The future of corporate sustainability reporting: a rapidly growing assurance opportunity.

EXECUTIVE SUMMARY

* To satisfy the information needs of external and internal stakeholders, more organizations are measuring and reporting on their social and environmental performance. CPAs can play an important role in providing the needed information and helping to verify its accuracy.

* Corporate sustainability reporting (CSR) involves reporting financial and nonfinancial information to key stakeholders on the company's operational, social and environmental activities and its ability to deal with related risks.

* The most dominant CSR regulations are those of the Global Reporting Initiative (GRI), which issued its first comprehensive reporting guidelines in 2002 and its G3 Reporting Framework in October 2006. As of October 2006, more than 1,000 international companies had registered with the GRI and issued corporate sustainability reports using its standards.

* An opportunity exists for CPAs to audit the information companies present in corporate sustainability reports. As of yet interested parties have not fully agreed on what information can and should be audited. Concern exists about the suitability of the criteria used to prepare the reports and what performance and reporting standards the auditor should use.

* A joint task force of the AICPA and the Canadian Institute of Chartered Accountants (CICA) concluded the 2002 GRI standards had not yet reached a point where they were suitable criteria to be considered generally acceptable and allow a set of generally accepted assurance standards for CSR reports to be developed. Two exposure drafts offered by accountants in the Netherlands on assurance engagements related to sustainability reporting are currently under review by international accounting organizations including the AICPA.

**********

Faced with increased pressure from internal and external stakeholders, more organizations are measuring and reporting on their social and environmental performance as well as the usual financial reporting measures. Stakeholders have been pressing companies to publicly report this information either in annual financial reports to shareholders or in voluntary corporate performance reports. The worldwide growth of socially responsible investment funds, investment rating systems such as the Dow Jones Sustainability Index and investment policy disclosure requirements also have put financial pressures on companies to make these kinds of nonfinancial disclosures.

As this trend grows, so, too, will the role of accountants and auditors. CPAs within organizations will play a key role by providing and measuring the social and environmental information, using their skills to improve its quality and facilitate its use to make sound business decisions in areas such as investment appraisal, budgeting and strategic planning. Auditors also will have a significant role in verifying the accuracy of the reported information as well as the systems and practices from which it is derived. This article provides all CPAs with an overview of corporate sustainability reporting and the role it may play in businesses worldwide.

BEYOND THE BOTTOM LINE

Organizations have come to realize that meeting stakeholder expectations is as necessary a condition for sustainability as the need to achieve overall strategic business objectives. While maximizing shareholder value continues to be an overriding concern, companies will not be able to do that over the long term if they don't meet other key stakeholder interests. According to a PricewaterhouseCoopers report, The Value Reporting Revolution: Moving Beyond the Earnings Game, "to create long-term economic value for society--shareholders and other stakeholders alike--sustainability says that companies must also create social and environmental value." To create transparent reports that provide accurate and reliable data, as well as a fair picture of overall performance, many companies are now reporting results across the "triple bottom line" of economic, environmental and social performance.

Triple-bottom-line reporting, also known as corporate sustainability reporting (CSR), involves reporting nonfinancial and financial information to a broader set of stakeholders than just shareholders (see exhibit 1, page 67, for some examples). The reports inform stakeholder groups of the reporting organization's ability to manage key risks. Because these interests vary, the type of information varies; however, much of it has to do with the company's economic, operational, social, philanthropic and environmental objectives.

Exhibit 1

Typical Stakeholders
for U.S. Publicly
Owned Organizations

Financial stakeholders

* Shareholders (institutions, hedge
funds, employees and individuals)

* Bond holders

* Banking institutions

* Employees (including unions)

* Other sources of capital (venture
capitalists)

Supply chain stakeholders

* Customers

* Alliance partners

* Direct suppliers

* Upstream suppliers

* Contractors

Regulatory stakeholders

* Securities and Exchange
Commission

* Internal Revenue Service

* Occupational Health and Safety
Administration

* Food and Drug Administration

* Environmental Protection Agency

* Accounting standard setters
(FASB, IASB, PCAOB)

* Federal Communications
Commission

Political stakeholders

* Federal government (lawmaking
and court decisions, for example)

* State governments

* International governments

* United Nations

* European Union

* OPEC

* NATO

Social stakeholders

* Local communities

* General public

* Academia

* Charitable organizations funded
by companies

* Environmental and social
organizations

A number of companies--DuPont, Mobil, Allstate, Gap Inc. and British Petroleum-Amoco among them--recognize the potential comparative advantages of publicly disclosing their goals related to nonfinancial and financial performance measures and then reporting on how well they achieve them. To better understand the pressure to be transparent about a broad number of issues, consider that Wal-Mart's annual revenues exceed the gross domestic product (GDP) of Austria; Exxon-Mobil's revenue is greater than the GDP of Argentina or Turkey; and General Motors' revenue is more than the combined GDP of Columbia and the Philippines. All of them are among the world's 50 largest countries.

CRITERIA FOR PREPARING SUSTAINABILITY REPORTS

Reports on corporate sustainability generally are prepared based on reporting criteria established by an outside organization or the company's internal guidelines. The most dominant reporting regulations are those of the Global Reporting Initiative (GRI). Launched in 1997 with the goal of "enhancing the quality, rigor, and utility of sustainability reporting," the GRI began to develop criteria that could eventually serve as the basis for generally accepted reporting standards. The GRI has received active support and input from numerous groups--including businesses, not-for-profit organizations, accounting regulatory bodies (including the AICPA), investor organizations and trade unions--to build reporting guidelines that are accepted worldwide. In October 2006 it released its second comprehensive set of reporting guidelines--called the G3 Reporting Framework.

The rapid increase in the number of companies around the world adopting GRI standards and issuing corporate sustainability reports, along with the fact that the GRI works closely with the United Nations, gives its reporting criteria the credibility necessary to be considered generally accepted. Overall, the number of organizations reporting under GRI guidelines has grown exponentially since 2000. As of October 2006, nearly 1,000 international companies from more than 60 countries had registered with the GRI and were issuing corporate sustainability reports using some or all of its standards. (See exhibit 2, page 67, for a list of the 100 U.S. companies.)

Exhibit 2

U.S. Companies Registered With the GRI for
Corporate Sustainability Reporting

3M
Abbott Labs
AMD
AES Corporation
Agilent
Alcoa
Allegan
Alliant Energy
Amerada Hess
American Standard Companies
Anheuser-Busch
Applied Materials
Avon Products
Bank of America
Baxter
Ben & Jerry's
Bristol-Myers Squibb
Brown & Williamson
Calvert Group
Cascade Eng.
Catholic Healthcare West
CH2M Hill
Chevron
Chiquita Brands
Cinergy (now Duke)
Cisco Systems
Citigroup
Coca-Cola Enterprises
Cummins
Dell
Dow Chemical
Dow Coming
Du Pont
Ecolab
EDS
Exxon Mobil
Ford
Freescale Semiconductor
GAP
Genecor
GE
GM
Georgia-Pacific
Gillette (now P&G)
Green Mountain Energy
Haworth
Heinz
Hewlett-Packard
Intel
IBM
International Finance
International Paper
Johnson & Johnson
Kimberly Clark
Louisiana Pacific
Lucent
Masco
Mattel
McDonald's
MeadWestvaco
Merck
Microsoft
Mirant
Motorola
National Grid
Newmont Mining
Nike
Office Depot
Pepsico
Pinnacle West Capital
Plan A
Polaroid
Procter & Gamble
R J Reynolds
Reebok
Rio Tinto Borax
SC Johnson & Son
Seventh Generation
Smithfield Foods
Staples
Starbucks
State Street
Sunoco
Target
Temple-Inland
Texas Instruments
Timberland
Time Warner
Tyco
Tyson Foods
UPS
United Technologies
Visteon
Wells Fargo
Weyerhaeuser
Wisconsin Energy
World Bank Group
Wyeth
YSI Incorporated

Source: As of October 2006,
www.globalreporting.org.

Companies can use GRI guidelines in several ways with varying degrees of stringency For example, they may elect to use them for informal reference or to apply them incrementally Or they may decide to report their corporate sustainability information based on the more demanding in accordance level. The move from informal to in accordance under GRI standards occurs through enhancements of transparent reporting, reporting coverage across the company and reporting structure (see www.globalreporting.org/services/ report/inaccordancechecks for more information). As of July 2006, just over 20% of the organizations issuing CSR reports using GRI guidelines did so at the in accordance level. This percentage has been increasing since 2002, suggesting organizations issuing CSR reports recognize an increasing market value for in accordance reports. The new G3 Reporting Framework is designed to improve the process whereby organizations become in accordance

OPPORTUNITIES TO PROVIDE ASSURANCE FOR CSR

As with any information an organization reports, the lack of an accompanying independent assurance report reduces the quality and informational usefulness of a CSR. (See "Fraud Risk in CSR." page 71.) Consider the reaction should public companies begin to issue unaudited financial statements. Aspects of CSRs are auditable because they are quantitative and verifiable. However. the current lack of reliable metrics for all stakeholder measures results to any qualitative statements about risk management and performance and quantitative measures that are not reliable enough to audit. Thus. the reports that are audited generally are limited in scope (a report might be accompanied by a legend stating which measures are audited).

Exhibit 6

Expert Panel Report for Shell Group 2005 Corporate Sustainability
Report

Panel of Experts:

Margaret Jungk, Business Department
Director, Danish Institute For
Human Rights

Dr. Li Lailai, National Programme Director,
Leadership For Environment
And Development (Lead)--China:
Director, Institute For Environment
And Development, Beijing

Jermyn Brooks (Review Committee
Chair), Board Member, Transparency
International

Roger Hammond, Development Director,
Living Earth

Jonathan Lash, President, World Resources
Institute.

Shell invited us to assess on two
counts. Firstly, does it contain
the right information about the
full range of issues that Shell stakeholders
care most about? Secondly,
how well does it reflect understanding
of stakeholders' expectations? We
were guided in our appraisal by the
AA1000 Assurance Standard, an independent
standard for evaluating sustainability
reports against three basic
principles: materiality, completeness
and responsiveness to stakeholders.
We met twice during the final stages of
Shell's report drafting process. We interviewed
senior Shell staff, including
the Chief Executive, and individuals
involved with the biggest projects and
issues in the Report. In recognition of
our time and expertise, an honorarium
was offered, payable to us individually
or to the organisation of our choice.
This is our assessment of the 2005
Shell Sustainability Report, unedited by
Shell. We speak here as individuals,
not for our organisations.

Shell's sustainability reporting

Since 1998, Shell's reporting has been
judged by many external experts as
among the best in its sector and overall.
Shell has made a serious effort to
compile a full and informative report
that responds to the needs of the company's
international stakeholders,
while keeping it concise and readable.
The Report's combination of descriptions
of the energy challenge and
Shell's business strategy, along with environmental
and social performance
data, documents Shell's concern with
sustainability issues and performance.
The Report is frank and honest. The
company discusses successes as well
as challenges and mistakes made (for
example, in the accounts of the Corrib
and Sakhalin projects).

[Detailed Comments on Specific Sections
Excluded--see Shell.com for complete
report]

We suggest the following ways Shell
might improve future Sustainability
Reports:

* In selecting subjects for inclusion
in the Report, Shell prioritises issues
which have the greatest impact on
Shell and are highlighted by pressure
groups. These measures may fail to
take sufficiently into account impacts
on wider society, that are not currently
the subject of pressure group or media
campaigns, but where the company
has a substantial and sustained impact.
We recommend that these be considered
as key selection criteria in future
Reports.

* Shell is increasing the number of
upstream projects. It is important for
the company to comment on how the
Shell Project Academy and biodiversity
knowledge management system will
contribute to the capture and transfer
of project experience and skills. Emphasis
should be on stakeholder dialogue
and conflict-management skills.

* Key performance indicators are
presented in the data section of the
Report. We believe they could be improved
by inclusion of additional metrics,
for example relating to pay discrepancies
between nationals and
non-nationals, the average number of
hours worked annually, and the use of
hotlines to report breaches of Shell's
General Business Principles.

* The annual spend on researching
and developing renewables would be
more helpful than cumulative figures
for the last five years.

Conclusion

We want to thank Shell for its commitment
to reporting and its willingness
to seek external review of the results.
We are impressed by the Report's quality
and the care with which it has been
compiled. Our critical comments in no
way diminish this. We are unanimous
in encouraging Shell to make progress
on this path.

The Hague, April 3, 2006

Source: The Shell Report 2005, The Shell Group,
www.shell.com.

A Step Beyond

Of the investors, portfolio managers and securities analysts who responded to a survey, 79% called annual reports an important tool in making decisions. An even greater number-90%-said the reports should go beyond financial and shareholder issues to include topics such as environmental sustainability and corporate governance.

Source: WithumSmith+Brown, www.withum.com. October 2006.

The GRI's new reporting framework addresses the issue of assurance for CSRs. Exhibit 3, below, provides details on the framework's choices on assurance. In 2005 KPMG reported that accounting firms prepared more than 50% of the assurance reports for CSRs.

Exhibit 3

Assurance Guidance in the GRI G3 Reporting Framework

Assurance

Choices on assurance

Organizations use a variety of approaches
to enhance the credibility of
their reports. Organizations may have
systems of internal controls in place,
including internal audit functions, as
part of their processes for managing
and reporting information. These internal
systems are important to the
overall integrity and credibility of a report.
However, the GRI recommends
the use of external assurance for sustainability
reports in addition to any
internal resources.

A variety of approaches are currently
used by report preparers to implement
external assurance, including the
use of professional assurance
providers, stakeholder panels, and
other external groups or individuals.
However, regardless of the specific approach,
it should be conducted by
competent groups or individuals external
to the organization. These engagements
may employ groups or individuals
that follow professional
standards for assurance, or they may
involve approaches that follow systematic,
documented, and evidence-based
processes but are not governed by a
specific standard.

The GRI uses the term external assurance
to refer to activities designed
to result in published conclusions on
the quality of the report and the information
contained within it. This includes,
but is not limited to, consideration
of underlying processes for
preparing this information. This is different
from activities designed to assess
or validate the quality or level of
performance of an organization, such
as issuing performance certifications
or compliance assessments.

Overall, the key qualities for external
assurance of reports using the GRI
Reporting Framework are that it:

* Is conducted by groups or individuals
external to the organization
who are demonstrably competent in
both the subject matter and assurance
practices;

* Is implemented in a manner that
is systematic, documented, evidence-based,
and characterized by defined
procedures;

* Assesses whether the report provides
a reasonable and balanced presentation
of performance, taking into
consideration the veracity of data in a
report as well as the overall selection
of content;

* Utilizes groups or individuals to
conduct the assurance who are not unduly
limited by their relationship with
the organization or its stakeholders to
reach and publish an independent and
impartial conclusion on the report;

* Assesses the extent to which the
report preparer has applied the GRI
Reporting Framework (including the
Reporting Principles) in the course of
reaching its conclusions; and

* Results in an opinion or set of
conclusions that is publicly available
in written form, and a statement from
the assurance provider on their relationship
to the report preparer.

As indicated in Profile Disclosure
3.13, organizations should disclose information
on their approach to external
assurance,

Source: www.globalreporting.org.

Exhibit 4, page 72, shows the CSR audit opinion for Royal Dutch/Shell's 2003 fiscal year. It was jointly audited by PricewaterhouseCoopers LIP (London) and KPMG LLP (The Hague). The opinion points out that only certain measures in the report were audited and describes the type of procedures performed. The last statement in the scope paragraph provides negative assurance for the remainder of the corporate sustainability report (the accounting firms read that part of the report and noted no material inconsistencies).

Exhibit 4

Independent Auditors' Report for Royal Dutch/Shell 2003 Corporate
Sustainability Report

Assurance report

To: Royal Dutch Petroleum Company and the "Shell" Transport and
Trading Company, p.l.c.

Introduction

We have been asked to provide assurance on selected data, graphs and
statements of the Royal Dutch/Shell Group of Companies (the "Group")
contained in The Shell Report 2003. The Shell Report Is the
responsibility of management. Our responsibility is to express an
opinion on the selected data, graphs and statements indicated below
based on our assurance work performed.

Assurance work performed

For the safely and environmental parameters identified with the symbol
[globe] on pages 22 to 26, we obtained an understanding of the systems
used to generate, aggregate and report the data for these parameters
at Group, Business, Zone and Operating Unit level. We assessed the
completeness and accuracy of the data reported in respect of 2003 by
visiting Operating Units to test systems and review data. We assessed
data trends in discussion with management. We tested the calculations
made at Group level, We also completed assurrance procedures on the
Refinery Energy Index and reported our findings to management.

For the Sakhalin Location Report on pages 16 and 17 we visited the
location to inspect documentary evidence and held interviews with
Business and in-country management and with three major Russian
contracting companies to understand and test the systems, procedures,
and evidence in place supporting the assertions and matters discussed
within this Location Report. We also performed assurance procedures in
relation to china West-East pipeline project and reported our findings
to management.

We read the whole Report to confirm that there are no material
inconsistencies based on the work we have performed.

Basis of opinion

There are no generally accepted international environmental, social
and economic reporting standards. This engagement was conducted in
accordance with the International Standards for Assurance Engagements.
Therefore, we planned and carried out our work to provide reasonable,
rather than absolute, assurance on the reliability of the selected
data, graphs and statements that were subject to assurance. We believe
our work provides a reasonable basis for our opinion.

Considerations and limitations

It is important to read the data and statements in the context of the
basis of reporting provided by the management as set out below and the
notes below the graphs. Environmental and social data and assertions
are subject to more inherent limitations than financial data, given
both their nature and the methods used for determining, calculating or
estimating such data.

Our assurance scope is limited to those specific matters mentioned in
our opinion below. We have not provided assurance over the contents of
the entire Shell Report 2003, nor have we undertaken work to confirm
that all relevant issues are included. In addition, we have not
carried out any work on financial and economic performance data and
data reported in respect of future projections and targets.
Accordingly, no opinion is given in respect of them. Where we have not
provided assurance over previous years' data this is clearly,
disclosed. We have not performed work on the maintenance and integrity
of information from The Shell Report published on the Group's website

To obtain a thorough understanding of the financial results and
financial position of the Group, the reader should consult the Group's
audited Financial Statements for the year ended 31 December 2003.

In our opinion:

-- The safety and environmental historical data and graphs (together
with the notes) on pages 22 to 26, marked with the symbol [globe],
properly reflect the performance of the reporting entities for each of
these parameters;

-- The assertions and matters discussed in the Sakhalin Location
Report, on pages 16 and 17, are fairly described and supported by
underlying documentary or other evidence.

22 May 2004

(1) Source: The Shell Report 2003, Royal Dutch/Shell Group of Companies,
www.shell.com.

The majority of information on which assurance currently is being provided is nonfinancial, quantitative performance measures. For example, PricewaterhouseCoopers and KPMG provided assurance on these performance measures in the Shell report:

* Global warming potential.

* Energy efficiency

* Total spills.

* Flaring in exploration and production activities.

* Fatal accident rate.

* Injury frequency

* Carbon dioxide release.

* Methane release.

* Regulatory, health, safety and environmental fines.

While there are many other performance measures in the report, their auditability was not at the level the firms could audit with a high enough level of assurance to provide an opinion.

Other assurance approaches that accounting firms use include a review level engagement or limited assurance based on the policies in place and the results of evidence-gathering procedures, as well as verification reports that refer to existing international assurance and attestation standards. For example, exhibit 5, page 73, contains the independent auditors' report for Starbucks' 2005 CSR. Moss Adams LLP issued it as being prepared using international standards approved by the IAASB and issued in 2005 as a guideline. The firm's conclusion says Starbuck's CSR was prepared consistent with its internal policies and report information was reasonably supported by documentation, internal processes and activities, and information provided by external parties. This type of report, while only referring to established criteria (standards approved by the IAASB) still improves the quality of information for external users.

Exhibit 5

Auditors' Report of Starbucks Corporation
Sustainability Report

To the Stakeholders of Starbucks Coffee Company:

We have been engaged to provide assurance on the Corporate Social
Responsibility ("CSR") Fiscal 2005 Annual Report (the "Report") of
Starbucks Coffee Company ("Starbucks"), for the fiscal year ended
October 2, 2005.

We have performed evidence-gathering procedures on the following
subject matter:

* Key Performance Indicators Summary and Fiscal 2005 Highlights;

* Information and data provided in each area of focus of the Report
(World of Products, Society, Environment, and Workplace); and

The management and reporting for the preparation of this information
and data.

We have considered the subject matter against the following evaluation
criteria:

* The procedures by which the CSR information and data were prepared,
collated and compiled internally; and

* The control environment over the quality elf the information and
data.

Our statement should be considered in conjunction with the inherent
limitations of accuracy and completeness for CSR data as well as in
connection with Starbucks internal reporting guidelines.

The Board of Directors of Starbucks is responsible for both the
subject matter and the evaluation criteria.

Our responsibility is to report on the internal reporting processes,
information and data for CSR based on our evidence-gathering
procedures. Currently there are no statutory, requirements or
generally accepted verification standards in the United Stares of
America that relate to the preparation, presentation, and verification
of CSR reports. There are International standards for the CSR reports
that were approved by the International Auditing and Assurances
Standards Board (IAASB) in January 2005. Using the IAASB approved
standards as a guideline, we planned and performed evidence-gathering
procedures to provide a basis for our conclusion. However, we have not
performed an audit in accordance with the International Standards on
Auditing. Accordingly, we do not express such an opinion.

Our evidence-gathering procedures included, among other activities,
the following:

* Testing the effectiveness of the internal reporting system used to
collect and compile information on each area of focus in the Report;

* Performing specific procedures, on a sample basis, to validate the
CSR data;

* Visiting Starbucks coffee buying operations in Switzerland;

* Visiting Starbucks corporate headquarters in Seattle, Washington;

* Interviewing partners responsible for data collection and reporting;

* Interviewing partners at retail location;

* Assessing the information gathering and compiling process of each
area of focus in the Report;

* Reviewing relevant documentation, including corporate policies
management and reporting structures; and

* Performing tests, on a sample basis, of documentation and systems
used to collect, analyze and compile reported CSR information and data.

In our opinion, based on our work described in this report, the CSR
information contained in the Report gives a fair representation of
CSR performance and activities of Starbucks Coffee Company for the
fiscal year ended October 2, 2005. Statements, assertions and data
disclosed in the Report are reasonably supported by documentation,
internal processes and activities, and information provided by
external parties.

Moss Adams LLP
Seattle, Washington
January 27, 2006

Source: Starbucks 2005 Corporate Social Responsibility Report,
www.starbucks.com.

Shell's 2005 CSR report was ranked no. 1 by Pleon's 2005 Global Stakeholder Report (www.pleon.com), which asked stakeholders worldwide to give examples of companies that do a good job of CSR reporting. Interestingly, Shell changed its approach for its 2005 report from using independent accounting firms to an independent panel of experts who reviewed the CSR and offered praise and criticism (see exhibit 6, page 74, for excerpts from the panel's report). While this change does not mean the independent accounting firms were ineffective, it suggests organizations should consider a range of methods for providing assurance about the information in the CSR. If accountants fail to act on the opportunity to provide assurance, companies will begin to adopt other, less rigorous, means.

CHALLENGES OF PROVIDING AUDITOR ASSURANCE

There are two major challenges in providing a sustainability report with auditor assurance: the suitability of the criteria management uses to prepare its sustainability report and the performance and reporting standards the auditor uses. International and national standard setters should not let these challenges deter them from seeking a solution--there is need for these reports, as well as to protect the public through auditor verification.

While the GRI appears to have the most commonly adopted criteria for sustainability reporting and is the organization likely to evolve as providing generally accepted CSR guidelines, it has yet to be recognized in this role by a regulatory body. One mason GRI standards are not generally accepted is the nature of the measures included in its earlier 2002 reporting guidelines, which faced issues associated with relevance, reliability, auditability and the like. The GRI says one of its goals in issuing the new G3 guidelines was to improve the relevance and auditability of measures.

In 2002 the AICPA and the Canadian Institute of Chartered Accountants (CICA) formed a joint task force on sustainability reporting. While the task force concluded in 2003 that the GRI had not yet developed to a point where its criteria were suitable, it also recognized the importance of working with the GRI and international standard setters to develop performance and reporting criteria. The task force took an important step in the United States by developing the first attestation engagement on environmental reporting. With the approval of the AICPA Auditing Standards Board, the task force issued Statement of Position 03-2, Attest Engagements on Greenhouse Gas Emissions Information. The AICPA also is participating in the Enhanced Business Reporting Consortium (www.ebr360.com), which is examining how to improve information for public company stakeholders.

In January 2005 the professional body of accountants in the Netherlands published two exposure drafts--ED 3410, Assurance Engagements Relating To Sustainability Report, and ED 3010, Practitioners Working With Subject Matter Experts From Other Disciplines On Non-Financial Assurance Engagements (presumably referenced in the Starbucks CSR assurance report). These documents were built on International Assurance Standards, which are similar to the attestation standards the ASB issues. In response the International Audit and Assurance Standards Board (IAASB) formed a sustainability advisory expert panel (which includes members from the AICPA/CICA task force) to review the EDs and provide comments and suggestions to the Netherlands. The EDs and the IAASB comment letter can found at www.ifac.org.

The letter focused on several key aspects of the EDs that needed refinement before they would be acceptable to the IAASB and ASB. Those include

* Judgments around the suitability of criteria decision.

* The use of experts in performing these types of engagements.

* The work effort necessary to distinguish between reasonable or high assurance vs. limited or moderate assurance.

* Materiality factors to consider in planning the scope of the engagement and when deciding on the type of report to issue.

* The completeness of the sustainability report.

Adding further to the auditor's challenge is the realization that the information in such reports usually is generated by a diverse set of measurement techniques. Information may be gathered from various sources, some of which are outside the reporting organization because of the specialized expertise required to accurately measure certain items. These circumstances may require the auditor to become familiar with the measurement procedures, management practices, systems and integrity of the other organization(s), in addition to those of the reporting organization. As Shell notes in its 2003 CSR, "environmental and social data and assertions are subject to more inherent limitations than financial data, given both their nature and the methods used for determining, calculating or estimating such data."

An alternate set of assurance standards has been developed by AccountAbility, which has no relationship with the AICPA, IFAC or other well-established assurance organizations. In 2002 AccountAbility issued its AA1000Assurance Standards, which represented the first assurance standard covering sustainability reporting and performance based on principles of materiality, completeness and responsiveness (www.accountability.org.uk). Some 120 organizations used the AA1000 standard in 2004.

GROWTH OPPORTUNITY

Corporate sustainability reporting is a rapidly growing way to address stakeholder demands for risk management and more performance measurement information. There are tremendous opportunities for CPAs in industry to be involved with the preparation and disclosure of these reports. The GRI G3 Reporting Framework might emerge as the one most likely to be generally accepted. With organizations issuing corporate sustainability reports at a rapid rate using GRI guidelines, stakeholders for all public companies will come to expect these reports at some point in the future.

There also are tremendous opportunities for CPAs in public practice to provide independent assurance on these reports. However, they face several challenges, including the development of performance and reporting standards. The ASB is supportive of and is working with the IAASB to develop international standards that can be tailored for U.S. auditors. Addressing these challenges will satisfy the growing needs of investors who are demanding the information and who would benefit from auditor assurance. In the 2005 Pleon report, researchers Thomas Lowe and Jens Clausen said CSR report credibility is best achieved by external accountants providing formal external report verification. However, as Shell's change to an expert panel illustrates, accountants might only have a finite amount of time to step forward and provide the expected assurance.

Brian Ballou, CPA, PhD, is an associate professor of accounting at Miami University in Oxford, Ohio. His e-mail address is balloubj@ muohio.edu. Dan L. Heitger, PhD, is an assistant professor of accounting at Miami University (Ohio). His e-mail address is heitgedl@muohio.edu. They are codirectors of the Center for Governance, Risk Management and Reporting at the Richard 7: Farmer School of Business. Charles E. Landas, CPA, is vice-president, AICPA professional standards and services. He oversees technical activities, including the Auditing Standards Board, and also is the AICPA's representative on COSO. His e-mail address is clandes@ aicpa.org. Mr. Landes is an employee of the American Institute of CPAs. His views, as expressed in this article, do not necessarily reflect the views of the Institute. Official positions are determined through certain specific committee procedures, due process and deliberation.

Fraud Risk in CSR

Thomas Golden is one of the leading forensic accounting partners at PricewaterhouseCoopers. He believes individuals who perpetrate financial reporting fraud generally fit one of two profiles. The first is otherwise honest individuals who misrepresent the numbers by rationalizing that what they are doing is best for the company. The second group is individuals who are well aware of what they are doing and who are attempting to attain goals dishonestly. Golden says such individuals exhibit a "rampant disregard for the truth." With either pattern, the pressure to misrepresent information is not entirely alleviated by the Sarbanes-Oxley Act or any other act by a government agency or regulator.

In fact, Golden believes that in the case of financial statement reporting, the rules put in place by Sarbanes-Oxley are analogous to squeezing a balloon. Although they make misrepresenting a company's financial reports more difficult (it's harder to "cook the books"), the pressure on the organizational balloon to perform well remains intense and causes misrepresentations to pop out in other areas.

One rather obvious area where this misinformation can pop out is through largely unaudited reports containing mainly nonfinancial information about an organization, such as the success of a company's new drug in Southeast Asia or the number of subscribers in its system. While the auditor reads communications such as press releases, letters to shareholders and the management discussion & analysis section of annual reports for consistency with the financial statements, nonfinancial information in these communications, as well as corporate sustainability reports, provide tempting opportunities for misrepresentations because they are unaudited.

Another intriguing example Golden offers is that of certain prisoners who, even in solitary confinement, have successfully continued to run their gang's activities on the outside. Unfortunately, these prisoners don't stop communicating illegal and dangerous information to individuals willing to listen. Instead, they adapt to their situation in solitary, which might be difficult at first but becomes easier with practice.

In much the same way, a fraudster might no longer be able to manage earnings or misapply GAAP as easily as before Sarhanes-Oxley, but he or she can find other ways to accomplish the same objectives. And these methods will get easier over time with practice. The use of unaudited communications that contain nonfinancial and other operations data in a misrepresentative manner might be challenging at first, but that will become easier with practice, too.

Golden says that as long as there is an abundance of investors with too much money chasing too few investment opportunities offering high returns, the temptation to misrepresent a company's performance or future prospects based on nonfinancial and other information will be too great to ignore. He says this is a huge hole in the corporate reporting process and if the accounting profession fails to take a leadership role in plugging it, a new market entrant could emerge to capitalize on providing assurance services for corporate sustainability reports.

"Individuals and firms in our profession need to realize they are in the 'assurance,' not simply the 'auditing' business," Golden says, "and investors need assurance on nonfinancial as well as financial data."