International Conference on Environment 2008 (ICENV 2008)

THE NEED FOR COPORATE SOCIAL RESPONSIBILITY

ASSURANCE
BARRY ACKERS
Department of Auditing, School of Accounting Sciences, University of South Africa,
P.O. Box 392, UNISA, South Africa
ackerb@unisa.ac.za

ABSTRACT
It is suggested that the business of business is no longer simply about short term profit
maximisation, but increasingly its about the value added, (or destroyed), in respect of its
interaction with the environment and society as a whole. Many organisations discharge their
corporate social responsibilities (CSR) through self-regulation and voluntary disclosure.
However, many critics claim that organisations usually only report positive aspects, while
placing the desired spin on others; and omitting transgressions that could impair its
credibility and standing amongst stakeholders. Since it is globally accepted that ensuring
effective corporate governance structures are the direct responsibility of the board of
directors, the critical question that emerges is whether any assurance, in respect of the
broader non-financial aspects of corporate governance disclosures is obtained. This
exploratory paper utilises both qualitative and quantitative data to introduce CSR and
establish a need for CSR disclosure assurance. Moreover, it particularly considers the role of
the audit profession, with specific reference to internal audit. Despite the increasing trend
towards CSR assurance, supported by literature presenting a strong case for CSR assurance
and a role for the auditing profession, a limited exploratory study found a lack of involvement
by internal audit in CSR activities. It is suggested though that this is indicative of the current
stage of the CSR discourse, which should change as CSR continues to evolve.
Keywords:

Corporate Governance; Corporate Social Responsibility; Auditing Profession;

Internal Audit; Accountability

INTRODUCTION
Today, there are global calls by society to secure a sustainable future for humanity
and to avoid a pending socio-economic and environmental crisis [13]. This is echoed by
Kotler & Lee (2005: x), who concludes that since everyone wants a better world, it is
imperative that corporations recognise the accruing bottom-line benefits, that working in
partnership with communities can bring [31].
A Global CEO Survey undertaken by McKinsey in 2006, reports that 84% of 4238
executives in 116 countries, no longer accepted the clich coined by Nobel Laureate Milton
Friedman (1970), that the business of business, is business [16]. While the majority of
respondents have recognised the importance of managing their economic, social, political and
environmental impacts, in terms of reputational damage and destruction of shareholder value,
this shift is not universally accepted [29]. The triple bottom line [14], introduces the idea that
organisations are not only responsible to shareholders for sustaining a viable financial return
on their capital investment, but are increasingly expected to act responsibly towards their
broader stakeholders in respect of the social and environmental impact of their operations
[46]. In this context stakeholders include owners, financiers, employees, customers (both
existing and prospective), suppliers, government and society at large (adapted from [5]).

International Conference on Environment 2008 (ICENV 2008)

However, the corporate social responsibility (CSR) horizon is fragmented by a

philosophical debate over the role of organisations [28; 29; 30; 31; 27]. Eells (cited in [56]),
suggests that CSR is a continuum of real organisational behaviours ranging from
irresponsible to responsible. On the one hand, the traditional corporation argues that profit
maximisation for the benefit of the owners is the sole legitimate purpose of business, whereas
at the other extreme, the model of the social corporation recognises a wider stakeholder role
and responsibility.
This exploratory paper utilises both qualitative and quantitative data to introduce CSR
and establish a need for CSR disclosure assurance and specifically to consider the role of the
audit profession, particularly that of internal audit.
RESEARCH METHODS AND DESIGN
Introduction. The research approach adopted utilises existing literature, secondary data and
a limited empirical study.
Research Problem. Despite societal calls for increased organisational accountability, for the
impact of their actions, or inaction, on society and the environment, the dominant global
practice is on voluntary disclosure. This however, increases the risk of organisations
selectively only disclosing information, placing them in a favourable light [13]. Stakeholder
demands for comprehensive and transparent CSR related disclosures and accordingly
increased organisational accountability, raises concerns about the completeness, validity,
accuracy and reliability of CSR disclosures.
Research Question. The primary research question is to determine whether CSR disclosure
assurance is really necessary. Within that context, a secondary research question is whether
the audit profession (and internal audit in particular), has any role to play.
Thesis Statement. A thesis statement names the central argument of a work, capable of being
challenged, either for or against, by a knowledgeable person in the field [23]. A thesis is a
statement, theory, position or proposition advanced and maintained by argument, or one
advanced without proof [7; 37; 41]. For the purpose of the exploratory study into an
emerging and untested field, a thesis approach, rather than a hypothesis is used. Whereas a
thesis represents a position advanced by argument, a hypothesis should be empirically
proven, or rejected. The thesis statement for this research paper is that stakeholders require
CSR assurance; and that the audit profession has a role to play.
Research Methodology and Design. This multidisciplinary study utilises qualitative
techniques to extract data from existing literature and secondary data sources to establish:
A need for CSR assurance;
The role of CSR assurors; and
The role of the audit profession.
The emerging nature of CSR assurance, for both audit practitioners and researchers, has
resulted in a mixed method exploratory study to gauge the extent of internal audit
involvement in CSR assurance. The exploratory study accordingly utilises quantitative data
(obtained through survey questionnaires), complemented by qualitative data (from the
content analysis of sustainability reports and secondary data sources).
Target Population for the Exploratory Study and Sample. The exploratory study
population incorporates South African enterprises impacted by the King report on corporate

International Conference on Environment 2008 (ICENV 2008)

governance for South Africa (King II), including both Johannesburg Securities Exchange
(JSE) listed public companies (representing the private sector) and government owned
enterprises (representing the public sector) [25]. Given the indicative nature of this study, a
convenience sample of 40 Chief Audit Executives (CAEs) of South African trading entities,
were selected to participate in the exploratory study. All were members of the Institute of
Internal Auditors in South Africa [26]. The content analysis used a convenience sample of
CSR reports of the largest 100 JSE listed companies (in terms of market capitalisation).
Data Collection. The IIA SA, on behalf of the researcher, selected and distributed the survey
questionnaires to a convenience sample of 40 CAEs. Data collection was through the use of
semi-structured survey questionnaires, containing primarily closed questions. Respondents
were required to complete self-administered survey questionnaires adapted from a study on
corporate governance and ethics, by Cates, MacCabe & Williams (2006: 8 11), also
directed at CAEs.
Response Rate. 12 responses were received from the 40 questionnaires sent, i.e. a response
rate of 30%. Due to the exploratory nature of this preliminary study, the 30% response rate is
regarded as being adequate. The non-statistical sampling methodology should identify
emerging trends but introduces an element of bias invalidating generalised deductions from
the research results.
Data Analysis. Given the relatively small sample, the data were analysed and reflected as
simple percentages representing the response frequencies. Where a negative response arose,
the confirming responses, representing the new frequencies, were further analysed.
Research Limitations. While this research examines CSR, stewardship and accountability; it
does so primarily from an audit perspective, with the exploratory study specifically
examining internal audit perceptions.
Since all the respondents represented internal audit practitioners, sample bias implies that no
deductions other than those pertaining to internal audit perceptions may be drawn. However,
since this study is used to support a proposition rather than to test a hypothesis, non-response
bias should not invalidate the result.
CORPORATE SOCIAL RESPONSIBILITY AND ACCOUNTABILITY
Corporate Governance and Corporate Social Responsibility (CSR). Sir Adrian Cadbury
succinctly defines CSR as being an integral component of corporate governance (as cited in
[25]):
Corporate governance is concerned with holding the balance between economic
and social goals and between individual and communal goals the aim is to align
as nearly as possible the interests of individuals, corporations and society.
According to Keasey et al (2005: 2), within an organisational context, effective corporate
governance has two primary dimensions [30]. At a micro level, ensuring that the organisation
functions in pursuit of its objectives, for the benefit of shareholders; and at a macro level
considering societal well-being as a whole.
Stakeholder theory presupposes that corporations are not only accountable to shareholders,
but also to the broader stakeholders. According to Gonella et al (cited in [40]), being
receptive to stakeholder views assists companies to achieve long-term success [46],

International Conference on Environment 2008 (ICENV 2008)

illustrating that economic, social and environmental objectives are not necessarily in conflict.
Company stakeholders include any person, or entity, with an interest in the well-being and
impact of the company. For example, employees may be concerned about employment
prospects and income security; creditors may be interested in the ability to recover its debts;
and the community may be interested in its survival and environmental behaviour, from the
perspective of the neighbouring populations [43].
Like many dynamic business concepts, CSR is constantly evolving and does not yet have a
universally accepted definition, or even name, variously being referred to as the triple
bottom line; environmental, social and governance (ESG); sustainable development;
sustainability; corporate governance; corporate responsibility; corporate citizenship;
corporate social investment; corporate ethics; stewardship; or responsible business,
amongst others [31]. Nevertheless, the Canadian government has issued the following
comprehensive definition [8]:
Generally, CSR is understood to be the way firms integrate social, environmental
and economic concerns into their values, culture, decision making, strategy and
operations, in a transparent and accountable manner and thereby establish better
practices within the firm, create wealth and improve society.
The worlds population explosion to around 6.5 billion, increasing global economic
prosperity, and the economic disequilibrium between developed and developing countries,
emphasizes the stark reality that the earth does not have an infinite capacity to sustain its
human population. The impact is illustrated by the finding that if the global population
consumed resources at the same rate as the UK, we would require 3.1 planets [39], the USA 6
planets, with even South African consumption representing 1.2 planets [42].
The co-dependent relationship between big business and society is an implicit social contract,
providing each side with obligations, opportunities and advantages [12]. In the opinion of the
researcher, this co-dependency recognises that only through making profits and remaining in
business, can organisations contribute to the social and environmental considerations of the
triple bottom line [14].
King II advocates integrated principled based organisational governance, recognising that
business no longer operated in a vacuum, but within a societal context, by introducing the
principles of good social, ethical and environmental practice. Since sustainable development
involves the simultaneous pursuit of economic prosperity, environmental quality and social
equity [25], organisations should not only be evaluated on economic value added, but also on
the value, or cost, of its environmental and social contribution and/or degradation.
KPMG (2005:18) found that economic considerations, including increased shareholder value
or market share, increased business opportunities, innovation, reputation and reduced risk,
were the primary drivers for CSR. Pleon Kohtes Klewes (2005: 17) however, concluded that
the primary motivation for CSR disclosures was to improve their reputations [44].
Adding to the CSR business case, Reuvid (2007: 12 13) suggests that in addition to
increased risks, social issues also provide value creation opportunities [46]. Examples
include the production of generic drugs to reduce pharmaceutical costs, healthier meal
options at fast food restaurants, cleaner fuels and more efficient engines to reduce emissions
and consumption.

International Conference on Environment 2008 (ICENV 2008)

Forward thinking organisations may therefore gain competitive advantage by identifying and
capitalising on these opportunities, before their competitors.
Effective risk management provides greater competitive advantage through more stable
operations, and improved compliance and governance, enhancing stakeholder confidence and
trust [46].
Accountability. CSR is the process of providing information designed to discharge social
accountability [19]. Mitchell, Hill & Stobie (2005: 67 68) suggests that the theoretical
bases for CSR are [38]:
Stakeholder theory, making a normative assumption that businesses have a social
accountability duty to their stakeholder; and
Legitimacy theory, explaining CSR as a mechanism that allows businesses to continue
operating with tacit stakeholder approval, by providing sufficient accountability to
satisfy these stakeholders.
Referring to leading dictionaries [7; 37; 41], it would appear that accountability is about
accepting responsibility for actions and outcomes (whether good or bad); delivering
performance in respect of obligations and expectations; and accounting for actions and/or
inactions. The researcher suggests that accepting responsibility is only one part of the
accountability equation and timeously providing stakeholders with CSR disclosures, the
nature and contents of which have integrity, are equally important components of
accountability. This is confirmed in AA1000AS [1].
Corporate Social Responsibility Disclosure. Godfrey, Hodgson & Holmes (2003: 711
712) argue that traditional accounting methods are limited by artificially constructed
organisational boundaries and inadequate provision for non-financial components frequently
associated with CSR related disclosures [18]. For example, since raw materials are only
accounted for upon receipt, producers usually do not track and cost environmental and social
impacts before raw materials arrive at the factory, nor after the products leave the factory
floor. Life cycle analysis on the other hand provides a more complete understanding of the
interdependence and interactions amongst business, society and the environment, through the
identification of all the relevant costs.
Internationally, mandatory environmental and social reporting regulations are being
implemented, particularly in the European Union, where companies are required to include
environmental performance in their annual reports [12; 32]. In a global study, Pleon Kohtes
Klewes (2005: 12) found that only 25.3% of respondents were not in favour of mandatory
CSR reporting [44]. Despite environmental and social reporting not being mandatory for all
organisations, many are already adopting voluntary codes of conduct and corporate reporting
in this regard [28].
King II [25] requires companies to report annually on its social, transformation, ethical,
safety, health and environmental management policies and practices [25]. Despite being a
voluntary code, King II particularly applies to public entities (in terms of the Public Finance
Management Act of 1999) and to JSE listed entities [25].
Organisations are required to disclose the extent of compliance, or the reasons for noncompliance with the corporate governance principles implicit in King II [25].

International Conference on Environment 2008 (ICENV 2008)

The Board of Directors. Boards of directors are usually appointed by the owners, as the
agents, or custodians, of their organisations [13]. Directors have a fiduciary duty to exercise
their powers bona fide and for the benefit of the organisation, as well as to display reasonable
care and skill in carrying out the responsibilities of their office [34]. King II confirms
directors responsibilities, by emphasising their duty to observe the principles of good
corporate governance. According to Braiotta (2004: 4 5), directors responsibility includes
ensuring meeting public expectations of corporate performance on social and ethical issues
[6]. Despite the absence of a legal stakeholder obligation, board accountability may extend
beyond the shareholders to include broader stakeholders, for any violation by the
organisation, of its perceived corporate governance responsibilities (including CSR). An
extreme example of stakeholder liability could include a catastrophic environmental disaster,
where rehabilitation costs and victim compensation exceeds the organisations resources.
Traditionally, the board receives assurance about the reliability of financial accounting and
internal control systems, through the audit committee; from the auditing profession (both
external and internal) and from executive management in respect of social and environmental
risk mitigation. Since King II requires triple bottom line performance reporting, disclosures
should comply with the Global Reporting Initiative (GRI, 2006) principles of reliability,
relevance, clarity, comparability, timeliness and verifiability [25].
CSR ASSURANCE
An Early Prediction. In 1972, at the very infancy of the movement advocating greater social
corporate responsibility, David Rockefeller (President of Chase Bank) suggested that due to
growing pressure for improved corporate accountability, he could foresee the day when, in
addition to the annual financial statements being certified by independent auditors,
corporations could also be required to publish social audit reports, similarly certified (cited in
[19]). Even in those early years, it was predicted that to ensure completeness and integrity of
CSR disclosures, verification of CSR disclosures was desirable.
Establishing the Need for CSR Assurance. Despite an increase in the provision of CSR
assurance, the CSR assurance business case remains unresolved [11]. Organisations use
different approaches to enhance their CSR report [11], including internally conducted
assurance, stakeholder panels, or well-known experts to provide commentary. Despite
internal control systems and internal audit for managing and reporting information, in
addition GRI G3 recommends external CSR report assurance [17].
Internal stakeholders (i.e. investors and employees) more readily accept CSR disclosures,
while others tend to be more sceptical. CorporateRegister.com (2008: 10) suggests that
assurance provides both internal and external value, with robust assurance significantly
enhancing report credibility and boosting stakeholder confidence [17].
Ernst & Young (2007) perform an independent annual evaluation of the JSE Socially
Responsible Investment (SRI) Index [15]. They argue that it is becoming increasingly
important for assurance to enhance CSR report credibility, and recommends the use of
independent, external assurance providers.
Percy (1997: 5 6) suggests that auditing is an essential component of corporate governance
[43]. He argues that the public believe auditors have a broader responsibility than reporting
on the annual financial statements. The public expect auditors to consider environmental and

International Conference on Environment 2008 (ICENV 2008)

societal issues, to produce an annual report that can be relied upon by all stakeholders.
Eccles et al (2008: 8) suggests that credible assurance mitigates the risk of organisations
saying how accountable they are, rather than representing the actual position [13].
UNCTAD (1997: 20) recommends including externally verified third party opinions, based
upon accepted and tested verification procedures, to improve credibility for external
stakeholders [53]. Similarly, the Association of Certified and Chartered Accountants
(ACCA, 2007: 9) supports CSR report assurance, challenging assertions not supported by
convincing and reliable evidence [5]. Given the audit professions rigorous methodologies,
together with their training, compared to other assurance providers, although not the subject
of this paper, it is likely that many will not meet this stringent requirement.
The Canadian government concludes that verification provides stakeholders with reliable
information, to gain their trust and be perceived as organisations with credible integrity [8].
While many companies discharge their CSR responsibilities through adopting voluntary
codes of conduct [28], only effective monitoring and independent verification, will provide
assurance that a company meets certain ethical standards. Jenkins (2001: 25) however,
suggests that organisations tend to oppose independent monitoring and verification, arguing
that even when independent monitoring is accepted, the interpretation of independent is
often contentious [28].
CSR Assurance Standardisation. Initiatives are underway to converge social, ethical,
environmental, accounting, auditing and reporting standards, which should result in uniform
terminology, improving comparability and avoiding confusion caused by inconsistency.
Owen et al (2000: 91 92 and 95) suggests that social (and environmental)1 audits are not
really different to financial audits, with independence enhancing credibility. They conclude
that rigorous verification procedures, based on attestation and drawing heavily on current
financial auditing procedures, should be agreed [40].
In the absence of universally accepted principles, or standards, for CSR assurance, three
major approaches have emerged, i.e. AA1000AS, ISAE 3000 and the GRI Guidelines [11].

The AA1000 Assurance Standard (AA1000AS), launched by AccountAbility in 2003,

is the only internationally recognised standard specifically designed to provide
sustainability assurance [1]. AA1000AS assurance addresses CSR report credibility,
underpinned by the principles of completeness, materiality and responsiveness [11].
The International Standard on Assurance Engagements 3000 (ISAE 3000), also
known as Assurance Engagements Other Than Audits or Reviews of Historical
Financial Information, was published in 2005 by the International Federation of
Accountants [24]. It provides guidance to the audit profession on how to conduct
non-financial assurance. Despite being an audit standard, other assurors are also
starting to refer to ISAE 3000 in their assurance statements [11].
The Global Reporting Initiative Guidelines (GRI) represents voluntary principles and
guidance for organisations reporting their sustainability performance [17]. Despite
increasingly being referred to by CSR assurance providers, the current G3 version of

Whereas the author of the article published in 2000, only refers to social audits and is silent on the
environmental dimension, in the researchers opinion for the purpose of this paper, the two are interrelated and
should not be separated.

International Conference on Environment 2008 (ICENV 2008)

the standard, introduced in October 2006, is neither a standard, nor a benchmark

against which assurors should measure CSR reports. It does however, reference
external assurance for determining whether the GRI Reporting meets the
requirements, in order to reach its conclusions [11].
The Role of Other Assurance Providers. Many different approaches and assurance
providers exist for CSR assurance [11]. The audit profession is globally dominant with 42%,
other significant CSR providers being certification bodies with 25%, followed closely by
specialist consultancies with 24% [11].
The Audit Profession. This paper considers the audit profession from the perspective of the
accounting profession, comprising two primary components, i.e. internal and external audit,
both of which are assumed meet the criteria for a profession.
Accounting is about providing a record, or explanation of performance, whereas auditing is
about a methodical examination which may result in the production of a final report [37; 41].
According to Taylor, Kritzinger & Puttick (1983: 1), an auditor is one who satisfies himself
as to the truth of the accounting of another. The essence of accountability is on accepting
responsibility for actions and outcomes (whether good or bad); delivering performance in
respect of obligations and expectations; and accounting for actions and/or inactions [52].
The historical origins of auditing, provides evidence that the audit profession has always dealt
with aspects of non-financial governance (Loots, 1989: 8 54). Despite lacking a formal
mandate, or obligation, in terms of the Auditing Profession Act, or the Companies Act,
anecdotal evidence suggests that external auditors already perform extended scope audits
covering non-financial governance. In 1989, Loots (1989: 309 404) already argued that
external auditors should conduct comprehensive audits.
Many lay-people associate the auditing profession with financial statement attestation. This
is a misconception, since that role only assumed its present dominance after the Industrial
Revolution [35], with the emergence of the agency problem caused by separating
management (agents) from owners (principals), to attest managements accountability and
stewardship [13; 10]. Despite the historical role expanding auditing beyond conventional
financial statement attestation, indications are that it was confined to performance-based
auditing [35], without any assurance role on social and environmental issues.
Like any profession operating in a dynamic environment, the auditing professions role has
always evolved, and will continue to do so to meet perceived stakeholder needs. This is
succinctly confirmed by Percy (1997: 3 4), suggesting that dynamic auditing will maintain
societal confidence in directors, management and auditors; and that corporate governance
developments, more inquisitive stakeholders and non-financial assurance requirements,
increases the demand for new forms of audit [43].
The Role of Internal Audit. Internal auditing is a value added service, providing an
independent appraisal of the diverse operations and controls within an organisation, to
determine the accuracy and reliability of information [47].
Sawyer et al (2003: 1113 1117) suggests that by evaluating the internal control
environment, internal audit reviews compliance with legislation and regulations, determining
propriety of social and environmental issues, and ensuring proper disclosure [47]. Internal
audit should ensure that CSR risks are effectively mitigated, that CSR operations are efficient

International Conference on Environment 2008 (ICENV 2008)

and effective, and that CSR decisions are based on factual information. In this regard, the
audit customer includes:
the client the organisation whose functions will be enhanced by the results of the
audit; and
Management requiring intelligence on the operations for which it is accountable.
While management may not be enthusiastic about CSR auditing, if properly performed, the
audit should provide the following key benefits [47]:
Assist with legislative and regulatory compliance
Identification of potential problem areas, which could incur substantial remediation
costs and penalties; as well as to avoid possible litigation against the organisation.
Improve organisational stakeholder image due to compliance with legal and
requirements and ethical business practices.
Improve the relationship with regulatory authorities, due to effective self regulation.
The Role of External Audit. External auditing is performed by experts, independent of the
auditee, in accordance with requirements of the parties for whose benefit the audit is
conducted. The most common external audits performed, are statutory, or regularity audits
providing financial statement attestation as required by legislation [45].
Despite the present external audit emphasis focusing on financial statement attestation,
anecdotal evidence shows that external auditing firms already undertake compliance,
operational, CSR and other audits. According to CorporateRegister.com (2008: 29), in 2007,
the Big 4 audit firms provided 40% of the global assurance statements, with smaller
accounting firms being responsible for an additional 2% [11].
Audit Expectation Gap. The global audit profession has long argued that the primary
objective of independent audits was to provide an objective opinion on the fairness of
financial statement disclosures. In this regard, during meetings with the researcher, both the
South African Institute of Chartered Accountants (SAICA) and the Institute of Chartered
Accountants in England and Wales (ICAEW), have confirmed that their members
responsibility presently does not extend beyond the internal stakeholders, (being management
and shareholders), including in respect of CSR assurance.
Audit beneficiaries however, believe that audit responsibility should extend beyond financial
statement attestation, with a direct obligation to protect the interests of stakeholders. This
gives rise to an expectation gap between the public expectations of auditors and what
auditors believe their audit objectives to be [10; 33].
DISCUSSION OF RESULTS
The Need for and Prevalence of CSR Assurance. Confirming external verification as the
most important factor contributing to credibility, Pleon Kohtes Klewes (2005: 57) found that
the strongest demand was from the financial community (71%), followed by NGOs (59%),
academics (58%) and employees (46%). Only 22% of respondents were not in favour
external CSR report verification [44].
The global cross sectoral average shows that 25% of CSR reports included an assurance
statement ([11]. CSR assurance differs across regions, with the 2007 results being led by
Europe with 30% (415 statements), followed by Australasia with 28% (55 statements), Africa
with 25% (18 statements), Asia with 22% (98 statements), South America with 20% (28
9

International Conference on Environment 2008 (ICENV 2008)

statements) and lastly North America with 7% (30 statements). CSR assurance in the top 100
companies in the top five reporting countries are the UK (57%), Japan (29%), Australia
(12%), and Germany and the USA (11%). A content analysis of the top 100 South African
companies, showed significant growth with 15% of CSR reports being externally assured,
compared to only 4% in 2005 [32].
While global CSR report volumes and assurance are still relatively low, CSR assurance has
shown an average annual growth rate of 20% over the past 10 years [11]. The 650 assurance
statements produced globally in 2007 [11], will increase exponentially in the near future, due
to increased demands for accountability.
The Role of the Audit Profession. The audit profession is globally dominant in assurance
provision, producing 42% of all CSR assurance statements. However, the regional position
differ with the audit profession representing 61% of African and South American assurance
statements, followed by Europe with 41%, Asia with 32%, North America with 30% and
Australasia with only 15%.
The content analysis of the top 100 South African companies clearly shows the audit
profession dominance, with the Big 4 producing 80% of assurance statements.
An Internal Audit Perspective. The top 100 companies content analysis, found 3% of cases,
where internal audit played an active role in providing CSR assurance. However, it is
recognised that other internal audit activities may also be involved in CSR auditing, without
specific reference in the CSR report, especially where reports are externally assured.
Interestingly though, while AA1000AS is an assurance standard, intended to guide external
assurance providers, the internal audit department of one of the top 100 companies, actually
produced an assurance report issued against AA1000AS, published as part of their 2007 CSR
report. When approached, management at this company commented that they derived greater
benefit, than if it had been done by external assurance providers. In this regard, when
measuring CSR against the Eells continuum, the researcher suggests that organisational CSR
maturity will determine the organisational position on CSR assurance. However, internal
audits mandate does not usually extend beyond internal management and the board.
The results of the exploratory questionnaire based study are discussed below.
Demographics. All respondents were internal audit practitioners with 75% representing the
private and 25% the public sectors. 33.3% of respondents were from organisations with more
than 5000 employees, 58.4% with between 5000 and 1000 employees, and 8.3% with less
than 500 employees. 66.7% of respondents represented organisations with a turnover of
more than R1bn, 25% with a turnover between R500m and R1bn, and 8.3% with a turnover
of less than R100m.
Policies and Procedures. 91.7% of respondents have a CSR policy, with 18.2% being called
corporate social responsibility (CSR), 63.6% corporate social investment (CSI), 9.1%
sustainable development or corporate citizenship.
Accountability. From an accountability perspective, 83.3% of audit committees review the
risk assessment results, 58.3% review the corporate governance policies, with none reviewing
the CSR policies.

10

International Conference on Environment 2008 (ICENV 2008)

While all boards are involved in setting strategy, only 58.3% of respondents believe that CSR
is an integral component of corporate governance, 8.3% that it is not, with the remainder of
33.3% being uncertain.
Respondents were subject to the following legislation, regulation or voluntary codes:
91.7% to King II,
83.8% to employment equity,
75% to black economic empowerment and occupational health and safety,
50% to the JSE SRI, environmental regulations and product safety,
25% to the Public Finance Management Act (PFMA), and
8.3% to the Financial Sector Charter.
Given prevailing legislation and regulations impacted by sample bias, as expected, all
respondents were audited by both internal and external auditors, with 58.3% by occupational
health and safety inspectors, 41.7% by labour inspectors, 16.6% by insurers and 8.3% by
environmental inspectors, by product quality inspectors and the South African Revenue
Services, as well. Interestingly, no respondents believed that there was any duplication of
audit roles by the various bodies conducting audits.
Quality Assurance. 8.3% of respondents were certified against ISO 9000, ISO 14000 and
OHSAS 18000, where internal audit were not involved in assurance. Additionally, 8.3%
subscribe to the Institute of Ethics, where internal audit assists in attestation. Indicative of
internal audits lack of involvement in CSR related matters, one respondent stated that they
were subject to National Occupational Safety Association (NOSA), which became defunct in
2005.
Internal Audit. While 33.3% of respondents recorded that internal audit played a role in
CSR, 75% thereof were in respect of audits, with the remainder being consulting
engagements. However, 66.7% of the audits were part of corporate strategy or high level
governance audits. Reflecting the increased emphasis on corporate governance, 58.3% of
respondents have undertaken corporate governance audits, the scope of which included King
II (42.9%), PFMA (28.6%), corporate governance best practice (28.6%), annual report
disclosure validity (14.3%), risk management (14.3%) and compliance with relevant
legislation and regulation.
Despite all respondents being subject to King II, the requirements of which includes
establishing an internal audit function, compliant with the IIA standards, only 50% reported
compliance with IIA Standard 2130 on Governance [47]. Since only 8.3% of respondents
actually stated that they do not comply with the standard, it may be presumed that the
remainder either does not understand the standard, or how it applies to them. This is rather
concerning, since the Standards for the Professional Practice of Internal Auditing, are
mandatory for internal auditing responsibilities to be effectively discharged [47].
41.7% of respondents believed that internal audit could play a more active role in CSR and
governance, or had the capacity to do so. While 16.7% of respondents believed that their
capacity could be enhanced through receiving training in environmental management, quality
management, total quality management, corporate governance, employment equity, OHSAS
18000, AA1000, HIV/AIDS and community outreach programmes, another 9.1% maintained
that time constraints prevented training and development, to develop their capacity in this
regard. 16.7% of respondents even suggested outsourcing the internal audit function. On a
11

International Conference on Environment 2008 (ICENV 2008)

positive note however, 25% of respondents suggested that internal audit could improve CSR
accountability practices by providing assurance on CSR activities, communicating CSR
benefits and risks, and by training management.
CONCLUSIONS
The study considers CSR from the perspective of being a component of good
corporate governance, arguing that the board has a duty to ensure the adequacy and
appropriateness of CSR practices and disclosures. The board derives assurance about the
organisations CSR performance from various sources, including but not limited to the audit
profession.
The lack of standardisation impedes the acceptability of both CSR and CSR
assurance. However, according to Alan Knight, the head of standards at AccountAbility2, the
International Federation of Accountants (IFAC) intend commencing with a rewrite of ISAE
3000, in December 2008, after the release of the revised AA1000AS, due on 24 October
2008. In his opinion, the various assurance stakeholder bodies are involved in continuous
dialogue, which should result in the standards and practices converging.
Albeit rather slowly, there is little doubt that organisations are responding to stakeholder
demands for increased corporate accountability, both in terms of corporate governance and
social responsibility, through increased CSR reporting, usually in the annual reports. This is
evidenced by 92% of respondents having corporate governance and CSR policies. The
relative seriousness of this dimension is illustrated by 75% of respondents dedicating a senior
resource to CSR matters. However, the lack of consistency over what constitutes CSR, is
illustrated by the range of activities covered.
Waddock & Graves CSR attribute weighting (1997: 310), rates employees as being the most
important, followed by product, community relations and the environment respectively [55].
This is in line with the results of the exploratory study, focusing on employee related matters,
followed by societal and environmental issues, with product related matters being less
prevalent. Interestingly, CorporateRegister.com (2008: 57) concludes that employees are the
most trusting stakeholder group, with only 46% preferring CSR reports to be externally
verified, compared with the financial communitys 71%. While corporate governance
practices focuses on improving accountability, the need for ensuring the veracity of
disclosures appears to be neglected [11]. It is however, suggested that this situation is
indicative of the relative maturity of CSR related issues. As the CSR movement gathers
momentum, it is expected that this role will increase exponentially within the forthcoming
few years.
The research clearly reflects that the objective of determining a need for CSR
disclosure assurance has been achieved. Nevertheless, while the literature and secondary
sources present a compelling case for CSR disclosure assurance, many organisations still
adopt a benevolent CSR approach. The issue maturity, which has already seen large
companies integrating CSR into their mainstream strategies, implies that while many
organisations are still in the initial stages, which should increase as CSR becomes embedded
and as CSR assurance benefits are recognised.
Since 42% of global CSR assurance statements were issued by audit firms, indicates
an opportunity for the audit profession to retain its dominant role, presenting an opportunity
for the expansion of the audit firms business model. However, the present training and
education regimen for audit professionals, does not adequately prepare them to conduct CSR
assurance engagements. Despite the international standards on auditing (ISA 620) [24],

As discussed in a meeting in London with the researcher, during September 2008.

12

International Conference on Environment 2008 (ICENV 2008)

allowing auditors to use the work of experts, the auditor still requires an understanding of the
tasks being performed by the expert.
Despite the case for internal audit involvement in CSR assurance, not being as strong
as for external audit, it has a distinct role to play. In organisations where CSR issues are still
emerging, internal audit could assist management by providing an objective appraisal of CSR
performance and recommending improvements, enabling management to improve their CSR
practices and disclosures. However, internal audits focus should be on delivering value to
internal stakeholders, through the provision of an objective appraisal of CSR performance,
rather than on providing assurance to broad stakeholders on CSR reports. Internal audit
could assist the external CSR assurance providers by being seconded to their team, by
performing certain tasks on their behalf, or by producing work of sufficient quality that they
may rely on, improving efficiency. Lack of CSR involvement, could result in internal
auditors risk not delivering on their primary mandate, of providing a value added service and
of ensuring effective risk mitigation.
While the study suggests that South African internal auditing professionals are
presently lagging behind in respect of CSR issues, of greater concern, is that many of the
respondents appear not to be compliant with IIA Standard 2130, regarding governance.
Moreover, possibly reflecting a lack of understanding of the CSR risks, is the strong view by
respondents that internal audit does not have a role to play in CSR assurance. This is a direct
contravention of IIA Standard 2110, which requires internal audit to identify and evaluate
significant organisational risks, and to monitor and evaluate the effectiveness of controls,
including CSR. This is particularly relevant, since internal audit has a responsibility to the
board, through the audit committee, to provide an assessment of the integrity of disclosures
and to ensure that significant strategic risks, including CSR, are identified and mitigated
against. The board will accordingly be in a position to discharge their fiduciary duties, by
making informed decisions that will not impair shareholder value.
Despite the small number of CSR reports being issued, it is encouraging that when
compared to the top five reporting countries, South Africa ranks third in terms of the
percentage of assurance statements of the top 100 companies, behind the UK and Japan.
As the discourse unfolds, and as stakeholder demands for improved accountability
increases, legislative and regularity frameworks, requiring a more active role by the audit
profession may be specified, if not mandated. Moreover, the growth of institutional
investments like pension and mutual funds, representing an amorphous group of investors,
will result in a convergence of owners and stakeholder interests.
In conclusion, despite being an exploratory study, the evidence strongly suggests that
while the audit profession, (the Big 4 in particular), are presently providing CSR assurance,
as the CSR issue maturity of organisations continues to evolve, the audit profession will have
an increasingly important role to play. In this regard, particularly in the emerging phase of
organisational CSR, internal audit will have an increasingly important role to play, by
providing management and the board with an objective assessment of their CSR
performance, complemented by appropriate recommendations. This should facilitates
continuous improvements in CSR practices and reporting, in preparation for external
assurance. Finally, by working collaboratively with the external assurance providers, internal
audit should improve CSR risk management while producing a more efficient and effective
CSR assurance process.

13

International Conference on Environment 2008 (ICENV 2008)

REFERENCES
[1] AccountAbility (2003), AA1000 Assurance Standard. London, UK (AccountAbility).
[2] Ackers, B. (2001), An Analysis of the SADC Textile and Garment Industries under
AGOA, and the role of Conformity Assessment. Johannesburg, South Africa:
Unpublished M.B.A. Dissertation Gordon Institute of Business Science, University of
Pretoria.
[3] AIRMIC, ALARM & IRM (2002), A Risk Management Standard. London, UK.
[4] Association of Certified and Chartered Accountants [ACCA] (2005), Sustainability:
Taking corporate governance one step further. Volume III. Kuala Lumpur, Malaysia.
[5] ACCA (2007), Social and Environmental Reporting and the Business Case Summary
of ACCA Research Report No. 98, London, UK.
[6] Braiotta, L. (2004), The audit committee handbook. 4th edition. New York, USA
(Wiley).
[7] Cambridge Advanced Learner's Dictionary accessed online on 8th January 2008
(http://dictionary.cambridge.org/define).
[8] Canada (2006), Corporate Social Responsibility An implementation Guide. An
official publication by the Government of Canada.
[9] Cates, R.W., MacCabe, D.J. & Williams, B.H. (2006), Survey on Ethics and
Governance A Research Project. Austin, Texas, USA (IIA Research Foundation).
[10] Chandler, R. & Edwards, J. (1996), A Recurring Issue in Auditing: Back to the Future?
Accountability Journal, 9: 4 29.
[11] CorporateRegister.com (2008), The CSR Assurance Statement Report. London, UK.
[12] Davis, I. (2005), What is the business of business. The McKinsey Quarterly, 2005,
Number 3: 105 113.
[13] Eccles, N.S., Pillay, V. & de Jongh, D. (2008), Correlates of Corporate Accountability
amongst South Africas largest Listed Companies. (Unpublished at time of writing).
[14] Elkington, J. (1994), Towards the sustainable corporation: Win-win-win business
strategies for sustainable development. California Management Review 36, no. 2: 90
100. [15] Ernst and Young (2007), Excellence in Sustainability Reporting 2007.
Johannesburg, South Africa (E&Y).
[16] Friedman, M. (1970), The Social Responsibility of Business is to Increase its Profits.
The New York Times Magazine, 13 September, 1970.
[17] Global Reporting Initiative (GRI) (2006), Sustainability Reporting Guidelines (G3).
Amsterdam, The Netherlands (GRI).
[18] Godfrey, J., Hodgson, A. & Holmes, S. (2003), Accounting Theory (5th Edition).
Milton, Queensland, Australia (John Wiley & Sons).
[19] Gray, R.H., Owen, D. & Maunders, K. (1987), Corporate Social Reporting; Accounting
and Accountability. Hertfordshire, UK (Prentice Hall).
[20] Guth, R.A. (2008), Bill Gates Issues Call for Kinder Capitalism. Wall Street Journal,
24th January 2008.
[21] Hazard, J. (7th June 2007), Gates Champions Creative Capitalism to End Inequity.
CIO
Insight
accessed
online
on
29th
February
2008
(http://www.cioinsight.com/c/a/Past-News/Gates-Champions-Creative-Capitalism-toEnd-Ineqity).
[22] Henderson, M.T. & Malani, A. (2008), Capitalism 2.0. Forbes Magazine, 10th March
2008.
[23] Hofstee, E. (2006), Constructing a Good Dissertation A Practical Guide to Finishing
a Masters, MBA or PhD on Schedule. Sandton, South Africa (EPE)

14

International Conference on Environment 2008 (ICENV 2008)

[24] International Federation of Accountants (IFAC), (2008), Handbook of International

Auditing, Assurance and Ethics Pronouncements 2008 Edition, Part I. New York,
USA (IFAC).
[25] Institute of Directors (IoD) (2002), The King Report on Corporate Governance for
South Africa 2002. Issued by the King Committee on Corporate Governance.
Parklands, South Africa (IoD).
[26] Institute of Internal Auditors (IIA) (2001), Standards for the Professional Practice of
Internal Auditing. Altamonte Springs, Florida, USA (IIA Inc.).
[27] Institute of Chartered Accountants in England and Wales [ICAEW] (2004), Information
for Better Markets Sustainability: the role of accountants. London, UK (ICAEW)
[28] Jenkins, R. (2001), Corporate Codes of Conduct: Self-Regulation in a Global Economy.
Technology, Business and Society, Programme Paper No. 2, April 2001. Geneva,
Switzerland (United Nations Research Institute for Social Development UNIRISD).
[29] Kakabadse, A. & N. (2007), CSR in Practice Delving Deep. New York, New York,
USA (Palgrave Macmillan).
[30] Keasey, K., Thompson, S. & Wright, M. (2005), Corporate Governance
Accountability, Enterprise and International Comparisons. Chichester, West Sussex,
England (Wiley).
[31] Kotler, P. & Lee, N. (2005), Corporate Social Responsibility - Doing the Most Good for
Your Company and Your Cause. Hoboken, New Jersey, USA (Wiley).
[32] KPMG (2005), KPMG International Survey of Corporate Responsibility Reporting
2005. Amsterdam, The Netherlands (KPMG International).
[33] Lin, Z.J. & Chen, F. (2004), An Empirical Study of Audit Expectation Gap in The
Peoples Republic of China. International Journal of Auditing, 8, 2004: 93 115.
[34] Loos, A. (2006), Directors Liability: A Worldwide Review, Alphen aan den Rijn, The
Netherlands (Kluwer Law international).
[35] Loots, J.A.J. (1989), An Evaluation of the Applicability of Comprehensive Auditing in
the South African context. Pretoria, South Africa: Unpublished D. Com. (Accounting)
Thesis University of Pretoria.
[36] Makower, J. (1994), Beyond the Bottom Line Putting Social Responsibility to Work
for Your Business and the World. New York, New York, USA (Simon & Schuster).
[37] Merriam-Webster online dictionary accessed 8th January 2008 (http://mw.com/dictionary).
[38] Mitchell, C.G., Hill, T.R. & Stobie, B.S. (2005), Corporate social and environmental
reporting as an effective mechanism to support social accountability in South Africa.
Southern African Journal of Accountability and Auditing Research Vol. 6, 2005: 67
74. [39] New Economics Foundation (2006), The Unhappy Planet Index. London, UK
(NEF).
[40] Owen, D.L., Swift, T.A., Humphrey, C. & Bowerman, M. (2000), The new social
audits: accountability, managerial capture or the agenda of social champions? The
European Accounting Review 2000, 9:1, 81 98
[41] Oxford Compact English Dictionary accessed online on 8th January 2008
(http://www.askoxford.com/concise).
[42] Parry-Davis, D. (2006), The Enviropaedia, Be the Change Edition 2006 2008.
Simonstown, South Africa (Eco-Logic).
[43] Percy, J.P. (1997), Auditing and Corporate Governance a Look Forward into the 21st
Century. International Journal of Auditing Volume 1, Issue 1, Mar 1997: 3 12.
[44] Pleon Kohtes Klewes GmbH (2005), Accounting for Good: the Global Stakeholder
Report 2005 the Second World-wide Survey on Stakeholder Attitudes to CSR
Reporting. Bonn, Germany (Pleon).

15

International Conference on Environment 2008 (ICENV 2008)

[45] Porter, B., Simon, J. & Hatherly, D. (2003), Principles of External Auditing (2nd
Edition).
[46] Reuvid, J. (2007), Managing Business Risk A practical guide to protecting your
business (4th Edition). London, UK (Kogan Page).
[47] Sawyer, L.B., Dittenhofer, M.A. & Scheiner, J.H. (2003), Sawyers Internal Auditing
The Practice of Modern Internal Auditing (5th Edition).
[48] South Africa (2005), Auditing Profession Act, No. 26 of 2005.
[49] South Africa (1973), Companies Act, No. 61 of 1973.
[50] South Africa (1999), Public Finance and Management Act, No. 1 of 1999 (PFMA).
[51] South Africa (2004), Public Audit Act, No. 25 of 2004 (PAA).
[52] Taylor, I.R., Kritzinger, L. & Puttick, G. (1983), The Principles and Practice of
Auditing (5th Edition)
[53] UNCTAD United Nations Conference on Trade and Development (1997),
Environmental Accounting and Reporting at the Corporate Level. A report by the
UNCTAD Secretariat to the Intergovernmental Working Group of Experts on
International Standards of Accounting and Reporting, Geneva, on 11th 13th February
1998.
[54] Utting, P. (2005), Beyond Social Auditing: Micro and Macro Perspectives.
Presentation at the EU Conference on Responsible Sources: Improving Global Supply
Chains Management, Brussels, 18th November 2005.
[55] Waddock, S.A. & Graves, S.B. (1997), The Corporate Social Performance Link.
Strategic Management Journal, Vol. 18, No. 4, April 1997: 303 319.
[56] Zenisek, T.J. (1979), Corporate Social Responsibility: A Conceptualization Based on
Organisational Literature. The Academy of Management Review, Vol. 4, No. 3, July
1979: 359 368.

16