How to Prepare for the CSRD Audit?

The CSRD directive marks a revolution in sustainability reporting, significantly expanding requirements for companies. Between double materiality, transition plans, and digital taxonomy, this initial exercise raises as many questions as it creates opportunities. How can you prepare effectively? What key points should you monitor to ensure a successful audit? Through insights from audit experts and findings from a study of companies, discover the issues, challenges, and best practices for navigating this new era of ESG reporting.

Matthieu Duault
Climate Copywriter
Publication : 
03.01.2025
Table of Contents
Example H2
Request a demo

At the Produrable trade show, we hosted a roundtable with future CSRD auditors. Lawyers and statutory auditors shared their perspectives on the CSRD, outlined their areas of focus, and described how audits for this new exercise should be conducted.

The CSRD audit is a top priority for companies, especially for this first cycle, which has left many uncertain about what is expected under this new European sustainability reporting framework. 

According to a study conducted by Tennaxia in June 2024 among 208 companies soon to be subject to the CSRD, one-third still had doubts regarding the audit arrangements for their CSRD report, not fully grasping what would be audited or what would be expected of auditors. At that time, half of the respondents indicated they would work on this with the statutory auditor who already handles their financial reports. This is a logical, convenient solution, as these auditors already have a strong understanding of the company, its operations, and its structure.

But is this the view of the auditors themselves? In their opinion, what are the best processes to adopt for a successful audit? And what are the main points of vigilance to consider during the CSRD audit?

Who can audit CSRD reports?

In France, CSRD reports must be audited by statutory auditors or Independent Third-Party Bodies (OTIs). 

To obtain sustainability auditor status, these professionals must complete mandatory 90-hour training focused on sustainability issues and ESG criteria, provided by an accredited training body.

The High Authority for Auditing (H2A) is responsible for overseeing these professionals' engagements and managing any potential sanctions in the event of a breach. A list of accredited sustainability auditors is available on the H2A website.

From the DPEF to the CSRD: A change in scale

France's long-standing non-financial reporting format has been significantly expanded by the requirements introduced by the CSRD.

Not only is the number of topics covered and data points involved much larger, but the CSRD also introduces new elements that enrich the analysis required for producing a non-financial report:

  • The double materiality analysis, including the assessment of material IROs (Impacts, Risks and Opportunities) for each ESRS (European Sustainability Reporting Standards),
  • Taking into account the company's stakeholders and their expectations,
  • Taking into account information from the European Union's green taxonomy and its link with the information required by the ESRS,
  • Implementing a tagging system enabling machine-readable data (iXBRL format),
  • Determining an acceptable margin of error for each indicator processed.

These new elements profoundly change the auditor's work. Under the DPEF, the audit produced a reasoned opinion on the compliance and fairness of the information, along with an attestation from the statutory auditor confirming the report's presence. For the CSRD, the auditor will need to analyse each of the processes that led to the report being compiled and to the correct choice of data processed by the company.

Another major change: while the DPEF focused mainly on the company's historical information, the CSRD also looks at forward-looking information. The introduction of transition plans is a telling example. Auditing these plans and attesting to their credibility is therefore an exercise auditors are not used to.

Finally, the DPEF stopped at the boundaries of the group's consolidated accounts, whereas the CSRD incorporates stakeholders affected by the company's impacts. The scope of analysis is therefore considerably widened, and it will be up to the company – as well as the auditor – to determine which link in the value chain (suppliers, subcontractors, clients, users, etc.) is relevant to include in the sustainability report.

In these first exercises, the auditor is therefore likely to spend considerable time examining the processes put in place by the company to produce its CSRD report, more so than the data collected and the information disclosed.

What is the company's scope of study? How did it carry out its double materiality analysis to determine the ESRS relevant to its activity? Are they consistent with those of similar companies? How were the key issues determined by activity and by company site? Were the IROs correctly analysed, and how?

Auditors themselves acknowledge that, given the complexity of the CSRD and the various ESRS that make up this sustainability reporting standard, their stance should be, for this first exercise, that of a supportive auditor, with a reduced level of stringency and a progressive view of the sustainability report.

The CSRD directive also specifies that the information disclosed in reports will be checked based on a limited assurance engagement until 2028, at which point the audit engagement should move to a reasonable assurance level.

A radical cultural shift in the documentation expected

The CSRD will require every piece of information disclosed in the sustainability report to be justified. This essential point should make it easier for auditors to carry out checks and allow them to ensure companies' transparency and fairness. 

For companies previously subject to the DPEF, the process of documenting each piece of information with supporting evidence is already well established. But the CSRD will ultimately apply to a much larger number of companies, which will need to incorporate this concept of evidentiary documentation.

This methodology applies to the various data points but also, as a new element, to the double materiality analysis. Determining material issues cannot be based solely on expert judgement; the inclusion or exclusion of data points must be justified and documented. 

The CSRD is indeed intended to make ESG reporting more observable and objective. It is therefore necessary to enrich the report with scientific analysis, data, or a concrete explanation of the assumptions behind certain decisions. These documents must make it possible to explain the methods applied, the approaches followed, and, ultimately, to justify any discrepancies observed.

The auditor will indeed need to ensure that the reporting achieves its objectives, i.e. conveying information that is clear, accurate, objective, usable and comparable. The CSRD report must therefore be a “dry” report; it is not there to tell nice stories, a bias that could sometimes be found in DPEF reports. Narratives will need to be highly descriptive and factual, based on observable, auditable data, leading to a specific action within a precise scope. This is an essential element for ensuring the comparability of the different reports. One point required by the CSRD, which will not be tolerated by the auditor, is communicating on non-material topics, as this risks diluting material information for future readers.

This comparability of data is an essential element – comparability from one reporting cycle to the next and from one company to another. Consistency of information is a key objective of this legislation, whose purpose, as a reminder, is to strengthen corporate transparency on ESG information. Auditors will therefore need to ensure the comparability of the information provided. However, EFRAG's iXBRL taxonomy, which is meant to tag data points and thereby facilitate their harmonisation, readability and digital processing, has not yet been finalised. The process will therefore likely be iterative and will be refined over the years. 

Finally, beyond this radical change in documentation, there will likely be a significant cultural shift in how companies are organised. Given what is expected of this report, particularly regarding the financial dimension of IROs and the transition plan, we are seeing leadership being shared between the ESG department and the finance department, which is now much more involved in decision-making. This organisational change can nonetheless make auditors' work easier, since finance directors are already used to providing, as part of the financial audit, supporting evidence for every piece of data disclosed and every decision made.

Auditing the transition plan: a new challenge

As mentioned earlier, one of the major differences between the CSRD and the DPEF is the shift from an analysis based solely on historical information to one also based on forward-looking information.

The most telling example is the introduction of the transition plan required from companies under ESRS E1, dedicated to climate change.

According to the study carried out by Tennaxia, this ESRS is considered material by 98% of the companies surveyed. A result that is relatively unsurprising, considering two things:

  • It is difficult to justify denying that one's activities have an impact on the climate. Any economic activity inevitably generates greenhouse gas emissions across all three scopes.
  • This ESRS receives specific treatment. It is the only one for which a company must provide a formal justification if it deems the topic immaterial (and we wish them the best of luck with that).

After measuring their carbon footprint and conducting their IRO analysis, companies will need to provide all information regarding their transition plan. This includes the targets set, the implementation timeline, the actions taken, and the associated budget. Yet, according to the study conducted by Tennaxia at the time, 48% of companies indicated they still had doubts about implementing climate transition plans. Once again, this figure is logical, given that this is a new exercise for many companies now affected by the CSRD in the short or medium term, and one governed by a strict methodology.

These concerns seem to center on two main points, which will also be scrutinized by auditors:

  • Visualizing and assessing the impact of the action plan in terms of GHG emissions and financial investment. This involves defining an action plan, estimating the impact, and calculating the associated costs in terms of CapEx, OpEx, and even the savings linked to this transition.
  • The comparability of data from one reporting cycle to the next. Measuring a carbon footprint in year N is relatively simple, but a company is not a static entity—it changes (ERP system updates, factory openings or closures, changes to emission factors for certain values, etc.). Added to this is its structural complexity: different sites, different contacts, etc. All of this means that tracking the evolution of a carbon footprint becomes a genuine balancing act from year N+1 onwards. 

Auditing the transition plan effectively renders the traditional Excel file, still often used to measure carbon footprints, obsolete. Using a dedicated tool that enables data modeling and traceability is set to become a must-have. 

Auditors will scrutinize these action plans and, to ensure their integrity, will need a clear view of the associated targets and financial estimates. They will inevitably ask about the calculation methods applied, the assumptions made, and the extrapolations carried out. They must be able to trace all data back from the impact chart presented to them. Relying on CSRD software will therefore become essential, but it will also be necessary to ensure it demonstrates the greatest possible transparency.

Many are also tempted to rely on artificial intelligence tools. In this case, it is essential to use them with caution. In many instances, AI is a black box that does not allow for proper tracing of source data or the processing methods used to build the transition plan.

Summary of key areas for vigilance

To summarize, the key areas for companies to focus on to ensure their audit runs smoothly are as follows:

  • Providing supporting evidence for every piece of information disclosed
  • Demonstrating the utmost transparency
  • Maintain objectivity in your analyses
  • Disclose the methodologies applied, the assumptions made, and the calculation methods used
  • Ensure data comparability
  • Equip yourself with tools that allow for data traceability

 

Justify, prove, trace.
These 3 verbs should be your motto when compiling your sustainability report.

 

As the complexity of the ESRS can be a hurdle, some organisations have undertaken simplification work to help companies and auditors identify the main expectations of the CSRD report. These documents include:

Finally, even though auditors have undergone mandatory training before being authorised to audit CSRD reports, this is their first time auditing these reports, which promise to be particularly dense and are subject to a strictly framed drafting process. It is therefore likely that their level of stringency will not be at its peak in the first year. That said, don't hesitate to discuss your methodologies with them in advance, whether for the double materiality analysis, IRO validation, etc. This is the best way to ensure you are on the right track and avoid having to redo the whole exercise from scratch.