Who Owns ESG Today? Second Line Evolution and the Integrated Reporting Imperative

Who Owns ESG Today? Second Line Evolution and the Integrated Reporting Imperative

Who owns environmental, social, and governance (ESG) in your organization? Who should own it? What does “good” ESG governance and strategy look like, and how are companies integrating it with existing risk and compliance governance structures? 

As stakeholder interest in ESG continues to rise and disclosure requirements are written into law worldwide, forward-looking companies are working to answer these questions and others. They feel an increasing urgency to get in place the people, processes, controls, and technologies needed to support reliable, up-to-date, accessible, and auditable ESG reporting. But most ESG programs are still in their nascent stages: In KPMG’s 2023 Chief Ethics & Compliance Officer Survey, 48% of CCOs surveyed had not yet implemented sustainability/ESG compliance programs — with 44% still in the planning/development stages

Every company wants to know how other companies are handling ESG. Since ESG risk and responsibility span the organization, companies must find ways to improve collaboration and centralize governance. Many have responded by creating an ESG Program Manager and/or ESG Controller role, raising a compelling question: Is ESG creating a new “second line of defense” function, adding a fresh layer to the Institute of Internal Auditors’ (IIA’s) Three Lines Model? How does the role fit with ESG’s cross-functional context? And what past lessons and emerging best practices can companies draw upon to engender the collaboration, alignment, accountability, and visibility needed to build and run effective ESG programs? 

Read on as we explore emerging ESG roles and responsibilities and foundational guidance and best practices for ESG program management.

Big Picture: Sustainability Is a Team Sport

Nobody “owns” ESG today, since responsibility for ESG spans the entire enterprise and no individual can make ESG happen on their own. While a leader can set a vision and strategy, only a cross-functional team can deliver it. The necessary distribution of responsibilities means there is no one-size-fits-all approach to ESG program management. Further, given the cross-functional nature of ESG program management, contributors from different areas of the business — all with their own domain experience — are now required to collaborate more than ever. While the breakdown of roles and responsibilities will vary based on resource availability, industry-specific requirements, and the materiality of different ESG factors, the table below echoes common practices we see. 

2023 ESG Maturity Benchmarking Report

ESG Program Management — Emerging Roles and Responsibilities

ESG Governance and Oversight

ESG Reporting and Communications

  • ESG Controller: Owns data verification and integrated reporting of financial and nonfinancial information as mandated by ESG disclosure requirements. 
  • Legal or General Counsel: Advises on understanding/mitigating ESG risks (e.g., compliance, reputational damage, fair labor, “greenwashing”), developing policies on ethical business practices, and setting goals. 
  • ESG Program Manager: Gathers key metric data, leads internal reporting and framework reporting efforts, and contributes to annual sustainability reporting. 
  • Marketing or Branding: Owns ESG press releases, report design and publication, and marketing efforts around ESG reporting, commitments, goals, and progress. 
  • Investor Relations: Owns ESG communications with existing and potential investors. Also helps assess materiality.

ESG Assurance

ESG Performance

ESG Risk Management

  • Risk Management: Ensures that ESG is integral to and aligned with overall risk management. Identifies, assesses, and monitors ESG risk, including materiality and priority. Helps to build an ESG-aware culture.
  • Corporate Compliance and Ethics: Owns governance/oversight of ESG policies and procedures, mapping to frameworks, risk monitoring/mitigation, regulatory compliance, monitoring stakeholder expectations, etc.

ESG Program Management

  • ESG Program Manager; Owns ESG data collection/verification, stakeholder engagement, framework mapping, and report writing. Creates policies, processes, and tools and manages issues. Helps shape ESG initiatives and strategy, advise on risks/issues, and train others.
  • Sustainability or ESG (if present); Leads strategy development, coordinates execution and communication, and ensures visibility/prioritization of ESG at C-Suite level. Makes recommendations to C-Suite and board and acts as SMEs in developing impactful strategies.

This breakdown isn’t exhaustive — just consider all the other groups responsible for implementing ESG (e.g., HR’s employee well-being efforts, IT’s green data center practices). It’s nonetheless easy to see the need for centralized coordination and governance to ensure:

  • Collaboration. Are the different groups connected, communicating, and relying on the same data? 
  • Visibility. Do different groups have ready access to the data needed for their roles? Are insights and issues being communicated up, down, and across the organization?
  • Alignment. Are efforts aligned with overall strategy? Are we duplicating efforts?
  • Accountability. Are mitigation activities planned and implemented? Are individuals held accountable for fulfilling responsibilities and delivering on commitments?

More Background: Revisiting the “Second Line” 

These challenges are not new. As new risks and market pressures emerge and transform, organizations must develop the roles and frameworks needed to respond effectively. The “Three Lines of Defense” model introduced by The IIA 20+ years ago was one such response. According to KPMG, The IIA’s guide for dividing risk management roles and responsibilities “evolved after the 1990s (1995 to 2001) when the dot.com demise exposed the sheer breadth and depth of the risk landscape.” 

The IIA updated the model in 2020, citing the reality that organizations are “operating in an increasingly uncertain, complex, interconnected, and volatile world” with “multiple stakeholders with diverse, changeable, and sometimes competing interests” — exactly the situation with ESG. The updated model has a simpler name, increased focus on governance, reduced emphasis on rigid lines/roles, and explicit encouragement of greater collaboration and communication across lines (see below). 

Source: The IIA’s Three Lines Model

The IIA’s model stresses the importance of delineating the roles of a governing body, management — which includes both the first and second lines — and an independent, objective third-line advisory and assurance function (in this case, internal audit). The guidance stipulates that second-line roles can focus on specific risk management objectives (e.g., compliance with laws/regulations, internal controls, IT security, quality assurance) or broader responsibilities like enterprise risk management (ERM). To that end, traditional second-line roles include SOX and other compliance functions, ERM, IT risk management, and legal, roles responsible for developing and maintaining the policies, frameworks, techniques, and tools organizations use to identify, measure, report, and monitor risk, helping to ensure consistency in how risk is defined and measured. These roles also provide appropriate oversight of, and additional assurance on, management’s activities in implementing risk management. 

The Evolving ESG Program Manager and ESG Controller Roles: A New Second Line?

The job functions of the ESG Program Manager and ESG Controller are quickly developing into discrete buckets of work, and appear to align with how The IIA describes the second line. Though job descriptions evolve and mature daily, core responsibilities for the two roles include: 

ESG Program Manager: Emphasis on ESG data collection and aggregation 

  • Developing and maintaining the processes and tools required to collect ESG data and ensure that reporting aligns with standards and meets applicable requirements. Eventually, this will include ensuring that ESG reporting passes audits.  
  • Managing and monitoring issues and ensuring follow-up.
  • Providing management with relevant insight and trends on ESG topics.
  • Training others in the organization on ESG processes, risks, and considerations. 

ESG Controller: Emphasis on governance and data verification, and regulatory compliance

  • Developing ESG measurement policies to ensure data accuracy and consistency.
  • Bringing both a financial reporting perspective and an operational perspective of the organization to non-financial disclosures.
  • Standardizing and controlling comprehensive ESG reporting in adherence to international standards, frameworks, and upcoming regulatory requirements.
  • Owns integrated reporting of financial and nonfinancial information as mandated by ESG disclosure requirements.

Many people performing these roles have different titles and “official” functions, even as ESG program management and controllership has become integral to their work. In our experience, ESG Program Managers often have backgrounds in internal audit, risk, rating agencies, academia, or sustainability, and ESG Controllers may have a background that combines  financial oversight, deep understanding of ESG metrics, and experience with both the operational and financial aspects of reporting efforts. As ESG regulations take shape and companies assess their short- and long-term needs and priorities, we expect that the ESG Program Manager and the ESG Controller roles — as well as the professionals in it — will continue to evolve. 

AuditBoard is creating a video series to explore who ESG Program Managers and Controllers are and what makes them successful. Are you an ESG Program Manager or Controller with a story to tell? We want to hear from you! Please email us at esg-marketing@auditboard.com.

ESG Program Management 101: Lessons Learned From SOX

We don’t have to look back far for a relevant precedent: the Sarbanes-Oxley Act of 2002 (SOX), which created the second-line function of SOX Compliance Managers. From what we’ve seen, ESG Program Managers are looking more and more like SOX teams. 

As John wrote in his 2022 AuditBoard blog, “What Integrated ESG Reporting Can Learn From SOX,” there are notable parallels between the SOX compliance work companies have been doing for 20+ years and the ESG compliance work they’re anticipating. Both efforts are designed to improve the accuracy, transparency, and completeness of reporting in their respective areas, and both will ultimately require similar levels of assurance. Many feel that COSO’s new “internal controls over sustainability reporting” are essentially SOX controls over non-financial data. 

Companies have a key opportunity to use lessons learned from SOX to inform their approach to ESG, from framework selection and identification of relevant controls to understanding technology’s capacity to enable process and the urgent need to integrate with overall risk management. We can also view the evolution of the SOX team’s role as a foil for understanding the ESG Program Manager role, because decades on, many companies are still struggling to effectively transfer ownership for SOX compliance, risk mitigation, and controls out to the first-line process owners. 

ESG program management is still in its infancy. Most companies are years away from being able to transfer ownership in this way. But — armed with lessons learned from SOX — companies building their programs have the opportunity now to deliberately embed ESG compliance and ownership throughout the organization, positioning ESG Program Managers to more effectively perform their critical second-line responsibilities. 

Foundational Lessons in ESG Program Management

As we’ve illustrated, an ESG Program Manager is only one part of a still-developing puzzle. Effective ESG program management involves not only connecting data and controls, but connecting leaders across the organization. Emerging guidance and best practices suggest that organizations:

  • Set and track commitments. Getting serious about ESG means setting goals, tracking progress, and documenting commitments and achievements. 
  • Focus and prioritize. You don’t need to do everything at once. Chief Sustainability Officers (CSOs) have suggested selecting one area of your business where ESG is more mature, having an auditor perform a limited assurance engagement around only that area, and using those findings to improve other areas.
  • Embed ESG in overall risk management. Requirements will involve documenting physical and transition risks and opportunities — part and parcel to ERM. Get scenario analysis in place to show regulators you’re identifying, assessing, and mitigating the right risks. In a 2022 KPMG survey, more than 80% of companies that embedded ESG into their enterprise-wide business strategy considered their ESG programs successful. 
  • Use a common framework and strategy. Rather than reverse-engineer a piecemeal approach, design a framework upfront to bring together the processes and controls needed to comply with ESG requirements across jurisdictions. Consider leveraging existing frameworks (e.g., COSO) and teams (e.g., SOX) to address ESG needs. 
  • Invest in enabling cross-functional collaboration. Technology is critical for gaining visibility, accountability, collaboration, and alignment. A connected risk platform like AuditBoard promotes improved visibility, clear alignment, transparency and agility for identifying gaps and issues, integration with overall risk management, and more.
  • Identify a cross-functional ESG leader to own the program. If this person does their job effectively (and empowers their first-line counterparts to own ESG), they will ultimately work themselves out of a job. But having a CSO or similar role is often critical for launching a program, defining how ESG is addressed and integrated, and ensuring accountability for implementation. 
  • Prepare to be audited. Internal audit should be the canary in the coal mine, performing readiness assessments and ESG report audits and establishing baselines for controls — even before limited assurance requirements come into play. 

ESG’s Risks and Opportunities Demand Evolution

As stakeholder interest in ESG continues to rise, pressure grows for businesses to address it effectively. Forward-looking leaders understand ESG’s critical connection with long-term value creation and business success. They are making it central to business strategy, which includes taking a proactive approach to getting ESG program management right — and evolving first-, second-, and third-line roles and responsibilities across the organization to meet ESG’s integrated reporting imperative

ESG demands evolution, and we will do well to remember the many lessons learned from SOX. Companies moved fairly quickly from viewing SOX as a burden to appreciating the valuable insight it provides into the organization’s financial risk exposure. Ultimately, despite inevitable bumps and bruises along the way, we expect ESG to follow a similar trajectory. Start today by looking at how your organization is dividing roles and responsibilities to address ESG, ensuring that you are respecting the “three lines” necessary for protecting and creating value. 

John

John A. Wheeler is the founder and CEO of Wheelhouse Advisors, and former Senior Advisor, Risk and Technology for AuditBoard. He is a former Gartner analyst and senior risk management executive with companies including Truist Financial (formerly SunTrust), Turner Broadcasting, Emory Healthcare, EY, and Accenture. Connect with John on LinkedIn.

Judson

Judson Aiken is a Senior Director of Risk and ESG Solutions driving strategic growth across AuditBoard’s enterprise risk management and ESG customer base, with an emphasis on product development. Prior to AuditBoard, Judson was at EY in their Risk Advisory practice supporting enterprise risk management, SOX, and internal audit. Connect with Judson on LinkedIn.

Claire

Claire Feeney is a Senior Product Marketing Manager at AuditBoard focused on ESG and RiskOversight. In her role, she helps support organizations in transforming their enterprise risk management and sustainability programs. Prior to joining AuditBoard, Claire worked in product marketing at OneTrust, VMware, and Infor. Connect with Claire on LinkedIn.