Category Archives: EHS

Results from the Auditor QuickQuiz

Our auditor quiz is now closed after a month. The questions were based on existing international non-financial auditing standards, Association of Certified Fraud Examiners (ACFE) fraud identification/examination techniques and US Government Auditing Standards for non-financial audits. There were fewer respondents than we had hoped so we can’t extrapolate beyond our dataset. Even so, some notable trends did emerge.

Of those who responded, 47% were EHS auditors and 27% were CSR auditors. We had hoped more CSR auditors would have participated. Other information about the respondents’ backgrounds:

  • 60% had no certification or “other”
  • 50% have 10 years or less auditing experience
  • 50% have 50 or fewer audits
  • 13% have participated in more than 500 audits during their career
  • 63% spend at least 75% of their time conducting audits

There were only 2 “passing” scores – i.e., greater than 70%. The average score was 49% – far lower than was expected.

Knowledge of standard terminology seems to be lacking, further reflected in poor scores for questions that embedded the terminology within them. For instance, only 30% correctly defined “audit criteria” as meaning the audit protocol. This likely led to 53% of respondents incorrectly answering that QA/QC reviews should include assessing the correctness of the “audit criteria used by the auditor.” QA/QC reviews of auditor working papers should look at how an auditor applied the audit criteria, not the inherent accuracy of the criteria (or audit protocol) used by the auditor. Indeed, only 10% correctly identified that none of the answer options are appropriate for QA/QC reviews.

Only 3% considered interviews better than document reviews when asked directly what type of evidence is strongest. Yet when the question was placed in a practical setting, 73% indicated they would rely on interviews over documentation. Only 26% correctly identified the evidence hierarchy (from strongest to weakest).

On a more positive note, 83% answered that they would decline to develop a document that they audited, meaning 17% did not view this as a conflict of interest. Frankly, we were disappointed that there was not a perfect score in identifying this to be an independence issue.

In answering the question listing possible common evidence problems, just over half (53%) correctly indicated that all of the answer options are common evidence problems.

Finally, 2/3 incorrectly answered that initial determinations of significance/materiality should be made after assessing evidence. It is possible that respondents did not read the question carefully and pick up the word initial.

Certainly more responses would have provided a better representation, but we think there are some valuable take aways from our limited data.  Among them – the gap between EHS/CSR auditor knowledge and existing (and theoretically similar) non-financial audit standards may be larger than previously thought.  As the importance – and liabilities – of sustainability/CSR audits grow, increased auditor training and competence seems warranted.

Last Week for Auditor QuickQuiz

Our auditor QuickQuiz will close at the end of the day September 1.  We hope to see more folks will take a few minutes to answer the questions.  It is painless.

Some of the trends we are seeing are:

  • 67% of the respondents have more than 10 years experience, with 75% or more of that experience doing EHS/CSR audits.
  • Only 15% of the respondents had a passing score.
  • There is a gap in knowledge and application of fundamental audit terminology.
  • There is inconsistency in understanding the strength of evidence types, with an over-reliance on interviews over documentation.

Things are likely to improve when we get more responses.

Auditor QuickQuiz Update

Our short auditor skills QuickQuiz has only been live for a few days and we have logged responses.  The number of respondents is smaller than anticipated but trends are appearing.

The Good:  Respondents understand follow through with sampling plans, are aware of the Fraud Triangle and know the role body language plays in interviews.

The Bad:  Most importantly, respondents have been unable to identify specific threats to auditor independence and they have demonstrated a lower-than-expected understanding evidence corroboration and hierarchy.  Other areas where knowledge improvements seem necessary are materiality determinations, awareness of basic audit terminology and the scope of a QA/QC review.

Keep those responses coming in, and thank you for taking a few minutes to complete it.

A 1960s Economic Model for Sustainability Value

Innovation can create “extra-normal profits” – profits higher than the normal expected ROI based on the risk. But these extra-normal profits are short-lived and disappear once the innovation has been adopted by competitors, thereby equalizing the playing field. You may know these by the term “first mover advantage” – something intangible. But there is a 50 year old economic model for this, known by a far more difficult-to-pronounce name – Schumpeterian profits,  after German economist Joseph Schumpeter.

In April 2004, Yale Economics Professor William D. Nordhaus penned what has become a widely referenced Working Paper for the National Bureau of Economic Research (NBER). Then in 2015, Xie Fan School of Economics & Management at South China Normal University followed up with a study more specific to sustainability matters (more on that paper later).

To summarize Nordhaus, innovation generally leads to reduction in the cost of production without a concurrent reduction in the price charged for the product, meaning increased profit for the innovator until such time as others “appropriate” the innovation and create more or less equal competition. An example of this is patents – once a patent expires, other companies can sell essentially the same product, driving prices down, along with the “extra-normal” profits of the original patent holder. Very simply, the longer a company can hold on to its innovation on an exclusive basis, the longer it can maintain those higher profits. Nordhaus presents a formula for calculating specific values. Looking at historical data from 1948 – 2001, he estimated the Schumpeterian profits (i.e., the extra-normal profits only) to range from -1.3% (during the major recession of the 1970s) to a high of 6.3% of total corporate profits.

We reached out to Nordhaus to see if his paper has been updated and the applicability to sustainability. He answered that no update has been issued. His response about sustainability reflected a limited (and perhaps erroneous) concept of sustainability as relating primarily to environmental protection. This is important in one respect that we won’t delve into here (it relates to the social value of innovation), but in our view is less of a factor than the direct production cost reductions achieved from business-focused sustainability initiatives.

Xie Fan explored whether innovations related to CO2 emissions regulations in China had an economic development benefit as well as an environmental one. Fan’s summary states that

… first of all, the environmental regulation affects the total factor productivity growth in China’s pollution-intensive industries; in the second place, the environmental regulation does not promote producer’s scientific and technological innovation level in China’s pollution-intensive industries; in the third place, the environmental regulation has reduced Schumpeter profits in China’s pollution-intensive industries.

In the end, we see that both Fan and Nordhaus offer complementary  models for sustainability value. In our view, Fan’s point is that once an environmental issue becomes regulated, compliance innovation may not provide Schumpeterian profits, although this seems to contradict the famous Porter Hypothesis. Yet applying Nordhaus to discretionary sustainability business innovation, short term extra-normal profits are to be expected and can be estimated with his formula.  But doing so may also involve reducing transparency in order to maintain exclusivity of sustainability innovations.

All food for thought.

 

 

 

 

 

New Advanced Auditor Training Program for HSE/CSR Auditors

Elm Sustainability Partners and Elm Consulting Group International have launched a new training module for senior-level and experienced health, safety, environmental and social auditors seeking to improve their auditing skills and get updates on timely topics related to non-financial auditing and technology.

It is also relevant to those buying HSE/CSR audit services who are looking to improve the quality of audits they receive.  After this course, buyers can identify specific areas of audit practice improvements to request of their providers.  Alternatively, these buyers may wish to require their external HSE/CSR auditor to complete this training themselves.

A partial list of what is covered includes detailed review and practicum concerning:

  • auditor independence standards and managing impairment threats
  • audit criteria requirements
  • audit and evidence limitations
  • evidence hierarchy, weighting and corroboration
  • fraud, forgery and tampering – including new concerns brought about by technology
  • interviewing skills including fraud examination and FBI techniques
  • discussions of US Department of Justice Criminal Division Evaluation of Compliance Program criteria (2017), the June 1, 2017 US Public Company Accounting Oversight Board (“PCAOB”) auditor reporting standard on Critical Audit Matters and EU Non-financial reporting rule
  • audit QA/QC considerations

Each participant will take a pre-test to establish a knowledge baseline and identify specific areas for improvements.  Exercises are administered throughout and a post-test will conclude the session demonstrating the advanced competencies gained.  HSE/CSR regulatory and other technical topics will not be covered as this is not a regulatory update session.

Elm Principals are BEAC Certified Professional Environmental/Health/Safety Auditors (CPEA), have served on the Board of Directors of The Auditing Roundtable (recently merged into the Institute of Internal Auditors (IIA)) and BEAC, and have trained thousands of internal and external HSE auditors over the past three decades.

Contact us to learn how you and your team can take advantage of this unique program.

New Social Auditor Certification in the Works

We have been vocal in our concerns and criticisms concerning social/CSR auditing.  And we have ourselves been criticized for that. Fair enough.

The Association for Professional Social Compliance Auditors (APSCA) has released for public comment its draft Code of Conduct and Auditor Competency Standards – available here.

We support APSCA and its work towards improving the entire “ecosystem” of CSR auditing.  Anyone with a dog in this hunt should click on the link above and submit comments.  APSCA is keen to obtain input from as wide a range of stakeholders as possible to help become as credible as possible.  Given the breath of subject matter that is being demanded of CSR auditors by buyers of their services, there is a great deal of overlap in APSCA’s draft into environmental health, safety, transportation and other technical areas.

You Are What Your Suppliers Do: Supplier Actions Make Headlines, Break Business

With companies facing increasing pressure for the actions of every part of their supply chain, demand for – and reliance on – supplier/corporate social responsibility (CSR) audits conducted by third parties has grown rapidly.

Shirts, Phones, Rocks and Shrimp

But there is concern about the quality, reliability and credibility of these audits.

CSR Auditing and Toilet Paper

Is Social Auditing Really Auditing?

Harvard Professor Identifies Factors for Meaningful CSR and Supply Chain Audits

You Don’t Know What Your Suppliers Are Hiding

Companies rely on their CSR audit firm to utilize qualified auditors, employ adequate QA/QC processes and expend adequate time to conduct a reasonable audit. Yet there are no generally-accepted professional CSR audit practitioner standards. Moreover, due to cost pressures, lowest cost audit providers are frequently selected that may not have appropriate auditing skills or training – the largest CSR audit firms conduct tens of thousands of these audits each year. Increasing audit time and costs to improve quality or credibility is typically not realistic – the business model is inherently high-volume, low margin.

Are these audits effective at findings supplier actions that create risks for you? Can a company gain confidence in their CSR audits without adding costs? Is a change in auditors necessary?

Improve Credibility for Disclosures, Media and Customers

Changing audit firms is not necessary, nor is another layer of auditing. Instead, a formalized auditor training program can be a low cost yet effective solution.

The Elm Consulting Group International is expanding our well-proven auditor training program to companies who use CSR/supply chain auditors. The intent of this program is for brands to provide detailed communication and training to their current CSR/supply chain auditors about the company’s requirements for auditor competence, audit quality and processes in order to enhance the credibility of audit information.

Our formalized training for existing CSR auditors builds their client’s confidence in the quality of the work provided. The program is not intended to provide training on specific audit topics such as child labor or worker rights. Instead, the focus is on proven audit techniques such as:

  • Understanding and applying professional skepticism
  • Interviewing and active listening
  • Identifying and responding to non-verbal cues within multi-cultural contexts
  • Evidence sampling methodologies
  • Using information from different sources
  • Verification and recomputation techniques
  • Judging audit evidence quality and limitations
  • Fraud detection
  • Using working papers and audit protocols
  • Writing effective and complete audit findings
  • Audit quality expectations, requirements and processes
  • Maintaining auditor independence, including auditor rotation

Our Qualifications as The Leader in Auditor Training

Our HSE auditor training experience began in the 1980s and we have successfully trained hundreds of external and internal auditors. Elm Principals hold auditor certifications from the US Board of Environmental, Health and Safety Auditor Certification (BEAC, now wholly merged into the Institute of Internal Auditors) and UK Institute of Environmental Management & Assessment, are approved trainers for the IIA EHS auditor certification program and are subject to annual continuing education requirements ourselves. Further, Elm Principals have served in various Board positions in The Auditing Roundtable (merged into the IIA in 2016) and BEAC, including the current BEAC Chair.  More information about our internal audit quality and auditor competence standards is available here.

Give us a call at 678-200-3424 or contact us via email to discuss how we can help you increase confidence in your CSR audits.

CSR Auditing and Toilet Paper

In the 1990s I worked for a large paper company and one of the products we made was a name brand toilet paper. As TP goes, this was nice stuff – 2 ply, thick and soft. We marveled that the product didn’t sell well in markets dominated by products that were thin, had holes and fell apart too easily. It baffled us that so many people didn’t care about what ends up on their hands.

Today there is a surprising demand for third party environmental/safety/social/supply chain audits that are equivalent to cheap TP – thin, single “ply” (i.e., one dimensional) and full of holes.   Yet even in the midst of so much reliance on audits, very few buyers of these audit services seem to be concerned. Its not only us that sees this – a fascinating article published earlier this week called out Amazon, The Children’s Place, Gap, Hanes, J-Crew, JC Penny, Kohl’s, Macy’s, Nike, Pink, Polo, Target, Walmart and Zara for “ineffective … CSR monitoring, corporate codes of conduct and industry ‘social audits’ … in protecting the rights, health and safety of millions of workers in global supply chains.”  This, after a decade of CSR audits, is the author’s conclusion.

The article goes on to discuss related failures and inconsistencies in certifications and audit scopes. Our own experiences support this – all too frequently we have seen companies pursuing various certifications solely in order to have a certificate to frame and hang in their lobby. One unfortunately memorable experience came a week after a client had completed their ISO14001 recertification audit. The ISO auditor passed the site with flying colors and was highly complimentary of their program. However, our compliance audit found – with little effort – criminal environmental violations that resulted in the site environmental manager losing his job and one of the few instances where self-disclosure to EPA was warranted without question. This isn’t necessarily a problem with the standards themselves – the problem rests completely with the auditors responsible for assessing the sites.

This criticism shouldn’t be a surprise to anyone who is familiar with current CSR audits and auditors. Certainly there are excellent and conscientious practitioners in the field, but the pricing model of these audits tends to support minimalism all the way around. In a recent article on this topic, we stated our belief that the pricing of CSR audits is directly in response to severe operating cost pressures placed on the manufacturers by the brands. But that circles back to consumer buying preferences as we pointed out six years ago. If attributes other than price and product performance were truly key buying criteria, then the entire economic ecosystem (eco-ecosystem??) would be different.

We do not offer typical CSR/supplier audits because we flatly refuse to compromise our professionalism in order to be cost competitive in this market. Our respect for clients and concern for the risks they face exceeds our desire to compete for revenue from these services in the current market. But, as evidenced by what the article states is an $80B year CSR industry, many people are okay with using cheap toilet paper and don’t seem to care what will end up on their hands.

A few key things you should do to help prevent continuing CSR audit failures:

  • Ensure the audit scope matches the auditor(s)’ backgrounds.  For example, after Raina Plaza, CSR auditors have been increasingly asked to provide information on structural engineering and local electrical code compliance.  These matters require specific technical knowledge beyond that of a typical CSR auditor.
  • Explore the auditor(s) professional qualifications. Do they hold a relevant third-party certification?  How much continuing education do they require on an annual basis?  What fraud detection training have they had?  What are the audit firm process for ensuring independence of the individual auditors, not just the firm as a whole?  Auditors should consider themselves professionals and hold themselves accountable to appropriate standards for qualifications.  If they don’t, that speaks volumes about their attitude toward their work.
  • Test the auditor(s) technical knowledge beyond their checklist.  Does the auditor understand the applicable requirements beyond what is written in the audit checklist or protocol?  There are few times when reality matches the criteria on paper.  You want a professional who is prepared to apply knowledge and expertise objectively and pragmatically, not just check boxes on paper or a screen.
  • Find out how much time the auditor(s) spend onsite, and on each audit activity.  Generally speaking, one day (or less) total on-site is too little for any credible audit scope.  The auditor should reasonably balance their time between document reviews, interviews and visual observations.  If you don’t feel there is adequate time spent or balance in the activities, make your auditor change their practices.
  • Observe – or get feedback on – the auditors’ bedside manner.  An auditor’s attitude and non-verbal cues have a significant impact on the amount and quality of information they are able to gather from the audited entity, and how that entity responds to the audit and corrective actions.  Interviews conducted by the auditor should be non-threatening.  Using active listening techniques without sounding condescending or like a robot is an art form not easily mastered.
  • Look at audit report findings and the cited evidence.  Are findings based solely on interviews?  While this can be acceptable in some settings/situations, information from interviews should be corroborated with another type of audit evidence such as documentation, recomputation or direct visual observations.  If findings are not based on objective and repeatable evidence, make your auditor change their practices.  Issues based on interviews alone should be brought forward in a mechanism outside the audit report as those don’t meet the requirement for a formal finding.
  • Determine how audit reports are peer reviewed – or are they peer reviewed at all?  Does the review require the auditors’ original notes so the reviewer can confirm that the audit evidence supports the findings?  All audit reports should go through a formal internal quality check.
  • Don’t get swayed by broad company or program certifications such as ISO.  While these certifications can be an indicator of internal process formalization, understanding the reality of auditor performance in your specific need is far more important.
  • When considering an auditor, call client references and discuss their experiences, both positive and negative.  Obviously, references are specifically selected to present a positive image.  Expressly ask the reference to offer comments about matters or situations that are not so positive.

The Best Sustainability Seminar in 20 Years – National Association of Manufacturers (NAM) Leading Edge Executive Forum

Yesterday I attended one of NAM’s new Leading Edge series of forums. The session was held in Chicago on the topic of generating real economic value from sustainability.  In 20 years of working in the sustainability space, this was by far the best meeting on the topic I have attended. There have been good ones in the past, certainly. But those typically include folks (ahem, usually consultants) trying to sell the idea of artificially bulking up financial benefits of sustainability initiatives by using soft numbers and intangibles in the ROI.

That is exactly the kind of fluff that destroys the business credibility of sustainability – which we have written about and commented on to the SEC as well. In stark contrast to fluff, BS and soft value, the NAM panelists spoke to how they quantify the real dollars from their various sustainability initiatives.  And I do mean real.  No attempts at assigning a value to reputational damage or brand image, no estiamated avoided contingent risks.  These were business initiatives that, oh by the way, also happen to fall within the scope of sustainability.

Yesterday’s gathering was set up in conversation style rather than a typical presentation, which allowed each speaker to discuss their approach to, or obstacles encountered in, a moderated topic. Speaking were representatives from Ecolab, Microsoft, Pfizer, BASF, Smithfield Foods, ArcelorMittal and Alcoa, with a wrap up from Subaru of Indiana.

One point that stood out came from Subaru, who showed the sustainability timeline for their manufacturing plant in Indiana, which began in 1994.   Back then, they developed a business case for a particular project based on real dollars that was successful.  By doing so, they set the foundation for future sustainability initiatives that probably would not have seen the light of day if the business foundation set in 1994 was unsound.

I’m not sure if NAM will repeat the session, but if they do we highly recommend attending.  If you would like to convince them to hold it again, please send us a note and we will forward it to the NAM program manager.

Is Social Auditing Really Auditing?

We are a rather vocal proponent of auditor qualifications and set a high bar for ourselves and others who call themselves auditors. Non-CPA auditors are “regulated” differently than CPAs and in some cases, less stringently. Auditor certifications are available for non-CPAs specific to areas of practice. These certifications vary greatly in terms of validity, rigor and length of time they have been established. In our case health, safety and environmental (HSE) auditor certification is applicable.

In the US, the Board of Environmental Auditor Certification (BEAC) was established in 1997 as a joint venture between the Institue of Internal Auditors (IIA) and The Auditing Roundtable. Earlier this year, BEAC and The Auditing Roundtable were wholly merged into IIA. Elm Principals obtained BEAC certification the year it was established and have maintained the annual continuing educational requirements to hold the certification continuously since then. Three of our Principals have for the past 10 years held – or currently hold – leadership positions on the Boards of The Auditing Roundtable and BEAC.  In the UK, the Institute of Environmental Management & Assessment (IEMA) offers auditor and practitioner certifications. One Elm Principal holds an IEMA certification as well.

The Independent Private Sector Audit (IPSA) requirements finalized under Dodd Frank Section 1502 for conflict minerals reports added more professional qualifications for IPSA practitioners. Elm responded by adding a stand alone page on our website describing our audit quality practices.  We haven’t seen other firms provide the same level of clarity, specificity and visibility on this matter.  From our beginning, we sought to ensure our qualifications, expertise and professionalism were unparalleled.

During the past 10 years, a new type of audit emerged – the social or corporate responsibility audit. Most of these audits are commissioned by large companies to be conducted of their suppliers to ensure that they are conforming to social responsibility standards. We have found over the years, the perceived value of these audits has reduced dramatically and price is far and away the primary auditor selection criteria. Of course, with reduced pricing comes reduced scoping and level of effort.

And here is the mic drop.

It isn’t unusual to see social auditor qualifications indicating something like 2,000 audits conducted over 10 years. At first, that sounds very impressive. But do some math – on average, that is 200 audits/year or 16.7/month. Assuming a full time US standard work year (2,080 hours) and 75% utilization, that comes to a little over 7.5 hours/audit average.

In comparison, Elm Principals average close to 30 years of experience each, and have conducted between 500 – 600 audits each. In comparison to the 2,000 social audits, we seem to be slackers. But again, doing math on conservative numbers (25 years and 500 audits), we average of 20 audits/year or 1.7/month. Again, assuming a full time US standard work year and 75% utilization, that comes to 78 hours/audit average.

These are just averages and different matters factor into real numbers for both social audits as well as ours (our average is more like 55 – 60 hours/audit). But clearly there is an order of magnitude difference between our HSE audits and social audits.

Are we inefficient or milking billable hours?  We hardly think so.  First off, our business model is different – we don’t run on billable hours, which relieves the pressure most firms have for project volume.  Our audits are far deeper and more complex than a typical supplier social audit – almost always requiring two to five auditors and a week on-site. We spend significant time delving into documentation, spreadsheets, permits and regulations at the federal, state/provincial and local levels. Our data sampling rate is generally far higher than the minimum statistically meaningful level. We carefully evaluate and confirm operating and production levels, including technical operating parameters for pollution control equipment. Most of our audits also include assessing performance of on-site contractors.  We even show up on site at 3 a.m. to observe third shift operations. And we cover the full breadth of environmental, health, safety and – when the client requests – sustainability indicators.

This is not to say that all social auditors are poor auditors or unqualified. We have observed some in the field and have been impressed.  There are also instances where limited audits/site visits are reasonable in the social auditing context.  But with social auditors expanding into other areas of supply chain and operations, the social audit approach and qualifications are not universally appropriate even though the price they offer may be attractive.  You may want to think carefully about your needs and expectations, as well as the numbers on CVs and ask yourself if the auditor is actually impressive or overworked and under-scoped.