthen Internal Controls
Apply appropriate controls to significant ESG data.
Controls should address data collection, calculation, review, approval, changes, and retention of supporting evidence.
Conduct a Materiality Assessment
Not every ESG issue has the same level of importance to every business.
A materiality assessment helps organizations identify the environmental, social, and governance topics that are most relevant to their business and stakeholders.
The PSE itself describes materiality as a process for identifying and prioritizing sustainability topics that are significant to its operations, stakeholders, and financial prospects.
Align ESG Reporting With Applicable Standards
Companies should identify the reporting requirements and frameworks relevant to their organization.
Depending on the business and reporting requirements, this may include applicable SEC requirements and internationally recognized sustainability disclosure standards.
The PSE's ESG guidance emphasizes that its guidebook should be used alongside applicable legislation, regulations, and globally recognized reporting frameworks rather than as a replacement for them.
Maintain an Audit Trail
Every material ESG figure should be traceable to its source.
Documentation should explain where the data came from, how it was calculated, who reviewed it, and what evidence supports it.
A strong audit trail makes the reporting process more efficient and helps management respond to questions from auditors, regulators, investors, and other stakeholders.
What Are the Benefits of Auditor Involvement in ESG?
Auditor involvement can provide benefits beyond regulatory compliance.
Better Data Quality
Testing and control reviews can identify inaccurate, incomplete, or inconsistent ESG information.
Stronger Internal Controls
ESG reporting can expose weaknesses in processes that may also affect operational and financial risk management.
Greater Stakeholder Confidence
Independent review or assurance can increase confidence in sustainability information.
Improved Risk Management
ESG risks can affect business continuity, reputation, financing, supply chains, and long-term profitability. Bringing these risks into the organization's risk management framework can improve decision-making.
Better Reporting Readiness
Organizations that establish controls and documentation before reporting deadlines are better positioned to respond to evolving disclosure expectations.
ESG Compliance Is Becoming a Business Issue
ESG compliance should not be viewed solely as a reporting exercise.
Environmental risks can affect operating costs and business continuity. Social risks can affect employee retention, workplace safety, and reputation. Governance failures can result in financial losses, regulatory action, and loss of stakeholder trust.
The PSE's current sustainability initiatives reflect this broader direction. Its sustainability framework emphasizes transparency, accountability, material ESG disclosures, and stronger governance within the Philippine capital market.
In 2026, the PSE also encouraged listed companies to use CDP to strengthen environmental disclosure, noting that its platform incorporates IFRS S2 as a foundational baseline and can help companies identify and report climate-related financial risks and opportunities.
For businesses, this means ESG information is increasingly connected to broader questions about risk, strategy, governance, and long-term value.
The Bottom Line
Auditors play an important role in strengthening ESG compliance by helping organizations improve the reliability of sustainability information, assess ESG-related risks, evaluate internal controls, and prepare for independent assurance.
As ESG reporting continues to develop, companies will need more than sustainability initiatives. They will need reliable data, clear accountability, effective controls, and evidence that supports what they disclose.
For Philippine businesses, particularly organizations facing increasing reporting and stakeholder expectations, building an audit-ready ESG process can help turn sustainability reporting from a compliance exercise into a stronger component of risk management and corporate governance.
Frequently Asked Questions About Auditors and ESG Compliance
Do auditors audit ESG reports?
They can, depending on the engagement. Auditors may perform internal reviews, agreed-upon procedures, readiness assessments, or formal sustainability assurance engagements. The scope and level of assurance should be clearly defined.
Is ESG assurance mandatory for all companies?
Not necessarily. ESG reporting and assurance requirements depend on the applicable laws, regulations, listing requirements, industry requirements, and reporting frameworks relevant to an organization.
Can internal auditors review ESG compliance?
Yes. Internal audit functions can assess ESG-related risks, controls, governance, and reporting processes as part of their risk-based audit plans.
What ESG information can auditors test?
Depending on the engagement, auditors may test environmental metrics, workforce data, health and safety indicators, governance information, emissions data, energy consumption, waste data, and other reported sustainability information.
Why should companies involve auditors early?
Early involvement can help identify weaknesses in ESG data, controls, documentation, and reporting processes before information is formally disclosed.
