Barcelona is hardly a surf spot, yet last week at Workiva Amplify conference delegates were caught between two waves.
These were not the surfing types but the CSRD type: wave one companies who have just published their first CSRD reports, and wave two companies which are wondering if they should store their reporting boards and take an omnibus away from the beach.
And while policy makers in Brussels and Strasbourg are (it seems) steaming ahead with a deregulation agenda, investors reiterated the need for disclosures and many companies said they are cracking on with the job at hand and recognising the benefits of the CSRD requirements.
Carlsberg Group finance director and group sustainability Finn Adser went as far as describing CSRD as "what we had been waiting for".
The Danish brewing company already had the processes for sustainability reporting, he argued, but CSRD gave "the guidelines and standards to report against".
For wave two companies, the path forward is of course trickier due to policy uncertainty. One such company's representative explained to Corporate Disclosures that, despite all the investments and efforts, it decided to wait and see where policymakers in Brussels land, adding that there was little confidence over whether the two year 'stop the clock' provision was going to be two years, longer or shorter.
Asked why they were not continuing the work and publishing on a voluntary best practice basis, the corporate said: "Well, legal is worried, and then, more generally, internally there is no appetite to report more now than might be required further down the line."
During a Q&A session for one of the conference panels, a wave two corporate asked Liisa Aavik, sustainability compliance manager at fellow wave two company Bolt, advice on what to do while politicians debate.
Aavik explained that the Estonian multinational was "continuing to gather [its] ESG data and developing [its] reporting system".
"First because it helps us better manage the company," she said. "[But also,] we still see a demand [for this information] from banks and customers [...] We are using this two-year extension to do a better job with the report."
Although, she admitted that the focus had shifted more to the quantitative metrics, leaving aside the narrative metrics for now in the expectation that these would be reduced as part of the ESRS simplifications under the omnibus.
Merje Maripuu, who heads the group's reporting and compliance and was sitting on the same panel as Aavik, added that "it is super useful to get those systems set up right now [rather than having] to make inefficient retroactive fixes very close to the deadline".
A thought echoed on another panel by James McIntyre, head of finance and staff pensions at Aviva, who stressed the importance of streamlining processes as they are constructed, "rather than a reconciliation exercise at the end".
Greg Stinson, partner for accounting advisory services at KPMG UK, spoke in an interview with Corporate Disclosures of his surprise at the "appetite for companies to continue on the path they were on".
"Although the term 'stop the clock' is being used, it's not about exclusively putting the breaks [on] but actually taking stock of progress, considering the investments in people, systems and processes, and determining [the] best next steps," he said. "Of course, it's not a universal truth and you'll have some companies that [will] take a pause to take stock of what the law will require of them. But many are still going forward."
On another panel, Chirag Shah, partner at KPMG UK, said the "narrative and projects" he was working on at the moment have changed due the current "climate of deregulation". Before the omnibus announcement, the focus was on meeting the assurance requirements, now the focus is on "building the process that meet the standard of quality that we need in the cheapest, most efficient way".
At Bolt, Maripuu admitted she was worried six months ago of having to "produce this report quickly with data we were not sure about".
"Now we have some breathing time, so we can make the changes into our business processes in the way that we don't have to fix things later," she said.
Lessons from first year of reporting
With two company representatives – one from sustainability, one from controls – on the same panel, Maripuu and Aavik were keen to emphasise the importance of cross-functional work for successfully implementing the CSRD.
"It took us a year to understand how important it is to involve all the stakeholders, like procurement [and] finance, at the same table and think about the metrics and how we approach the reporting," Maripuu candidly revealed. "We did a project plan as to where we wanted to be in a year's time and, working backwards, what are the steps we needed to take to get there, while highlighting the milestones."
And this cross functionality doesn't necessarily need to be complicated. Aavik highlighted the success of a simple joint messaging channel Bolt used "with everyone working [on] CSRD, where you post regular updates from the lead CSRD team on what is going on, how the work is progressing, who is responsible for what".
"It is a simple thing," she said. "But it is a game changer to keeping your teams aligned."
And then of course teams can learn from each other. In Bolt's case, Maripuu highlighted two learnings her risk team passed on to Aavik's sustainability team. One being the importance of the process description in the context of an audit.
"How we arrive at [a] certain conclusion is not always a right or wrong answer but there has to be a reasoning behind [it]," she said. "And secondly, we need to be able to support any information that we present in the report, so archiving and storing the data is very important so that we can prove what we report, and that it is consistent with the financial reporting."
That consistency with financial reporting was also a key learning at Carlsberg – a wave one company.
Reflecting on the first year of reporting, Carlsberg Group's Adser said it had brought about more transparency.
"Because of the way the CSRD is structured, you have to make sure that your datapoints are connected so that the stories you report actually match," he explained.
"The best example is: you report your policies, you report your targets under that policy and then your report on your actions, but you also have to report on the amount of investments."
Adser continued: "It would look weird if you have material topics and you don't spend anything on it, and it could also be that you spend a lot but you don't see any performance going forward. Stuff like that gets really transparent."
Asked about the importance of these connections, KPMG's Stinson said organisations cannot operate in silos - whether it's from a process, system, people, data or controls standpoint - because a lot of these things are going to underpin all of the reporting that the organisation does, whether it's financial, whether it's non-financial reporting, whether it's going into the front half of the Annual Report, the accounts, the investor packs or other sustainability reports.
"Ideally, the data should all come from connected systems, well governed, and assurable," he continued. "If I review the company's principal risks in the front half, I absolutely need to be making the connection to the financial statements, be it going concern, impairment, revenue contracts, deferred tax or something else.
Companies need to keep the two absolutely linked and connected and definitely not mutually exclusive."
Stinson concluded: "We are not there yet, and there's a long way to go because there is a question of skill, but also information outside of the financial statements tends not to be subjected to the same audit requirements. Regulation and market practice is developing here, with new approaches to assurance. It's developing and evolving and will continue to do so."
Other learnings from wave one companies included the use of technology. For example, Sini Halla, head of group accounting at Nokia, shared a "traumatising" experience where, at 11pm the day before the publication of a report, senior staff were trying to fit a table into a page "when something changed and the excel table exploded – I just thought there must be smarter ways of doing this".
Although there are always pushbacks to new things, including AI and technology, she recommended adopting a step by step approach, starting with the easier tasks in order to demonstrate the advantages of such tools and get the buy-in.
The elephant in the room: assurance
Asked what the most surprising thing they heard at their conference was, both Esther Toth, senior industry principal for sustainability management at Workiva and Graeme Fleming, GRC industry principal at Workiva, highlighted the relationship between companies and auditors and the potential implications for the next cycle of reporting.
"There were no qualified limited assurance reports as of now," Fleming said, bearing in mind that this is a new environment with controls being built. "There have been plenty of what they describe as 'emphasis of matter'. So that's kind of saying there is something we are going to tell the stakeholders about, but we're not qualifying it."
This would suggest that, in the background, auditors are helping their clients in their journeys to improve reporting, and accepting that many of the datapoints reported are estimates, which may not have undergone the necessary level of controls, Fleming said. "That it's not in itself grounds for a qualification, but if you have the same emphasis of matter two years in a row, that probably suggests that there might be some qualified limited assurance going forward."
In other words, he expects the sustainability assurance bar to raise next year and, once Europe chooses a limited assurance standard, he said "it will probably focus on reporting risk and controls and requiring auditors to actually test the controls".
"If your controls environment fails on mass, you are going to have a qualified sustainability assurance opinion," he said. "Which would be catastrophic as it amounts to the auditor saying 'you can't rely on any of this data'."
And so, regardless of political headwinds, corporates need to ready themselves for the next wave and remember the iconic (and fictional) surfer Bodhi's words: "Fear causes hesitation, and hesitation will cause your worst fears to come true."
This journalist's travel and accommodation to Workiva Amply were covered by the organisers.
