Social and environmental reporting and assurance

Customers, investors and communities now ask what a company does to people and to the environment, not only what it earns. Companies answer with social and environmental reports, and they ask accountants to give those reports credibility. For the auditor there are two questions. How do social and environmental matters affect the statutory audit of the financial statements? And how is a sustainability report itself reviewed or assured?

This topic covers both, and it is the topic behind May 2026 Question 4, a 20-mark question on sustainability assurance for a bottling company. It covers the laws and ISAs that link environmental matters to the audit, the substantive tests, social and environmental policies and reports, environmental and social audits, key performance indicators and evidence, and the process of sustainability reporting and assurance.

The previous topic covers small company audits. The next topic covers emerging technologies and the audit changes in Companies and Allied Matters Act 2020 (CAMA 2020).

CAMA 2020 and sustainability matters

CAMA 2020 does not set rules for sustainability reporting. In Nigeria that comes from the Financial Reporting Council of Nigeria (FRC). The Act matters because it governs the statements the auditor opines on and the auditor’s powers.

For CAMA 2020, the sustainability report is other information if it is in the annual report. The earlier topic on key audit matters and other information explains how the auditor reads it under ISA 720.

How social and environmental matters affect the statutory audit

ISA 250

ISA 250 requires the auditor to get sufficient appropriate evidence about non-compliance with laws and regulations that have a direct effect on material amounts and disclosures. Non-compliance could be over health and safety, equal opportunities or anti-pollution law. A breach may mean the entity:

• must provide for fines or penalties;
• must disclose a contingent liability for a possible settlement in a civil lawsuit for damages;
• is required by law to improve working conditions or pay, which affects labour costs; or
• must write down certain assets because of impairment.

Other ISAs

Substantive procedures

• Review minutes of board, audit committee and environmental committee meetings, industry information, media comment, environmental reports and audits, internal audit and due diligence reports, regulator reports and correspondence with environment agencies and solicitors.
• Use an external expert (ISA 620) and the work of internal audit.
• Ask about insurance cover for environmental risks.
• Obtain written representations that management has considered environmental effects, is not aware of material liabilities or contingencies or impairment from them, or has disclosed all relevant facts if it is.
• Ask about management’s policies for writing down assets and for identifying liabilities, provisions and contingencies, and whether there have been violations, penalties or claims.
• Ask about site clean-up, restoration and penalty costs and any legal claims, and whether regulators have written.
• For property abandoned, bought or closed in the period, ask about clean-up rules and intentions.
• Use analytical procedures that relate financial and quantitative environmental information, for example raw materials used against waste or emissions.
• Review and test how management develops estimates, perhaps by getting an independent expert’s estimate or using subsequent events, and consider whether assumptions and amounts are reasonable.
• Review the adequacy of the disclosures.

Social and environmental reports

Why companies report

Under pressure from public opinion, many entities now recognise the effect they have on society and the environment. Failing to act and being seen to act puts reputation at risk, and reputation affects demand. Many people will not buy from, or invest in, companies without healthy social and environmental policies. So companies publish reports, or use websites, advertising and media.

In most countries, including Nigeria, reporting on these issues is voluntary. The European Union (EU) has required quoted companies to publish a business review that includes social and environmental information.

Policies

Environmental policies may cover energy consumption, pollution, use of natural resources and sustainability of the business, and use of recycled materials. Social policies may cover employee rights (for example union membership), training and development, human rights, child labour in developing countries, equal opportunities, health and safety, relations with the local community, and support for local, national and international good causes.

Many large companies publish a social and environmental or sustainability report. An independent verification statement from accountants or other experts adds credibility. Sustainability reports give financial, social and environmental performance, which is called triple bottom line reporting. This differs from ESG reporting, which covers environmental, social and governance issues.

Environmental reports and audits

Environmental reports are not regulated. External auditors may review them, but they are outside the statutory audit opinion. A report may cover environmental performance targets and whether they were met, relevant regulations and compliance, and compliance with industry or environmental standards and the entity’s policy on sustainable development. Sustainability means meeting the needs of the present generation without harming future generations.

A timber supplier that replants the forests it cuts is an example.

An environmental audit is a management tool made up of a systematic, objective assessment of how well an entity is performing, aimed at protecting the environment by improving management control of environmental practices, including compliance with legislation. It may be done by the external auditors, the internal auditors or external environmental experts.

It is not mandatory and not as highly regulated as a financial audit, though if done by professional accountants the usual codes of professional practice apply. It typically assesses compliance with regulations on pollution of land, water and air, waste disposal, recycling policies and sourcing of raw materials, and compares measured performance with set targets.

Social reports and audits

A social audit checks whether a company has met its social targets, for example a minimum number of training hours per employee. It gives independent verification. Because it is voluntary, the report need not be published, but a company may publish it to show social responsibility and improve its image.

Audit evidence for these reports

Because companies choose what to include, a report may be mostly words with few numbers. Where it has numbers, it usually compares actual with target for key performance indicators (KPIs), which vary by company. The examiner may ask for KPIs and evidence sources. Examples include:

Sustainability reporting and assurance (May 2026 Question 4)

The May 2026 solution treats sustainability assurance as an ordinary assurance engagement, either reasonable or limited, run with a risk-based approach.

Before accepting

1. Follow formal acceptance and continuance procedures in line with firm policy. Make sure ethics, including independence, are not compromised by the team or its specialists. Run background checks on the directors and assess the engagement risk.
2. Make sure there is no scope limitation that would modify the conclusion, and that quality management is in place. A quality assurance reviewer may be needed.
3. Set terms of engagement in a letter, which is the responsibility of the directors and the practitioner, stating the basis of reporting and conclusion, whether limited or reasonable assurance, and the standards to be followed.
4. Make sure there are enough competent resources, including specialists, with the necessary skills and time. The engagement partner takes responsibility for quality.

The process

1. Identify the scope and objectives. Get a preliminary understanding of the sustainability information, with enquiries and review of documents, and check the scope has no limitation.
2. Gather and analyse data by assessing environmental, social and governance (ESG) impacts. Plan with professional scepticism, understand the business, controls, reporting processes, systems and sustainability risks.
3. Evaluate the sustainability policies and procedures against the reporting standards, and perform analytical and substantive procedures on selected disclosures.
4. Collect sufficient appropriate evidence by enquiry, testing, analysis and third-party confirmation, and report strengths, weaknesses, opportunities and threats to those charged with governance.
5. Keep documentation, including misstatements and control deficiencies, communication with those charged with governance, other information and the assurance report.

Why it is needed

It gives transparency and accountability to stakeholders and makes the report credible, so it avoids friction with the community. It helps the company prepare early for climate and resource risks and reduces legal and compliance risk. It supports better decisions, and spots wasted energy and resources, which improves efficiency and returns. It also builds reputation and goodwill and helps attract customers and staff who care about sustainability.

Ethical concerns on the use of AI

• Accuracy and reliability. Artificial intelligence (AI) can give wrong or misleading information if input data is incomplete, algorithms are flawed or data quality is poor.
• Bias and discrimination. Biased training data can produce unfair or distorted reporting.
• Lack of transparency. Black box systems make it hard to see how disclosures were produced, which weakens trust.
• Data privacy and confidentiality. Sensitive data creates risks of unauthorised access, breaches and misuse.
• Manipulation and greenwashing. AI could exaggerate achievements or hide adverse impacts.
• Accountability. It is hard to say who is responsible when an AI-generated report is wrong.
• Reduced professional judgement. Over-reliance on AI weakens scepticism and judgement.

Background: standards for sustainability reporting and assurance

• The International Sustainability Standards Board (ISSB) issued International Financial Reporting Standards (IFRS) S1 (general sustainability-related disclosures) and IFRS S2 (climate-related disclosures). Nigeria adopted them, and the FRC issued an amended roadmap and Sustainability Reporting Guideline 1 in February 2026. See the FRC roadmap for the phasing by type of entity.
• The International Auditing and Assurance Standards Board (IAASB) issued ISSA 5000, General Requirements for Sustainability Assurance Engagements. It is effective for assurance on sustainability information for periods beginning on or after 15 December 2026, with early application permitted. The IAASB states that International Standard on Assurance Engagements (ISAE) 3000 (Revised) will no longer apply to sustainability assurance after that date. International Ethics Standards Board for Accountants (IESBA) issued matching ethics standards with the same effective date.

The earlier topic on ISAE 3000 covers the assurance framework, reasonable and limited assurance and the report. Those ideas carry over to sustainability work.

The rules in more depth

Why environmental matters are judgemental

An environmental liability may exist only if a law is breached or the company has a duty to clean up. Whether it exists, and how much it will cost, can depend on legal advice and engineering estimates. That is why experts, written representations and subsequent events are used.

Why “words not numbers” is a problem

A report that says only “we care about the community” cannot be verified. The auditor needs measurable KPIs with a target and a source. Without them the engagement may need a scope limit or a limited-assurance conclusion.

Why independence matters more here

A firm that helps a client set up its sustainability reporting system and then gives assurance on it faces a self-review threat. The earlier ethics topics apply as in any assurance engagement. The May 2026 solution lists independence of the team and specialists first.

Greenwashing

Overstating good performance or hiding bad impact misleads users. An assurance report helps only if the practitioner has real evidence. The more AI is used to produce the disclosures, the more the practitioner must test the data behind it.

Worked example: evidence for a sustainability report

1. Staff turnover. Obtain personnel files and recompute leavers divided by average headcount for both years. 12% is the target of the test.
2. Training spend. Agree ₦25 million to the cash book or training account in the ledger, and check that the expenditure is training and in the right year.
3. Waste recycled. There is no ledger. Use observation, and ask for weighbridge or collection records from the recycler, with analytical review of waste against production.
4. Injuries. Compare the health and safety records with the figure of 3, and check accident logs and any regulator correspondence for unreported cases.
5. Completeness. Ask what KPIs the company chose not to report. A report with only good news may be greenwashing.
6. Conclusion. Limited assurance gives a negative form of conclusion based on enquiry and analytical procedures. Reasonable assurance would need more testing.

If the same company had a regulator fine of ₦8 million for pollution, the financial statement audit would need a provision under ISA 250 reasoning, a check of disclosure, and representations from management.

How to score full marks

• Split a sustainability question by requirement. The May 2026 question had four parts: acceptance, process, need and AI ethics, worth 5, 6, 4 and 5 marks. Give each part its own heading and the number of points the marks suggest.
• Use the case. Mention the bottling company’s donations, the pressure group and the managing director’s concerns where they support a point.
• For acceptance, cover ethics and professional matters. Independence, background checks, scope limitation, quality management, engagement letter, competent resources.
• For KPIs, pair each with a source. A KPI without evidence earns half the marks.
• Link environmental matters to the financial statements. Provisions, contingent liabilities, labour costs and impairment.
• Name the ISAs. ISA 250, 315, 330, 540 and 620.

Common mistakes in the exam

• Saying environmental audits are part of the statutory audit or mandatory for quoted companies.
• Mixing up triple bottom line (financial, social, environmental) and ESG (environmental, social, governance).
• Writing about sustainability only in general terms without ethical and professional acceptance points.
• Giving AI ethics as only “AI can be wrong”. List accuracy, bias, transparency, privacy, greenwashing, accountability and judgement.
• Saying CAMA 2020 requires a sustainability report. It does not.
• Forgetting that a limited assurance conclusion is expressed in a negative form.

Quick revision

• Effects on the audit: fines provision, contingent liability, labour costs, impairment.
• ISAs: 250 laws, 315 risks, 330 responses, 540 estimates, 620 experts.
• Tests: minutes, reports, regulator and solicitor letters, expert, insurance, representations, analytical review, estimates, disclosures.
• Reporting is mostly voluntary. Triple bottom line is financial, social and environmental.
• Environmental and social audits are voluntary, not part of the statutory opinion.
• Acceptance: procedures, ethics, no scope limit, quality management, engagement letter, resources.
• Process: scope, ESG data, policies, evidence, documentation.
• AI concerns: accuracy, bias, transparency, privacy, greenwashing, accountability, judgement.
• CAMA 2020: ss. 377, 404(7)(a), 406, 407(3). Background: IFRS S1, S2 and ISSA 5000.

Practice questions

These are original questions written in the style of the Institute of Chartered Accountants of Nigeria (ICAN) exam. Try each one before you open the answer. Full model answers follow the written questions.

Recall check: multiple choice

The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.

Written questions

Model answers

Spotted a mistake? Tell us and we will check it.