Internal Controls Over IFRS Sustainability Disclosures: A Practical Framework

A finance-aligned internal-control framework for producing reliable IFRS S1 and IFRS S2 disclosures without pretending that financial and sustainability information are identical.

A sustainability report can look complete while still depending on fragile processes: uncontrolled spreadsheets, ambiguous metric definitions, manually copied supplier data, assumptions that differ from financial planning, management review that leaves no evidence, and disclosures assembled from multiple versions. These weaknesses are not solved by adding a final sign-off. The system must be capable of producing reliable information repeatedly, detecting error or bias and retaining evidence of how judgements were made.

The closest operational analogy is the financial close—not because sustainability information is identical to accounting information, but because the discipline is transferable. Both need a controlled perimeter, a reporting calendar, data ownership, cut-off, consolidation, reconciliations, review, exception management and authorisation. Sustainability reporting adds its own risks: value-chain data, estimates, scientific methodologies, external factors, scenarios, forward-looking information and narrative claims about governance or effectiveness.

Internal control framework aligned to finance

The five COSO components can organise sustainability controls, while the year-end close disciplines of scope, cut-off, consolidation, reconciliation, review and sign-off provide an operational backbone.

COSO’s 2023 publication Achieving Effective Internal Control over Sustainability Reporting applies the five components and 17 principles of the 2013 Internal Control—Integrated Framework to sustainability information. The publication is explicitly non-authoritative and interpretative. It is useful as an organising model, but an entity should tailor control objectives, owners and evidence to its reporting risks, jurisdiction, maturity and assurance scope.

Controls should respond to a clear reporting objective. Without that objective, teams often produce long checklists that prove activity but do not address the risk. For IFRS S1/S2, the control objectives can be organised around the qualities and requirements of the disclosures.

The control environment determines whether individual controls will operate when pressure increases. Sustainability reporting often spans functions that do not report to one owner. The board may oversee the reporting, finance may own publication, sustainability may own methodology, operations may own data and IT may own systems. Without explicit authority and accountability, gaps sit between functions.

Board and committee oversight: define which body oversees sustainability-related financial disclosures, material judgements, significant deficiencies and the final reporting claim.

Executive accountability: appoint a named executive responsible for the reporting system, not only for the final document.

Reporting policy: document the framework, scope, reporting entity, standards hierarchy, terminology, materiality process, use of estimates, evidence expectations and approval route.

Competence: assess whether owners and reviewers have the technical, sector, finance, climate, data and control skills required for their responsibilities.

Integrity and challenge: prohibit unsupported claims, hidden data gaps and silent method changes; create escalation routes that protect reviewers from deadline pressure.

Accountability: include control performance and remediation in role objectives, close certifications and governance reporting.

A data dictionary is the equivalent of a reporting chart of accounts. It prevents one metric name from carrying several meanings across the group and gives controls a stable object to test. The dictionary should cover quantitative and narrative fields. For example, “Board oversight frequency” is a controlled disclosure field just as “Scope 2 location-based emissions” is a controlled metric.

The data dictionary defines what the information means; the evidence register shows what supports the reported fact. A single item can have several evidence types: source data, methodology, calculation, review and governance approval. The register should be claim-based rather than organised only by department or file name.

A small team cannot always separate every task, but it should separate the most consequential decisions. The person who creates or changes a metric should not be the only person who approves the method and final result. Where full segregation is impracticable, use compensating review by someone with appropriate competence and authority.

Reconciliations convert “connected information” from a drafting principle into an operational control. They should not be limited to agreeing totals. The team must reconcile boundaries, definitions, periods, currencies, assumptions and narratives across the sustainability disclosures, financial statements, management reporting and external communications.

Many sustainability disclosures depend on models rather than direct measurement. Examples include Scope 3 emissions, financed emissions, climate scenarios, asset exposure, avoided emissions, workforce estimates and anticipated financial effects. Model governance should be proportionate, but it should address the same core questions: purpose, ownership, inputs, assumptions, logic, validation, change, access and limitations.

Data-to-disclosure control lifecycle

Controls should operate from data definition and collection through transformation, review, disclosure drafting, governance approval, publication and post-close remediation.

Disclosure controls should protect both the numbers and the meaning. A quantitatively correct metric can still be misleading if the boundary, method, uncertainty or comparative change is omitted. A narrative can be technically elegant but unsupported by evidence. The review process should therefore combine data-owner confirmation, framework review, finance consistency review, legal/claims review and governance approval.

Management representations are not a substitute for other evidence, but they can close the accountability loop. The representation process should be specific to the reporting system and signed by people who control the relevant information. It may include confirmation that data populations are complete, methods and changes have been disclosed, known fraud or error has been reported, material subsequent events have been considered and no material evidence has been withheld.

Use representations at multiple levels: data owner, business unit, functional executive and group reporting.

Tie each representation to identified responsibilities and reporting-period controls.

List known exceptions rather than asking owners to sign an unrealistic unconditional statement.

Escalate contradictions between representations and other evidence.

Retain the final representation set with the release and assurance evidence package.

A deficiency process should distinguish an isolated evidence gap from a control design failure or a material reporting risk. Severity should consider the likelihood and magnitude of a potential misstatement or omission, the importance of the affected disclosure, the pervasiveness of the process and whether compensating controls exist. The terminology used for financial-control deficiencies may be adapted, but the organisation should define its own escalation thresholds clearly.

The group first creates a data dictionary and assigns stable metric IDs. It then risk-ranks the metrics and selects key controls over group perimeter, factors, estimates and methodology changes. Finance owns the consolidated reporting calendar; sustainability owns technical methods; operations own source data; and reviewers are separate from preparers. Quarterly dry runs identify that one region uses a different safety denominator and that Scope 3 logistics data lag by three months.

Rather than hide the differences, the group defines the approved denominator, restates the comparative where appropriate, documents the lag policy and uncertainty, and creates a remediation plan for more timely supplier data. The final report is supported by reconciliations and owner certifications. The process is not “fully automated”, but it is controlled, repeatable and capable of being assured.

A sustainability data dictionary should give every quantitative and narrative field a stable identifier, definition, reporting basis, unit, boundary, period, method, source, owner, reviewer, estimation status, controls, disclosure location and change history. It prevents one metric name from carrying different meanings and gives controls a stable object to test.

Scope 3 spreadsheets should be governed as models: define their purpose, owner, inputs, assumptions, logic, validation, access, version changes and limitations. Lock calculation logic, retain source and factor evidence, separate preparation from review, reconcile boundaries and totals, and document estimates and exceptions.

Reconcile boundaries, definitions, periods, currencies, assumptions and narratives across sustainability disclosures, financial statements, management reporting and external communications. For GHG and energy, also reconcile facility populations, invoices, activity data, emission factors and totals; retain documented differences, factor changes and finance sign-off.

First distinguish an isolated evidence gap from a control-design failure or material reporting risk, then assess severity using potential misstatement, affected disclosure, pervasiveness and compensating controls. Correct or contain the current issue, analyse root cause, escalate significant matters, remediate the process or system, retest effectiveness and monitor recurrence.

A credible internal-control framework is not measured by the number of controls. It is measured by whether the system prevents or detects material reporting failures, preserves evidence and enables timely correction. Use finance discipline where it fits, add sustainability-specific controls where it does not, and organise everything around the information that IFRS S1/S2 users are meant to receive.