New Challenges for Internal Audit: Corporate Social Responsibility Aspects

Abstract

The purpose of this chapter is to provide a succinct overview of the main coordinates that should define the role of internal auditors in the field of corporate social responsibility. It outlines the main key points concerning the internal audit’s contribution highlighted by academic literature, by reviewing recent literature, discussing the opinions issued by various academics and finally offering some suggestions for improving subsequent research in the area. It proposes a synthesis of the main arguments that justify the need for internal audit to play a significant role in corporate social responsibility, while there are emphasized main actions that should be included within an internal audit program, so that internal audit can provide its contribution to corporate social responsibility. Given the importance of the issue, this chapter provides an overview of academic research that examined the role of internal audit in corporate social responsibility and provide practical suggestions on how internal audit practitioners should develop their audit programs in order to provide as best as possible their significant contribution in terms of corporate social responsibility.

These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

1 Introduction

Corporate social responsibility and accountability at corporate level are some of the topics with an increasing interest from both researchers and practitioners. According to Gray, Owen, and Maunders (1987), corporate social responsibility can be defined as the process of providing information designed to accomplish social accountability. No doubt, there is general consensus about the fact that business should no longer operated in a vacuum, but within a social environment, with an increasing focus for achieving principles of good social, ethical and environmental practice (King, 2002). Even more, the economic value added provided by organisations should no longer be the main criteria for evaluation of organisational performance, but also its impact on environment and value or contributions to social issues are more and more relevant.

In this context, a major challenge would be for internal audit to provide its value added by improving the value of the company and firm performance in terms of good social, ethical and environmental practices. Starting from the following principle issued by Ridley (2008) for all internal auditors that “Internal auditing has a responsibility to contribute to the processes of assessing reputation risks and advising at all levels in their organizations on how reputation can be managed and enhanced through good corporate responsibility practices”, this chapter proposes an examination of the arguments that justify the necessity for internal audit to play a significant role in corporate social responsibility. Emphasis is placed on the need for internal auditors to be sensitive to the complex of their social responsibilities and challenges; trying in the same time to highlight the main actions through internal audit can contribute to the ensuring of corporate accountability in terms of societal issues.

2 Corporate Social Responsibility: Conceptual Approaches and International Development

The interest in corporate social responsibility increased over the last two decades, while topics such as environmental and social responsibilities at corporate level are now even of greater significance at the global level (Maignan & Raltson, 2002). The concept of corporate social responsibility (CSR) has been evolving quite dynamically during the last few decades. Thus, if Nobel-Prize winning economist Milton Friedman (1970) clearly stated his vision about CSR, in his article The Social Responsibility of Business is to Increase Its Profits (Friedman, 1970 cited by Sprinkle & Maines, 2010), today, the academic literature on CSR contains a large spectrum of conceptual approaches of CSR, the interaction between CSR and other areas such corporate governance, accounting and audit being largely analysed. Even more, according to the study achieved by McKinsey (2006, cited by KaKabadse & Kakabadse, 2007), among 4,238 executives in 116 countries, more than 84 % no longer accepted the opinion shared by Nobel Laureate Milton Friedman (1970), that major goal of business is only to increase its profits. The participants to this study also admitted that now companies have to face with a larger and increasing spectrum of organisational risks, especially in terms of reputational and minimisation of shareholder value, therefore, now companies should be more careful about the economic, social, political and environmental impact of their actions.

One definition of CSR is given by the European European Commission (2010) where this concept was defined as follows:

Corporate social responsibility is a concept whereby companies integrate social and environmental concerns in their business operations and in their interaction with their stakeholders on a voluntary basis (European Commission, 2010).

Davis (1973) cited by Sprinkle and Maines (2010) attached to corporate social responsibility the following definition:

the firm’s considerations of, and response to, issues beyond the narrow economic, technical, and legal requirements of the firm to accomplish social [and environmental] benefits along with the traditional economic gains which the firm seeks (Davis, 1973 cited by Sprinkle & Maines, 2010).

According to the World Business Council for Sustainable Development (2010), corporate social responsibility or sustainability could be defined as the continuing commitment of organizations to behave in an ethical manner and trying to provide a valuable contribution to the economic development and social prosperity, looking for the enhancement of quality of life for the employees and their families as well as the local community and society. To achieve this objective in developing their businesses, companies should “innovate, adapt, collaborate and execute”. To perform these activities as best as possible, companies should form close partnerships with other businesses, governmental agencies, academic and non-governmental organisations “in order to get it right for all” (The World Business Council for Sustainable Development, 2010). This definition is in line with the previous conceptual approach of CSR concept developed by the World Business Council for Sustainable Development in its previous paper—Corporate Social Responsibility: Making good Business Sense, where the corporate social responsibility was defined as follows:

the commitment of business to contribute to sustainable economic development working with employees, their families, the local community and society at large to improve their quality of life (World Business Council for Sustainable Development, 2000).

In the vision of the Government of Canada, this concept of CSR should be understood as:

the way firms integrate social, environmental and economic concerns into their values, culture, decision-making, strategy and operations in a transparent and accountable manner and thereby establish better practices within the firm, create wealth, and improve society (IIA, 2010a).

Corporate Social Responsibility was defined by the Global Reporting Initiative (GRI) 2002 “Sustainability reporting guidelines” as a significant part of sustainability and sustainability is “one of the three ideas that are playing a pivotal role in shaping how business and other organizations operate in the twenty-first century”(GRI, 2002), while the other two ideas are accountability and governance. Looking for a more comprehensive understanding of “sustainability” concept, United Nations Global Compact provides in its paper some clarifications about this concept:

Throughout this report, we use the term “sustainability” to encompass environmental, social and corporate governance issues, as embodied in the United Nations Global Compact’s Ten Principles. These ten principles cover areas of “human rights, labour, the environment and anti-corruption” (United Nations Global Compact, 2010 cited by Ridley, D’Silva, & Szombathelyi, 2011).

Another interesting and complex perspective on this CSR concept was given by Rayner (2003), who develops the definition of CSR around some major elements such as:

• Companies should operate in a way that goes beyond fundamental legal compliance to larger areas, which include social and environmental aspects.

• In designing corporate strategy, organisations should take into account the impact, but also the value-added contributions to society and environment, by paying attention for minimising negative influences and maximising positives ones.

• The risks addressed and evaluated by company should also consider social, ethical and environmental risks.

• Transparency in disclosing the responsibilities and respect for human rights related to different internal or external stakeholders of the organisation.

• Companies should consider an appropriate answer to the needs and expectations of various stakeholders.

• All the elements mentioned above should be correlated in an integrated framework where elements like corporate strategy, corporate governance, management decisions and reporting systems are interrelated.

There are numerous terms used for CSR, but the most common term used in addition to CSR is “corporate sustainability”. The principles incorporated in this is similar to those connected with CSR and are derived from the following areas: ethics, governance, transparency, business relationships, financial return, community involvement, product value, employment practices and environmental protection (Epstein, 2008 cited by Sprinkle & Maines, 2010). The overlapping of corporate social responsibility issues with all aspects of sustainability is well argued by Ridley et al. (2011), who stated that the commitment of organisations for ensuring sustainability generates a strong impact and influence on all strategic and operational practices of the organisations.

One thing is clear—organizations are no longer only accountable to shareholders in terms of ensuring increasing of financial return on their capital investment. The spectrum of corporate responsibilities is now much more complex, including also social and environmental responsibilities about the potential impact of their operations and actions on stakeholders such as employees, existing and prospective customers, suppliers, governmental and non-governmental agencies and society at large.

In spite of the many conceptual approaches of CSR, one could identify some common elements around which corporate social responsibilities should be designed. These could include social, environmental and financial issues, which for major international companies require them to develop a “Triple Bottom Line” reporting strategy which encompasses relevant areas to be covered by the strategy. Thus, the interest of companies in their reporting is moved forward from the needs of shareholders to the interests of all the stakeholders who might be influenced by the organisation’s business policies and actions. While looking for a global positive impact for the entire society in achieving business purposes, the responsibility of companies has to be focused more significantly on how to impregnate the business operations with the commitment for social values, without significant impacts on its profitability, looking at the same time to minimize its potential negative impacts on the stakeholders.

This is no doubt, a complex corporate strategy which should incorporate corporate responsibility issues that should organised around major objectives of CSR, as depicted in Fig. 2.1. The responsibility for ensuring that CSR objectives are established, the management of risks, the measurement of performance and appropriate monitoring and reporting of companies’ actions belong to management, while, on the other hand—

Fig. 2.1

CSR objectives

CSR activities are pervasive throughout the organisation; thus every employee has a responsibility for ensuring the success of CSR objectives (IIA, 2010a).

Considering the increasing interest in CSR or corporate sustainability, at international level many set of principles, guidelines and standards have been developed by various governmental, non-governmental and professional organisations from around the world. Thus, while some address particularly social and ethical aspects of CSR/corporate sustainability, others adopt a broader perspective where aspects like employees, human rights, the environment and corporate governance issues are included and interrelated (Ackers, 2008b). A synthesis of these major international guidelines in terms of ensuring sustainability is provided in Table 2.1.

Table 2.1 CSR/Corporate sustainability—a synthesis of international guidelines

3 Role of Internal Audit in Corporate Social Responsibility

In this context of growing significance paid for corporate social responsibility and sustainability, one issue that needs more analysis is about the role of the audit profession in providing assurance on CSR topics. As Ackers (2009) admitted:

the auditors’ role as a CSR assurance provider is expected to become increasingly more important .... This increased demand for assurance services will require the global audit profession’s paradigm to be re-examined to include competence in contextual accounting and auditing.

There is a large amount of research papers and reports of various professional organisations and researchers dedicated to issues related to corporate social responsibility and how to provide its assurance, but in spite of the fact that latest research trends show that CSR assurance has become an increasing field of interest in auditing research, still it would appear that little scientific research has been done on the role of the internal audit function (Ackers, 2008a).

The Institute of Internal Auditors (IIA) notes that as “the internal audit profession is the global voice, recognized authority, and acknowledged leader” the IIA has argued that the major objectives of internal audit through the definition assigned to this function:

Internal auditing is an independent, objective assurance and consulting activity designed to add value and improve an organization’s operations. It helps an organization accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes (The Institute of Internal Auditors, www.theiia.org).

Even more, the IIA’s Standard 2130—Figure 2.2 on Governance states that internal audit has to provide an effective contribution to improving organizations’ controls in managing the risks within the processes of governance, operations and information systems.

Fig. 2.2

IIA’s Standard 2130. Source: The IIA International Standards for the Professional Practice of Internal Auditing (Standards)

The study released by PriceWaterhouseCoopers (PWC, 2011) about the state of internal audit profession emphasized that corporate social responsibility and sustainability have become growing areas of internal audit interest, while 35 % of the survey respondents clearly stated that their internal audit plan explicitly takes corporate social issues into consideration. No doubt, the internal audit techniques and approaches are continuing to evolve thus highlighting the internal audit function to be as best as possible strongly implicated in the process of better understanding the risks and exposures that might negatively influence the corporations. According to the respondents of the study of PWC (2011), some examples of internal audit approaches about corporate social responsibility issues could be used to:

• Elaborate an inventory of regulatory reports and public statements in the field of corporate social responsibility

• Provide assistance in the process of development of policies and procedures for review and approval of public statements about corporate social responsibility.

• Provide assistance for the development of regulatory compliance programs in terms of social responsibility issues.

The major goal of internal audit is to provide an assessment of the internal control environment, to undertake complex reviews of organisations’ compliance with the applicable legislation and regulatory framework. Therefore, the planning of internal audit activities should necessarily take into account social and environmental aspects, including the fact that the spectrum of CSR risks is properly mitigated. In the vision of Sawyer, Dittenhofer, and Scheiner (2003) who note that the involvement of internal audit in corporate social responsibilities should provide at least the following benefits:

• Internal audit should provide assistance with legislative and regulatory compliance, including social and environmental aspects.

• Internal audit should be in a position of being able to identify the possible problematic areas, which could generate significant remediation costs and penalties, and also potential litigation against the company, which could negatively affect the further financial return of investor, but also its reputation.

• Internal audit should contribute to building a strong organisational image of the company, because of the assurance provided about the compliance with legal requirements and ethical business practices.

• Because of the internal audit’s contribution to the effective self regulation, the relationship with regulatory authorities could be strongly improved.

Discussing the way many companies are achieving their CSR responsibilities, Jenkins (2001) states that only effective monitoring and independent verification could provide real assurance that a company fully meets certain ethical and social standards. Such an independent monitoring and effective assessment can be provided by the internal audit function.

Analysing the role that internal audit could play in this regards, Ackers (2008a) develops a study among a sample of 40 representative South African enterprises (with a response rate of 30 %). Their findings suggest that 91.7 % of respondents have a CSR policy which includes aspects such as: corporate social investment, sustainable development, human resource development, employee well-being, occupational health and safety, education, environmental management, community involvement, corporate citizenship, community Health & Welfare and energy efficiency. Considering the role of internal audit in CSR, 33.3 % of respondents stated the role played by internal audit in CSR, while under the clear requirement of compliance with internal audit IIA’s standards, only 50 % reported compliance with IIA Standards 2130 on Governance, while 41.7 % of the respondents shared the opinion that internal audit could play a more active role in corporate social responsibility and governance issues. Because of the relatively small sample used in this study, the conclusions derived from the analysis of data results cannot be generated.

One relevant model for internal auditing to provide value-added to sustainability was developed by IIARF (2006), where it presented some of the key roles that internal auditors could play in providing assurance for an effective sustainable corporate framework (IIARF, 2006 cited by Ridley et al., 2011):

• Assistance for management in designing/implementing their company’s sustainability management systems

• Training for employees in achieving their sustainability actions,

• Performing limited scope audits requested by top management,

• Achieving supply chain and compliance audits,

• Coordinating audit actions supplied by external providers.

Despite the existence in the scholarship literature of a limited amount of research dedicated to the role of internal audit in CSR, there is a general and common view that internal audit should have a distinct role to fulfill in CSR. Otherwise, if internal auditors are inactive from this perspective, they could be positioned in a dangerous area of not achieving their primary objective of delivering value added services about the assurance that should provide effective risk mitigation.

4 Ways to Increase the Contribution of Internal Audit in Corporate Social Responsibility

Ackers (2008b) notes that the audit process of sustainability/CSR must take into consideration all the dimensions of sustainability (social, environmental and economic) and should include at least following major steps:

• Define the audit program objective and scope.

• Select the representative business units to be included in the audit, specifying the frequency of the audits, their planning and the methodology used for establishing the plan of audit work.

• Select the audit protocols, checklist, procedures and guidelines to be used during the audit.

• Define the pre-audit activities such as meeting activities, file reviews, interviews and travel logistics.

• Establish procedures for audit reporting and document management. These procedures should indicate the elements that should be included within the audit report, timing and distribution, but also instructions on how documents generated during the audit will be managed.

• Establish procedures for post-audit corrective actions and follow-up of findings. These procedures should indicate the responsibilities and the mechanisms to track the recommendations made by auditor in order to correct any deficiency identified.

• Establish quality assurance processes to be incorporate into the audit process.

The role of internal audit in providing assurance about CSR issues is also one of the major topic of interests of the Institute of Internal Auditors (IIA) which is the international professional body, its supremacy being recognised all over the world in coordinating the development and progress of the internal audit profession. The IIA organised a series of courses dedicated to the role of internal audit in CSR areas—“Corporate social responsibility: opportunities for internal audit” (IIA, 2010b), which has provided a significant framework about the important questions that every internal auditor should frequently be asking the organisations they perform their audit function as depicted in Fig. 2.3.

Fig. 2.3

Questions for internal auditor. Source: Adapted after Ridley, D’Silva, Szombathelyi, (2011) citing IIA (2010a, b)

Internal auditors are in the position of being involved in corporate social responsibility at different levels. One of such position is as a result of them—internal auditors being asked to provide assistance and advice to management on how to manage CSR activities. Another situation might be when internal auditors are called upon to audit CSR programs and objectives providing assurance on how CSR objectives and responsibilities were achieved. But regardless, the position supplied by the internal auditor, there are a variety of risks related to CSR issues that need to be well-known and understood by the internal audit team in order to be included in the audit plan and procedures.

The subject of internal audit’s role in the auditing CSR activities and providing assurance in this field was, also, one of the major interest topics for The Institute of Internal Auditors (IIA) which has developed a practice guide, where significant and valuable guidelines are offered to internal auditors when they are called on to evaluate corporate social responsibility or sustainable development (IIA, 2010a). There are a lot of various risks associated with CSR activities, but the responsibilities for performing an appropriate assessment of these risks and implementing the control activities to manage those risks belong to management. The primary role of the internal auditor will be to provide an assurance about the effectiveness of these control activities designed to manage the risks related to CSR. A valuable synthesis of main categories of risks that could influence corporate social responsibility of sustainable development activities is provided by this IIA’s guide (IIA, 2010a), which is presented below in the Table 2.2.

Table 2.2 The categories of risks affecting CSR activities and objectives

According to the IIA’s practice guide (IIA, 2010a); an internal auditor could adopt one of the next approaches in auditing their company’s CSR activities and their related controls. The internal auditor could:

• a. Separate audits of each element included in CSR activities, that could further be developed into audits of matters at the corporate head office, subsidiaries and with external business relationship. Generally, these CSR activities should include at least following elements: governance; community investment; environment; ethics; health, safety and security; transparency; working conditions and human rights.

• b. Develop the audit of CSR activities by referring to each significant stakeholder group involved or affected by CSR activities that could also further be developed into audits of matters at the corporate head office, subsidiaries and with external business relationship. The main groups of stakeholders influenced by CSR activities are customers; employees and their families; the environment; local communities; shareholders/investors; suppliers, non-governmental organisations and activist groups.

• c. Group the related subjects as follows :

  • Workplace—which could include elements such as: health and safety; environmental management practices; ensuring diversity and equality; training and development; ethics; governance and human rights.

  • Marketplace—ensuring the appropriate safety and quality of product and services; responsible advertising and sales; responsible supply chain management; adequate practices and procedures in product development and testing; disclosure practices and privacy.

  • Environment—responsibility for natural resources such as air, water, land, waste, animals and energy use and compliance with regulatory framework related to them.

  • Community—philanthropy, local economic support, capacity building, volunteerism and stakeholder engagement.

• d. Audit the system of internal controls over risk management, recording, measuring and reporting of CSR activities applied within each department, function or activity included in the audit plan (or in other words, including in the audit of each department/ function/activity an audit objective related to CSR activities).

• e. Conduct Assurance audits of the way that company provides public information about their approaches and results in achieving CSR activities and objectives (or in other words, the audit of reporting of financial and nonfinancial information related to CSR elements).

• f. Audit third parties for compliance with contractual clauses, including compliance with CSR terms and conditions.

IIA (2010a) provides, also, some general considerations that should be taken in account by the internal auditors in developing their internal audit program, which could include the potential answers to a list of questions.

• Taking in consideration the disclosure of CSR information produced by the organizations. Internal auditor should look for answers to questions like: is there any consistency in the messages inserted in public reports, speeches, and presentations on the organisation’s website? How is process of disclosure of CSR information and activities controlled?

• Has the organization made a decision to align its reporting process of its CSR activities and information with one of the recognised at international level reporting standards and guidelines in the field of corporate social responsibility?

• How is the organisation communicating its CSR strategies and priorities? Internal auditor should find answers to questions such as: How are CSR strategies and priorities be incorporated into the process of decision making and approval? When there are conflicting objectives, which elements take precedence?

• Which elements of CSR responsibilities and strategies are included in the organisational structure? Is the responsible position in the organisational structure occupied by qualified staff with experienced and necessary competences?

• Is the organization a signatory to voluntary standards of performance? If not, then why not? Were the standards adopted by management, or by the board? How are they integrated into management practices? How is compliance monitored within the organization?

• How does the organization manage the process of compliance with local and international laws? Does the organization meet standards required for inclusion in environmental or social investment funds? If not, then why not?

• It is there any risk that the company’s reputation could be negatively influenced by the external business relationships that involve environmental or human rights issues?

• Can the CSR activities of customers adversely impact the organization’s reputation? Would the organization refrain from selling products to organizations with irresponsible or unsustainable practices? Does it provide programs to encourage or facilitate customers to be responsible with its products?

• How well controlled are the mechanisms put in place for capturing information about CSR activities and developing and reporting performance metrics? What instruments are used, and are there adequate control activities in place to ensure complete, accurate and timely information?

• It is there a procedure to follow in publishing a CSR report?

The Internal auditor should also look for answers to the following questions:

• Is the disclosure process for CSR activities and results as rigorous as for Financial reporting?

• Does this CSR report contain clear messages that are aligned with the company’s vision and commitments?

• Does it contain balanced reporting (mixed presentation of good elements with less positive ones), performance measures, and trends?

• Is the CSR report written in a manner that allows the reader to understand the issues and the organization’s accountabilities?

• Is there any possibility to compare the organisation’s CSR disclosed program with others programs reported by other companies?

• Has the organisation received recognition or awards for compliance with international standards or guidelines in the field of CSR?

• How do independent organisations perceive the company’s CSR report in this field of activity?

• Has the organisation asked for feedback about any of CSR issues or activities? Were these feedback given in a timely and effective manner? Are these feedback adequately disclosed to prove the company’s preoccupation in the field of CSR?

Using these considerations and answers to the previous questions, in order to proceed to the audit of CSR activities/sustainability development, internal auditor should establish the company’s audit objectives which could include the following elements:

• Based on audit evidence obtained by applying appropriate audit techniques, the internal auditor should deeply understand the company’s risk identification, response plans and internal control activities to mitigate the identified risks in the field of CSR’s programs, activities and responsibilities.

• Proceeding to test and analyse a sample of CSR programs in order to identify the degree of compliance with policies and procedures established by management in this field, but also the degree of compliance with international standards and guidelines that company has shown adherence.

• Identifying weaknesses in the control mechanisms and activities implemented in the field of CSR, and by making recommendations for enhancing the ability of the organization to fulfill its duties in terms of corporate social responsibility, represents now, one of the ways by which the internal auditor could provide real added-value to the company.

Considering these audit objectives, the internal audit program must be carefully planned, taking into consideration the following steps:

• 1. Preparatory phase, where the following procedures should be followed:

  • Determine the time period to be examined.

  • Obtain and review the applicable policies and procedures followed by company in the field of corporate social responsibility programs.

  • Identify and develop a risk profile related to CSR objectives and activities.

  • Identify strengths and weaknesses in this risk profile related to CSR programs.

  • Plan meeting, where the scope, approach, period, areas included and adequate auditee contacts are established.

• 2. Testing phase, where the following procedures should be followed:

  • Apply the audit procedures and techniques on the activities included in the CSR program, considering particularly the weaknesses identified previously, when CSR risk profile was identified.

  • Make a synthesis of the main deficiencies found

  • Make recommendations to improve the quality of internal controls in the field of CSR to mitigate CSR specific risks. These recommendations could start from the review of any known best practice for corporate social responsibility and their adaptation to the specific of audited company.

• 3. Closing phase, where the following procedures should be followed:

  • Prepare preliminary draft of the CSR internal audit using the standard format. Ensure that all findings are well argued.

  • Discuss the main findings with the representative of the audited entity in field of CSR. Also, ensure that any recommended action has been discussed with these representatives.

  • Issue preliminary report to management. At this time, management and representative should express their agreement about their availability to implement proposed recommendations and any suggested action has been identified and agreed in the internal audit report.

  • After all internal audit report content has been validated and agreed, the final version of the report should be issued.

Conclusions

No doubt, companies worldwide are increasingly preoccupied with how their activities and actions affect the environment and social welfare, while employees, consumers, governmental agencies, investors, non-profit organisations and other stakeholders groups are requesting that organisations act in a socially responsible manner (a view also shared by other researchers such as Sprinkle & Maines, 2010).

From their position and the requirement of absolute independence of internal auditors, the internal audit should be seen to be effective. From this statement, one conclusion is clear the internal audit is one of the features which demonstrate a company’s independence that could provide an independent assessment of the ethical, environmental and social performance of a company, without affecting the financial expectations of the investment community. Internal auditors have a competitive advantage, as one of the main pillars of audit function, because they have the necessary resources and capacities to obtain a complete understanding of corporate responsibility and sustainability development. This could assist the function to develop into a value-added centre by proposing consistent recommendations to improve the organisation’s ability to give an appropriate response to its obligations and responsibilities in the field of corporate social responsibility.