Audit committee oversight now reaches beyond the financial statements. The committee still answers for the integrity of financial reporting, internal controls and the relationship with the external auditor. Wherever sustainability and climate disclosures are made, those same disciplines apply to them: who owns the data, how it is controlled, who checks it, and what the committee is told. This guide explains what that oversight covers, how to divide it between the board, committees and management, and what members should be able to ask.
TL;DR
- The audit committee's ESG role centers on disclosure integrity, internal controls over sustainability reporting and oversight of any assurance engagement. Management keeps ownership of strategy and policy.
- IFRS S1 and S2 require an entity to name the body responsible for sustainability oversight and to explain how that body secures the skills it needs.
- Many boards delegate to the audit committee because of its control and assurance experience, then add a dedicated sustainability committee as the company matures.
- Competence is the limiting factor: members, internal audit and the reporting team all need working knowledge of the standards.
Table of Contents
- What audit committee oversight means once ESG is on the agenda
- Why the audit committee often takes the role
- What the standards now require you to disclose
- How the committee actually does the work
- Questions every member should be able to ask
- Competence: the part committees underestimate
- Where training fits
- Our perspective
- Common questions
- Sources
What audit committee oversight means once ESG is on the agenda
Traditionally, audit committee oversight rests on three functions: financial reporting, auditing and internal control. Academic work on audit committees aside, the practical shift is simple. Sustainability information now travels through the same pipeline as financial information: it is collected, aggregated, reviewed, published and, increasingly, assured.
The committee's ESG responsibility is usually framed around three things. According to one US issuer's committee charter materials filed with the SEC, the primary focus is the integrity of disclosures, the adequacy of internal controls over sustainability reporting and oversight of any ESG-related assurance engagements. Management retains responsibility for executing ESG risk strategy and writing the policies behind it. The same document describes an annual review with senior management of the type and presentation of key ESG disclosures and of how well the controls work.
That division matters. A committee that starts setting the decarbonization strategy has crossed into management's job. A committee that only receives the finished sustainability report has not done its own.
Why the audit committee often takes the role
The Institute of Internal Auditors argues that the audit committee is often the most suitable body to receive delegated sustainability oversight, not because it is an ESG expert but because it is the governing body most practiced in internal control, rigorous reporting and independent assurance. The IIA also notes that audit committees tend to fold ESG and climate risk into the existing enterprise risk management framework rather than building a parallel structure.
That is a sound instinct. A parallel structure creates two risk registers, two data owners and two sets of definitions. One structure, with ESG risks sitting beside credit, cyber and operational risks, lets the committee compare and challenge them on the same terms.
When a separate sustainability committee makes sense
COSO practitioners observe that as organizations mature they often set up a dedicated sustainability committee for non-financial risk, while the audit committee keeps its authority over the integrity of the resulting reports and the control environment behind them. COSO also states that the board is responsible for overseeing, and where appropriate challenging, management's approach to ESG risk ownership and for confirming a program exists to identify, assess, manage and monitor those risks.
A public example of the split: one US company's proxy statement says its board has designated the audit committee and a separate ESG and nominating committee with certain risk oversight responsibilities. The pattern is common. Strategy and stakeholder questions go to one committee, reporting integrity and assurance go to the other.
| Topic | Typical owner | Why |
|---|---|---|
| Sustainability strategy and targets | Full board or sustainability committee | Strategic and long-term |
| Execution, policies, data collection | Management | First and second line responsibilities |
| Disclosure integrity and controls | Audit committee | Same discipline as financial reporting |
| Assurance engagement oversight | Audit committee | Existing auditor relationship |
| Climate risk in the enterprise risk register | Board, with audit or risk committee review | Integrated with ERM |
The IIA's guidance on the Three Lines Model makes the same point in its paper on embedding ESG into that model: governance mechanisms should explicitly include sustainability and ESG considerations, along with the reporting strategy and stakeholder engagement.
For the structural choices in more depth, see our piece on an ESG governance structure that works for boards and reporting teams.
What the standards now require you to disclose
Oversight is no longer only an internal matter. Under IFRS S1 and S2, an entity must disclose its governance processes for monitoring and managing sustainability and climate-related risks. That includes identifying the body responsible, such as an audit committee, and describing how it ensures it has the appropriate skills and competencies. Disclosures also cover how oversight is reflected in mandates or terms of reference, how often the body is informed, and how sustainability risks are integrated into strategy and target setting.
In the United States, the SEC's 2024 climate rule would have required disclosure about any board oversight of climate-related risks and any management role in assessing and managing material climate risks. The rule's legal and regulatory status has been contested, so confirm its current position with counsel before relying on it. Even so, many US companies also report under global frameworks or to non-US regimes, and the governance disclosure questions are broadly the same. A committee that can answer them cleanly is ready whichever regime applies.
A practical test: read your committee charter and ask whether an investor could learn from it which body oversees sustainability reporting, how often it meets on the subject and what expertise it draws on. If not, the charter needs work before the disclosure does.
How the committee actually does the work
1. Set the scope in the charter
Say in writing which sustainability matters the committee covers: disclosure review, controls, assurance, and perhaps climate risk within ERM. Say which belong elsewhere. Ambiguity is where gaps appear.
2. Review disclosures like financial statements
The committee does not need to recompute emissions. It needs to see how management reached its numbers: boundaries, estimates, emission factors, data sources, and what changed since last year. Ask for a reconciliation of anything that moved materially and a clear list of judgments.
3. Test the control environment
Internal control over sustainability reporting is the least mature part of most programs. Questions worth asking:
- Who owns each metric, and who reviews it independently of the owner?
- Which data comes from spreadsheets, and which from controlled systems?
- How are third-party and value chain data validated?
- What is the process for correcting a published figure?
Our guides on ESG data quality and audit readiness under ISSA 5000 and ESG data governance over 12 months go into the control design in detail.
4. Oversee assurance
The committee should decide the level of assurance sought, limited or reasonable, and for which disclosures, and should approve the provider much as it approves the financial auditor. The IAASB has published staff answers on implementing ISSA 5000, covering topics such as determining group and value chain components and using the work of another practitioner. Those are the topics a committee will hear from its assurance provider, so members should recognize them.
5. Use the external auditor's signals
The PCAOB has observed that ESG-related critical audit matters can reveal management's assumptions and climate scenarios that are not apparent in the financial statements alone, prompting committees to take a fresh look at disclosure quality. The auditor is also obliged to communicate certain matters to the committee. Treat that channel as a source of information about climate-related judgments.
The PCAOB's 2021 outreach found the topic was already on agendas: among chairs who discussed non-financial information with their auditors, 70% named ESG matters as a key area. That survey is several years old, but it shows how early the shift began.
6. Make internal audit a real second set of eyes
Internal audit can test sustainability controls, check data consistency between financial and non-financial reports and report independently to the committee. For a three-step plan that maps COSO to an audit plan, see ESG internal audit in three moves.
Questions every member should be able to ask
| Area | Question |
|---|---|
| Scope | Which sustainability disclosures does this committee review, and which go elsewhere? |
| Materiality | How did management decide which topics and metrics are material? |
| Data | Which figures rely on estimates, and how sensitive are they? |
| Controls | Where is the weakest control in the sustainability data chain? |
| Assurance | What level of assurance applies this year, and what is the plan to move up? |
| Climate | Do the transition plan assumptions match those in the financial statements? |
| Consistency | Do the sustainability report and the annual report tell the same story? |
The last two questions deserve emphasis. Inconsistency between climate narrative and financial assumptions is the kind of finding that erodes credibility fastest. Our summary of what CFOs and auditors check on ESRS E1 transition plans and of IFRS S2 for CFOs shows what reviewers look for.
Competence: the part committees underestimate
The disclosure requirement about skills is deliberate. Oversight without understanding becomes ceremony. The IIA says a committee member's role includes ensuring the internal audit function is independent, objective, competent and future-ready, and it urges committees to demand competency in emerging risks such as climate impact and ethical AI.
Three groups need to build capability:
- Committee members. They need fluency in the standards' governance, strategy, risk and metrics structure, not technical depth in every metric.
- Internal audit. Auditors need to understand emissions accounting, assurance standards and how to test non-financial controls. Our list of five skills every ESG auditor needs is a good starting checklist.
- The reporting team. Finance and sustainability staff must share definitions and a control mindset.
Competence also covers adjacent risks that land on the same committee. Cyber is the obvious one, and a practical guide to training staff on cybersecurity shows the same principle: oversight works when the people closest to the risk are trained, not just instructed.
Where training fits
We built our programs for exactly these roles. Assurance practitioners and internal auditors can work through the Certificate in Climate, Sustainability and ESG Assurance at $199, the Professional Certificate at $299, or the Certified Sustainability Assurance Professional (CSAP) at $499, all one-off fees. Finance teams preparing the disclosures can take the Certificate in Sustainability Reporting at $149, the Professional Certificate at $249, or the Certified Sustainability Reporting Professional (CSRP) at $399. For directors, the short ESG Governance for Boards module is $49, and the All-Access CPD Pass is $599 per year.
Our courses are mapped to ISSB, ESRS, GRI and ISSA 5000, and assessments are server-validated with real pass thresholds. Browse the full certification catalog or the CPD modules and All-Access Pass.
Our perspective
We see the same pattern repeatedly: committees adopt ESG oversight in the charter first and in practice much later. The gap is rarely willingness. It is that nobody in the room can say with confidence whether a Scope 1 figure is well controlled, or what limited assurance does and does not cover.
Our view is that audit committees should treat sustainability reporting as a control problem before they treat it as a content problem. Get ownership, evidence and review right, and the disclosures improve almost automatically. Then invest in people: a committee chair who understands the assurance standard asks sharper questions than any template can supply, and an internal audit team with a credential in sustainability assurance can give the committee independent comfort rather than a second-hand summary.
We also encourage a deliberate path rather than a one-off workshop: foundation knowledge for members, professional-level skills for the teams doing the work, and a credential where independent verification of competence matters to investors or regulators.
— Ransford
Common questions
What is the role of an audit committee in corporate governance?
The audit committee oversees financial reporting, internal controls, the external audit and the internal audit function on behalf of the board and shareholders. Where a company issues sustainability or climate disclosures, many boards extend that remit to cover disclosure integrity, controls and assurance for those reports too.
Should ESG oversight sit with the audit committee or a separate committee?
Both models exist. The audit committee suits reporting integrity and assurance, while a dedicated sustainability committee often handles strategy and stakeholder issues as the company matures. Whichever you choose, the charter should say clearly who covers what, because IFRS S1 requires you to name the responsible body.
Does the audit committee need an ESG expert?
Not necessarily a single expert, but the committee must have the skills to challenge what it receives. IFRS S1 asks entities to describe how the responsible body ensures it has appropriate skills and competencies, so training and access to specialist advice are part of the answer.
How often should the committee review sustainability disclosures?
At least annually, before publication, with interim updates on controls and assurance progress. The charter material cited above describes an annual review of key disclosures and control effectiveness as typical.
Sources
- IFRS S1 General Requirements for Disclosure of Sustainability-related Financial Information
- PCAOB: 2021 Conversations with Audit Committee Chairs
- PCAOB: Revealing ESG in Critical Audit Matters
- IIA: Internal Audit's Role in ESG Reporting
- IIA: Embedding ESG into the Three Lines Model
- IIA: Internal Audit Competency, Future-Ready Assurance
- COSO: Enterprise Risk Management and ESG
- SEC filing: audit committee ESG responsibilities
- SEC filing: Kirby Corp proxy statement, March 2022
- SEC final rule on climate-related disclosures, 2024
- IAASB: Answers to key questions on implementing ISSA 5000