Emanuele Riva
IAF Chair

The beauty of traveling is discovering new things, landscapes, food and people that are different from our daily lives. Omne ignotum pro magnifico (Everything that is unknown is sublime), said Tacitus. Imagine taking a virtual journey not between mountains and cities, but between codes, standards and rules, developed in a parallel world that has only superficially, in recent years, interfaced with our world. I am speaking about the financial auditing world as viewed from our conformity assessment world. Well, now due to various legislations introducing non-financial reporting obligations across jurisdictions, in the sustainability field, these two worlds are meeting and getting closer. And the learning opportunities are very interesting!

It is wonderful to discover the small differences in approaches, perhaps born due to a single incident or a law, which have meant that for the same problems we have sometimes adopted similar, but sometimes different, solutions.

Firstly, there is a fundamental difference compared to what we are used to. The world of audit firms operates only and exclusively with auditors present in public lists, who have passed a state exam (a certified public accountant is a licensed professional who has passed an examination administered by a State’s Board of Accountancy or similar), and who, therefore, have demonstrated specific technical competences. Furthermore, these auditors are officially authorized by the State to hold the legal responsibility for the audit activity. They are the ones who sign the report, and who are legally responsible for their actions. This has meant that a strong effort of the global accountancy profession originally, and now by an independent global standard setter – the International Ethics Standards Board for Accountants (IESBA), which is overseen by an independent oversight body, the Public Interest Oversight Board (PIOB) – has focused heavily on developing an ethical code (almost 300 pages!) which has become law in many states. The focus is therefore mainly on the auditor rather than the firm behind the auditor. In our case, however, the approach is different. It is the conformity assessment body (CAB) that is accredited, and holds the legal responsibility for identifying criteria and people with the relevant competences (for the single cluster for the single certification scheme or programme).

Moreover, we have developed tables for man-days in many cases. Audit firms have not. Since their responsibility is personal, identifying the duration of the verification is more subjective. It is the individual auditor who must obtain assurance (limited or reasonable) of what they sign. And if the auditor is not sure, they can easily ask for a supplementary investigation, even a completely different one, from another audit firm/auditor, who, however, could already know that company and therefore could need less time. In theory, it could be a bit like this for us as well, as IAF MD 5 Determination of Audit Time of Quality, Environmental, and Occupational Health & Safety Management Systems reminds us that “the time allocated for a specific audit should be sufficient to plan and accomplish a complete and effective audit of the client’s management system”.

I could continue listing our differences. Audit firms talk about professional scepticism, we talk about objective evidence. They stand for independence, and we stand for impartiality. They have adopted more stringent rules of independence if the company to be verified is a public interest entity, while we have adopted the concept of risk. IAF MD 17 Witnessing Activities for the Accreditation of Management Systems Certification Bodies states: “A critical code is a code that from a technical point requires the CB’s audit team to have a higher level of competence, caution or diligence”. This concept is derived from Roman law, which says that a person is guilty only if and when they act without competence, prudence and diligence. Paradoxically, although we have drawn from Roman law, the whole documentary structure is strongly Anglo-Saxon (common law): we have defined a few principles and a few requirements, and then the interpretation of the principles is left to the various accreditation bodies (ABs), to the Regions, and then to the international bodies (ISO, IAF and ILAC). Audit firms, on the other hand, are subject to a different strategy. Many detailed aspects are well regulated (whether gifts, fees, business relationships, long association, how to address technology-related services provided to the entity, etc.), which, as previously mentioned, often becomes law.

IAF and IESBA have announced a strategic partnership precisely with the aim of getting to know each other better, and learning from one another. It could be a good opportunity to bring innovation and new solutions. The cornerstone of the partnership is the IAF’s stipulation to national ABs around the world that the IESBA’s proposed International Ethics Standards for Sustainability Assurance (including International Independence Standards) (IESSA) are to be used when accrediting and authorizing CABs to carry out assurance work on corporate sustainability disclosures, when included in the ISO/IEC 17029 programme. This agreement therefore allows ABs to also recall the IESSA in accreditation certificates, if this is required by an ISO/IEC 17029 programme (and therefore also if it is required by a law). It will therefore be possible, when required for a sustainability declaration, to adopt the rules that also apply to the audit firms. We must not compete on ethical issues. These matters are too important to trivialize. If the market, and the relevant authorities, believe that it is better to refer to the IESSA, the ABs will be able to do so, and they will also be able to receive help from IESBA for training and dissemination activities.

These, in summary, are the reasons behind the letter of intent. This partnership is mutually beneficial, aimed at bolstering the growth and credibility of sustainability information in the corporate landscape. This collaboration holds paramount importance and is poised to have profound and far-reaching impacts on the accreditation market for sustainability reporting. Recognizing the need for transparent, relevant, and trustworthy corporate sustainability disclosures, the IAF and IESBA have converged upon a shared objective. Their collaborative effort revolves around establishing a common framework of high standards of ethical conduct to reinforce the bedrock of trust in the assurance of sustainability information.

The profound significance of this partnership lies in its recognition of the imperative nature of a global baseline for consistently applied, high-quality ethics standards across all providers of assurance services in sustainability reporting. This encompasses audit firms, CABs, and other entities involved in the process. By integrating the IESSA within accredited verification activities, the IAF and IESBA are committed to establishing critical linkages between organizations and fostering the consistent adoption of high-quality ethics standards for sustainability assurance on a global scale.

However, the journey has only begun. What is needed now is a link document that helps mutual understanding.

This is particularly important to:

• Demonstrate the equivalence of what we do when CABs comply with the IESSA like the audit firms, to raise regulators’ trust in who we are and what we do (CABs and audit firms);
• Explain to ABs and certification bodies how to provide conformity assessment activities in the Sustainability Corporate reporting field (using the documents required by the market, that could be IESBA or International Auditing and Assurance Standards Board [IAASB] standards, or in other occasions also ISO 14019);
• Recognize the value of conformity assessment activities (starting from ISO 9001, up to ISO 14001, ISO 45001 or GHG verification).  It is very important in this regard to note the joint statement between ISO and the IFRS Foundation.

A common terminology and a common understanding of the two different approaches is required, thus the need for a link document between them, describing the differences, the shared points and the minimum global baselines. This document should be structured in order to become a profession-neutral reference document for assurance reporting process.

Another complexity to consider is that many documents are not yet definitive (e.g. ISSA 5000, ISO 14019-1,2 and 4, IESSA, ISO 14019-3). This could make this exercise more difficult, but is also a good opportunity to influence them along the way. As the current ISSA 5000, IESBA and ISO standards near completion, there is a need for guidance for professional practitioners and CABs to work together to combine their strengths to deliver credible assurance services on often complex sustainability and environmental, social and governance (ESG) matters.

This document could also be the reference for a program on the basis of which ABs could accredit, specifying which documents to use to carry out this activity. Moreover, the document should also describe what ABs must do to accredit the assurance of sustainability reports, considering that the efforts of CABs and audit firms have to be consistent, and also their output.

This will also facilitate collaboration between the worlds. It is likely that in future we will have joint assurance teams, that we will need to understand each other, and recognize the value of what each member can do.

So, I hope you enjoy your travels!

Aisle seat or window seat?