Internal and Forensic Audit · Emerging Issues and Challenges

ESG, Sustainability and Non-Financial Audit: Role of Internal Auditor

Updated 11 October 2026 · Fact-checked

ESG internal audit is an independent, risk-based review of how a company manages environmental, social and governance risks and reports them. The internal auditor tests controls over non-financial data, such as emissions or safety figures, checks BRSR disclosures against evidence, and reports gaps to the audit committee. It is assurance on data and controls, not a financial audit.

Understand ESG, Sustainability and Non-Financial Audit

ESG stands for environmental, social and governance. Investors, regulators and customers now judge a company on these matters along with its profit. Examples are energy use, emissions, worker safety, supplier conduct, board practices and ethics.

A non-financial audit reviews information that is not in the financial statements. The data is often operational: litres of water used, accident rates, training hours, number of complaints. This data often sits in plant registers, HR systems and spreadsheets, outside the accounting system. Controls over it are usually weaker than controls over financial data. That is the main reason internal audit is needed.

In India, listed companies report on these matters through the Business Responsibility and Sustainability Report (BRSR), required by SEBI under the listing regulations. It has general disclosures, management and process disclosures, and principle-wise performance disclosures based on nine principles. Some core indicators are subject to reasonable assurance for the companies that SEBI has covered under its BRSR Core framework. Check the latest SEBI circular for the exact applicability and indicator list before you write numbers in an answer.

The internal auditor's role is different from that of the external assurance provider. Internal audit is part of the company. It evaluates ESG risk management, tests the controls that produce ESG data, advises management on gaps, and reports to the audit committee. It can also give a readiness review before the independent assurance provider arrives. It does not replace that provider, and it must stay independent of the management decisions it reviews.

A financial audit gives an opinion on money-based statements using established accounting standards. An ESG audit covers wider subjects, uses many different frameworks, relies on operational data and often uses estimates, such as emission factors. Both need evidence, independence and documentation. The skill is carrying the same audit discipline into less standardised data.

Key rules to remember

Core ESG audit logic: ESG risk → control → data → disclosure → evidence → report; Use this chain to structure any answer. Break at the weakest link and name the control gap.
Three pillars: E (environment) + S (social) + G (governance); Give at least one risk and one test for each pillar when the question is general.
BRSR structure: Section A (general) + Section B (management and process) + Section C (principle-wise, nine principles); Section C has essential and leadership indicators. BRSR Core is a subset of key indicators for assurance.
Assurance levels: Reasonable assurance (positive opinion) > limited assurance (negative-form conclusion); Reasonable needs more testing. State which level applies and do not mix them up.
Three lines model for ESG: Line 1: operations own the data and controls; Line 2: sustainability and risk functions oversee; Line 3: internal audit gives independent assurance; Useful for role-based questions.

How to solve ESG, Sustainability and Non-Financial Audit questions

Use the same frame for any question on ESG, sustainability or BRSR audit. It keeps a case-based answer in the provision, analysis, conclusion order.

1Identify what is asked: role of internal auditor, difference from financial audit, BRSR review, or a case on a specific ESG failure.
2State the relevant concept or provision in one or two lines, such as the BRSR requirement or the meaning of ESG audit.
3List the key risks in the facts: inaccurate data, greenwashing, weak governance, non-compliance, supplier or safety issues.
4Link each risk to a control and an audit test, such as source-record checks, recalculation, site visits, and system access review.
5Say who receives the work: management for action and the audit committee for oversight.
6Conclude with a clear finding or recommendation, and note independence limits, for example that external assurance remains separate.

Quickest way: Risk-Test-Report in three lines

When to use it: When time is short or the question is a short note or a 'state the role' type.

Name the ESG risk in the facts.
Give two audit tests: one on controls, one on data accuracy.
Close with the report to the audit committee and a recommendation.

Common mistakes in ESG, Sustainability and Non-Financial Audit

Treating ESG audit as just another financial audit.
Students carry over the idea of an opinion on the financial statements.
Fix: State that the subject matter is mostly non-financial, based on operational data, and covers frameworks beyond accounting standards.
Saying internal audit gives the independent BRSR assurance.
Both are called assurance, so they get merged.
Fix: Say internal audit supports and reviews readiness. The independent assurance provider gives the formal conclusion on the specified indicators.
Writing only about the environment.
ESG is often thought of as climate and pollution.
Fix: Cover E, S and G each with one risk and one test, such as board diversity or whistleblower mechanism for governance.
Listing risks without controls or tests.
Students write theory and forget the audit step.
Fix: Pair every risk with how you would test it: inspect records, recompute, observe, confirm with third parties.
Quoting BRSR applicability or indicators from memory with wrong detail.
Requirements change and are phased in.
Fix: State only what you are sure of, and refer to the SEBI requirements in force for the specific list or threshold.
Ignoring greenwashing and data reliability.
Students focus on policies, not on the numbers behind them.
Fix: Include a test that reported claims match source data, and flag unsupported claims as a reputational and legal risk.

Worked examples

Example 1

Explain the role of an internal auditor in relation to a listed company's ESG risks and sustainability reporting. (Short answer)

Show the solution

Provision and concept: ESG reporting by listed companies is made through the BRSR, so reliable non-financial data and sound governance over it matter.
Risk assessment: the internal auditor includes ESG risks, such as emissions, safety, supplier conduct and disclosure accuracy, in the risk-based audit plan.
Control testing: the auditor reviews the controls over data collection, such as source records, approvals, system access and reconciliations between plants and head office.
Data testing: the auditor samples reported figures, recalculates them and traces them to evidence.
Advisory role: the auditor suggests improvements to policies, roles and reporting processes without taking management decisions.
Reporting: findings and recommendations go to management and the audit committee, with follow-up on action taken.

Answer: The internal auditor provides independent, risk-based assurance on ESG risk management and on the controls and data behind sustainability reporting, advises on gaps, supports readiness for external assurance, and reports to the audit committee. It does not replace the independent assurance provider.

Example 2

Meridian Steels Ltd, a listed company, reports in its BRSR that its water consumption fell 12% this year. The internal auditor finds that two of its five plants submit figures from estimates, with no meter readings. Advise on the audit approach and conclusion.

Show the solution

Issue: the reported reduction may be unreliable because two plants lack measured data. This is a data-control weakness and a disclosure risk.
Understand the process: obtain how each plant records water use, who reviews the figures and how head office consolidates them.
Test the data: compare the three metered plants to meter logs and bills. For the two estimating plants, ask for the estimation method and test it against production levels and past trends.
Recalculate the consolidated figure and the 12% change, including the base year, to check consistency.
Assess impact: if the two plants are a significant share of water use, the claim cannot be supported with sufficient evidence.
Recommend: install meters at both plants, define a standard method, add independent review at head office, and correct or qualify the disclosure if needed.
Report: communicate to management and the audit committee, and track the implementation.

Answer: The 12% claim is not adequately supported because part of the data is estimated without measurement. The internal auditor should report a control deficiency, recommend metering and a standard consolidation process, advise that the disclosure be corrected or properly qualified, and follow up with the audit committee.

Exam tips

Structure answers as risk, control, test, report. Examiners reward a visible audit approach more than a long definition.
For 'difference between ESG audit and financial audit', give four or five contrasts: subject matter, data source, framework, opinion form and nature of evidence.
In case questions, tie your points to the facts given, such as the plant, the figure or the process mentioned.
Keep BRSR details to what you are certain of. Mention the nine-principle structure and the BRSR Core assurance idea, and avoid unsure thresholds.
Always add a closing line on reporting to the audit committee and follow-up.

Practice questions from Emerging Issues and Challenges

ESG, Sustainability and Non-Financial Audit: frequently asked questions

What is the role of an internal auditor in ESG?

The internal auditor assesses ESG risks, tests the controls over ESG data and reporting, and advises on improvements. It reports findings to management and the audit committee. It supports, but does not replace, independent external assurance.

What is the difference between ESG audit and financial audit?

A financial audit gives an opinion on money-based financial statements under accounting standards. An ESG audit covers environmental, social and governance matters, often uses operational data and varied frameworks, and may involve estimates. Evidence, independence and documentation matter in both.

What is BRSR and why does internal audit care about it?

BRSR is the Business Responsibility and Sustainability Report that SEBI requires listed companies to publish. It contains non-financial disclosures against nine principles. Internal audit cares because the data behind it is often weakly controlled and errors create legal and reputational risk.

Can internal audit give assurance on the BRSR?

Internal audit can review controls and data and give assurance to the board and audit committee. The formal independent assurance on BRSR Core indicators is given by an external assurance provider where SEBI requires it. In an answer, keep the two roles separate.