Greenwashing: Mitigating the risk of deceptive environmental claims

How to spot greenwashing

As internal auditors become more involved in the assurance and governance process over ESG compliance risk and reputational risk stemming from greenwashing, we need to understand how this practice could look in the real world. In general, greenwashing is often accomplished by using generic, unsupported claims. In a corporate setting, greenwashing ESG objectives could be subtle and difficult to spot. For example, a large corporation could claim that it will reduce its carbon footprint by 30% over the next two years. Then, the corporation might report that the carbon footprint was reduced by 33% in the corporate headquarters. The commitment was broad, but the results were narrowly defined. The claim is meant to deceive the casual reader. In this scenario, the corporation may have implemented a work-from-home policy that reduced usage of the headquarters and only redistributed the carbon emissions to the homes of the employees.

How to mitigate greenwashing risks

When considering ESG greenwashing as a risk, we can identify potential controls organizations can implement to mitigate that risk. As with other fraud risks, there is no single control to prevent greenwashing from occurring. Instead, businesses should create a controlled environment designed to prevent and detect different aspects of fraudulent claims. The control environment to mitigate the risk of greenwashing could include:

Establishing transparent and measurable sustainability goals.

Objective setting should be done in consultation with relevant stakeholders, such as employees, customers, and suppliers. The strategy should be realistic and aligned with the company's business objectives. EY points out, "Organizations' ESG objectives and credentials need to be visible and measurable so they can be held up to scrutiny and avoid any allegations of greenwashing."

Setting clear criteria for making environmental claims.

The criteria could include defining what the company means by terms such as "sustainable," "green," and "eco-friendly." The criteria should be based on sound science and industry best practices.

Supporting environmental claims with complete and accurate data.

All claims must be backed by complete and accurate data, just like any financial claims a company makes on its financial statements. Supporting claims with data requires planning. For example, a company that sets a goal to reduce the carbon footprint of its products would need to implement a carbon accounting system to track and manage its emissions related to those products.

Obtaining independent verification of claims.

Again, like financial data, claims should be verified by an independent party qualified to assess the data. The third-party reviewer could include a certification body, auditor, or other suitable professional who reviews the company's claims to ensure these are accurate and credible.

Implementing detective processes to identify greenwashing incidents.

Finally, detective controls could be implemented to look for indicators of greenwashing throughout the organization. This could include regular audits of marketing materials, product development processes, and supply chains. The company should also have a process for gathering anonymous tips or complaints about greenwashing.

What is Internal Audit's role?

Internal Audit can play a multifaceted role related to the risk of greenwashing. Greenwashing should be included in the risk assessment following the typical audit process. As mentioned, greenwashing includes elements of operational, financial reporting, reputational, and fraud risk, making this an area that no organization making environmental claims can afford to ignore.

After assessing the risk related to greenwashing ESG claims, the controls in place within the organization should be reviewed for proper design, implementation, and execution. At this point, the auditors would look for the entity-level controls previously mentioned related to setting goals, defining criteria, and obtaining independent verification. They would also identify the process-level controls associated with the specific initiatives.

Before conducting any tests related to environmental claims, the auditors should consider the goal of their test. Most control testing is only designed to confirm that something is correct. In addressing greenwashing risk, this could be problematic since there is a higher probability of fraud. Initially, any claims should be reviewed for signs of a false association, like a broad commitment and a narrow claim. Then, the auditor can dig deeper into the systems used to measure the claim, test controls to ensure that the system works as intended, and conclude if the actual output matches the figures claimed.

Any discrepancies found should be thoroughly vetted and presented to management. Remember, if the auditor suspects fraudulent activity, they may need to defer the work to a fraud investigator. The IIA has advised internal auditors to be cautious in cases where fraud is likely since most internal auditors have not been trained to conduct a fraud investigation.

Adding value through independent assurance

EY's article on greenwashing reminds everyone that the situation is perfect for fraudulent activity. In summary, they found that employees lacking ESG experience are under pressure to present a positive outcome, and many employees will justify their actions in committing ESG fraud for the company's greater good. Regarding ESG-related risks like greenwashing, Internal Audit adds value by providing independent assurance to help leaders understand the current state of their control environment. The heightened attention placed on ESG risks, and on greenwashing ESG commitments in particular, is a clear signal that internal auditors should include this risk in their assessments and audit plan when appropriate to ensure their organizations do everything possible to mitigate the risk of greenwashing.