 AA1000 Assurance Standard
IntroductionAccountAbility’s revision of its AA1000 Assurance Standard in October 2008 marked a major step forward for the assurance of sustainability and corporate responsibility reports. The revised Standard, known as AA1000AS (2008), is unique as it requires the assurance provider to evaluate the extent of adherence to a set of principles rather than simply assessing the reliability of the data.AA1000AS (2008) represents the leading edge in sustainability assurance, and has been adopted by leading reporters and leading assurance providers alike. This section provides practitioners with information on AA1000AS (2008) In addition to a list of current reports with external assurance statements complying with the new Standard, we also introduce, for the first time, a guide to ‘Using the Standard’. This sets out the criteria we at CorporateRegister.com use when assessing whether or not a statement complies with the Standard - if it complies we include it in the Register. During the transition period (2008-09), we adopted a more flexible approach to assurance statement compliance to support early adoption and uptake of the standards. From 2010 onwards, we will adopt a more rigorous approach to assessing assurance statement compliance given that the transition period has ended and there is a more widespread marketplace awareness of the standard's requirements. We have accordingly developed this guidance to support assurance providers in preparing their assurance statements. If you are from an assuror or reporting company about to publish a statement using AA1000AS (2008), you are invited to send us a draft of the statement and we will carry out a pre-check. This is free of charge and we will respond within one week at the latest - usually sooner. Send your statement to info@corporateregister.com. Any additional information referenced within the assurance statement must be submitted with the statement. This could include, for example, a reporting company’s conclusions on the AA1000 Principles for assertion-based assurance or sign-posted information of assurance provider competencies. ‘Using the Standard’ comprises a listing of the criteria and what we look for, and is illustrated by excerpts from recent compliant statements. This guidance will be updated periodically to reflect the latest assurance practice. You are advised to check regularly for the latest information. It was last updated on: 23rd March 2010 Contacts For information about the Register and pre-checks please contact: Marko Kalik at CorporateRegister.com +44 (0) 20 7014 3366 marko@corporateregister.com www.corporateregister.com Current ReportsCorporateRegister.com is proud to host the official Register for the Standard.You can access the Register in two ways: 1. A listing of all reports complying with the AA1000AS (2008) here. This listing is updated every two weeks 2. Search the www.corporateregister.com website (Advanced Report Search, check the 'AA1000AS' box). You need to be a registered site user to search on the site. Using the StandardGeneral Points:
Intended users of the assurance statementWhat we are looking for
A brief statement of audience to whom the assurance statement is addressed - often the stakeholders and/or management of the company. This could be as an opening paragraph or title of the statement, or at any point in the statement body
Possible formulations
"To the management and stakeholders of ABC Inc."
"The intended users of this assurance statement are..." "The intended user of this statement is the reader of the ZZZ CSR Report." The responsibility of the Reporter & of the AssurerWhat we are looking forA brief delimitation of the responsibilities of both reporter and assurer in preparing the report.
Possible formulations
"ZZZ was responsible for the preparation of the report and this statement represents the assurance provider's independent opinion. AAA’s responsibility in performing its assurance activities is to the Management of ZZZ alone and in accordance with the terms of reference agreed with them."
"ZZZ is responsible for the collection, analysis, aggregation and presentation of all information and assertions made within the Report. AAA’s responsibility in performing this work is to the management of ZZZ only, in accordance with terms of reference agreed."
"Responsibilities: The Directors of ZZZ Group Plc are responsible for preparing the Report and related web-text, and the information and statements within it. They are responsible for identification of stakeholders and material issues, for defining commitments with respect to corporate responsibility (CR) performance, and for establishing and maintaining appropriate performance management and internal control systems from which reported information is derived. Our responsibility is to express our conclusions in relation to the above scope."
Assurance standard/s usedWhat we are looking forA reference to "AA1000 AS (2008)" in the assurance statement. (Not AA1000APS or AA1000 AS 2003).
Possible formulations
"The assurance was undertaken in accordance with the AA1000 AS 2008 Assurance Standard"
"Scope of Assurance
The scope of AAA's assurance engagement, as agreed with ZZZ included the verification of: The extent to which the principles of Materiality, Inclusivity and Responsiveness are adopted, in line with the requirements of the AccountAbility1000 Assurance Standard (2008) (hereafter ‘AA1000 AS (2008)’) for a High Level Type 2 assurance engagement. The reliability of the information within the Report for calendar year 2008, was verified to a high level of assurance, with particular attention paid to the following specific performance information in accordance with the requirements of AA1000 AS (2008)" "Which assurance standards did we use?
We conducted our work in accordance with ISAE 3000 and the requirements for a Type 2 assurance engagement under AA1000 AS (2008). A Type 2 Assurance Engagement covers not only the nature and extent of the organisation’s adherence to the AA1000APS (2008), but also evaluates the reliability of selected CR performance information." Description of the scope and typeWhat we are looking forA description of what subject matter and what parts of the organisation are covered. A statement of whether the assurance is Type 1 or Type 2.
Possible formulations
"AAA provided Type 2 assurance in accordance with the AA1000 AS (2008). This involved an assessment of the organisation’s adherence to the AA1000AS AccountAbility Principles 2008, and an assessment of the accuracy and quality of sustainability performance information contained within the report"
"Scope of Assurance
The scope of AAA’s assurance engagement, as agreed with ZZZ included the verification of: CSR policies, goals, initiatives, practices and performance for calendar year 2008, described in the Report. These were verified at Group level as well as in site visits to 10 ZZZ operating companies and joint ventures. The companies visited were: Company A and company B in Country 1 etc. The extent to which the CSR management approach and initiatives described in the Report are displayed in the operations at the sites visited. Processes for defining the boundaries, focus and content of the Report. The extent to which the principles of Materiality, Inclusivity and Responsiveness are adopted, in line with the requirements of the AccountAbility1000 Assurance Standard (2008) (hereafter ‘AA1000 AS (2008)’) for a High Level Type 2 assurance engagement. The reliability of the information within the Report for calendar year 2008, was verified to a high level of assurance, with particular attention paid to the following specific performance information in accordance with the requirements of AA1000 AS (2008)" Description of disclosures coveredWhat we are looking forAn explanation of which document(s) and document formats, the assurance statement relates to. The statement must be attached to the disclosures it covers.
Possible formulations
"The department commissioned AAA Management Group Pty Ltd to provide independent assurance of their 2008-2009 Sustainability Report (the ‘report’). The report presents ZZZ’s sustainability performance over the period 1 July 2008 to 30 June 2009." (...) "The assurance scope covered the whole report and focussed on systems and activities of ZZZ during the reporting period, with the following exceptions - the scope of work did not involve verification of financial data, other than that relating to environmental, social or broader economic performance. – the assurance provider’s involvement with stakeholder engagement was limited to reviewing."
"AAA has been commissioned by the management of ZZZ plc to carry out an independent third party assurance engagement on ZZZ’s 2008 Corporate Social Responsibility Report (hereafter ‘the Report’) in its printed and downloadable pdf formats"
"AAA was engaged by ZZZ Group Services Limited to provide assurance over selected aspects of the ZZZ Group plc (‘ZZZ’) 2008/09 Corporate Responsibility Report (‘the Report’)." Emphasis of matter ZZZ Subsidiary (Country 1) was included in the original scope of our assurance. It has a material contribution to ZZZ Group CR performance. However, because of issues identified in the reporting and assurance process, ZZZ decided to exclude ZZZ Subsidiary Ltd from the consolidated data and performance in the Report. A separate section on ZZZ Subsidiary Ltd has been included in the Report, which explains the dilemmas and challenges and current status of CR management and reporting"
Description of methodologyWhat we are looking forA description of how the assurance engagement was performed, including what information was reviewed and the techniques used to gather that information.
Possible formulations
"Assurance Methodology.
The assurance engagement was undertaken during July and August 2009, and the process involved: - Development of a materiality register.... - Branch and section manager interviews to assess.... - A review of processes [processes detailed]" "Verification Methodology
This assurance engagement was conducted between April and July 2009. It was planned and carried out in accordance with the AAA Protocol for Verification of Sustainability Reporting, which is based on the GRI G3 and AA1000 AS (2008). In reaching our conclusions, we have undertaken the following work: Interviewed a selection of ZZZ executives and management representatives from ... Visited ZZZ’s Head Office at [site] and ZZZ Subsidary’s Head Office in Country 1 and conducted site visits to ... Reviewed the mechanisms implemented by ZZZ ... Analysed corporate CSR data management... [continues]" " "What did we do to reach our conclusions?
We planned and performed our work to obtain all the evidence, information and explanations that we considered necessary in relation to the above scope. Our work included the following procedures using a range of evidence-gathering activities which are further explained below: An evaluation of the results of ZZZ stakeholder consultation processes... Observation of a ZZZ Stakeholder Panel meeting, and discussions with some of these stakeholders; A media analysis and an internet search for references to ZZZ during the reporting period; Interviews with the CEO, senior management and relevant staff... Testing ZZZ assertions and explanations regarding progress against commitments through evidence collection... Checking the GRI index on the ZZZ Group website, to ensure consistency with the GRI application level requirements of A+; An evaluation of the design, existence and operation of the systems and methods used... Visits to a risk-based selection of four operating companies, in Country 1, [etc.]. A review of drafts of the Report and relevant web text to ensure there are no disclosures that are misrepresented or inconsistent with our findings." Any limitaionsWhat we are looking forDetails of any information, processes and procedures that would have been examined during the course of the assurance engagement but were not because they were unavailable or because access was not provided.
Possible formulations
"The assurance scope covered the whole report and focussed on systems and activities of ZZZ during the reporting period, with the following exceptions:
the scope of work did not involve verification of financial data, other than that relating to environmental, social or broader economic performance. the assurance provider’s involvement with stakeholder engagement was limited to reviewing..." "The verification of ZZZ’s compliance with the [relevant industry framework] reporting requirements for greenhouse gas emissions is documented in a separate assurance statement on page 99.
ZZZ’s reporting boundaries include all operating companies over which ZZZ management exercises significant control. Where data and information from joint ventures and associated companies is included, it is noted within the Report. The primary purpose of this assurance engagement was to verify the quality of data, information and assertions made in the Report. By undertaking this process, AAA also gained insight into ZZZ’s approach to CSR management, in accordance with the above described scope of assurance. The engagement excluded the CSR management, performance and reporting practices of ZZZ’s suppliers, contractors and any third parties mentioned in the Report. AAA did not interview any external stakeholders as part of this assurance engagement. The verification covered data from calendar year 2009" "Specific limitations to our work included the following:
For waste, we confirmed that the data supplied by contractors were correctly reported and aggregated by ZZZ, but we did not undertake visits to verify the underlying reliability of this data; For social spend, we examined the Agreements between The ZZZ Foundation and local foundations, and internal reports supplied by local foundations to The ZZZ Foundation covering 90% of reported social contributions. We did not review direct donations from local operating companies to charities and we did not perform any checks on the actual transfers from the Foundations to charities. Separate financial audits of the ZZZ Foundations will be completed within their statutory reporting frameworks" Reference to criteria usedWhat we are looking forThe criteria against which the subject matter has been evaluated. The AA1000APS criteria are found in the AA1000APS and should be cited as criteria for evaluation of adherence to the principles. Criteria (and associated indicators) for performance information can come from a variety of sources. These sources should be cited.
Possible formulations
"The criteria set out in AA1000APS (2008) for each of the principles of inclusiveness, materiality and responsiveness.
Commitments set out in ZZZ Group plc 2009 CR Report. Relevant internal reporting guidelines for the selected environmental, safety and social performance data as set. GRI (G3) Sustainability Reporting Guidelines and application level requirements" "The AA1000 AS (2008) assurance principles of Inclusivity, Materiality and Responsiveness have been used as criteria against which to evaluate the Report."
"The AA1000 AccountAbility Principles (2008) against which ZZZ’s processes are assessed include:
Inclusivity: An assessment is made as to whether the organisation has included stakeholders in developing and achieving an accountable and strategic response to sustainability. Materiality: An assessment is made as to whether the organisation has included in its report the material information required by its stakeholders to be able to make informed judgements, decisions and actions. Responsiveness: An assessment is made as to whether the organisation has responded to stakeholder concerns in its Report. An assessment is also made as to whether the organisation has in place policies and relevant standards to address material sustainability issues and concerns." Statement of level of assuranceWhat we are looking forThe assurance level can be either "moderate" or "high". The assurance statement should make it clear what part of the scope has received a moderate level of assurance and what part of the scope has received a high level of assurance. If the statement also uses ISAE 3000 then the equivalent levels (limited and reasonable) may be stated.
Possible formulations
"The level of assurance is moderate as defined by the scope and methodology described in this assurance statement"
"The reliability of the information within the Report for calendar year 2008, was verified to a high level of assurance"
"Readers should note that high and moderate levels of assurance in AA1000 AS (2008) are consistent with reasonable and limited assurance respectively in ISAE 3000"
Findings and conclusions on 3 principlesWhat we are looking forConclusions on the three principles should articulate the extent and nature of adherence to the principles (i.e. how they adhere and how much). Assertion-based statements may refer to the company’s statement of adherence to the principles contained within the report being assured. In such cases, the pages and/or sections where assertions can be found should be accurately referenced. There must be a conclusion on each of the three principles. The conclusions may be separate or contained in the same sentence or paragraph.
Possible formulations
"Adherence to AA1000 Principles
Inclusivity: ZZZ has effective systems in place for internal stakeholders to participate in the development of the organisation's response to sustainable development issues, particularly through the Sustainability Working Group, Sustainability Steering Committee and [Employee Green Teams]. These forums, which comprise of formal and informal mechanisms for ongoing dialogue, enable participation from across the organisation. Materiality: ZZZ has a strong process in place to determine material issues. Key material issues identified by AAA through the materiality test were adequately reported to demonstrate ZZZ's environmental, social and economic performance. In addition, the report was found to provide balanced information about ZZZ’s sustainability performance. A range of internal stakeholders are involved in ZZZ’s materiality determination process that is facilitated by the Sustainability Working Group and Sustainability Steering Committee. However, the criteria used to determine issues for reporting could be further formalised. Responsiveness: ZZZ was found to be responsive to internal stakeholder concerns and expectations. This was achieved through the organisation's allocation of resources to stakeholder engagement, the timeliness and accessibility of reported information, and the types of communication mechanisms regularly" "What are our conclusions?
The following conclusions should be read in conjunction with the work performed and emphasis of matter described above. Assurance scope 1: On the AA1000APS principles of inclusiveness, materiality and responsiveness: We believe that ZZZ’s description of their alignment with the AA1000APS (2008) principles, on their website, is fairly stated. We draw your attention to the challenges described by ZZZ, which were highlighted through our assurance work. Key findings for each principle include: In relation to the principle of inclusiveness: Stakeholder engagement at a ZZZ Group level is comprehensive. However, processes at some operating companies could be strengthened to ensure the full range of stakeholders is identified and engaged with appropriately. The role and selection criteria for the ZZZ Group Expert Advisory Panel could be clearer, to ensure balanced representation and focused feedback. In relation to the principle of materiality: The criteria for assessing materiality are informal, which could lead to inconsistent assessment across operating companies. Emerging issues could also be better addressed within the materiality assessment. In relation to the principle of responsiveness: There are comprehensive ZZZ Group policies and guidance on management of material issues, and most issues are well managed across the business; however the extent of integration of CR into business operations at an operating company level can be variable, particularly for the newer businesses. We observed some cases where lack of documentation and formal handover, due to staff changes, has led to a loss of stakeholder relationships and operational engagement with CR. Programmes for the monitoring of contractor performance have yet to be implemented widely, and the increasing number of subcontractors presents a particular challenge when defining the boundaries of influence." Conclusions on performance info (Type 2 only)What we are looking forConclusions on the reliability of all performance information identified in the scope of the assurance engagement.
Possible formulations
"Reliability of Performance Information
Based on the scope of the assurance process, the following was observed with regard to performance information: The findings of the assurance engagement provide confidence in the systems and processes used for managing and reporting sustainability performance information. The majority of data and information presented were found to be accurate. Some data inaccuracies identified were found to be attributable to transcription, interpretation and aggregation errors. The development of data management protocols should be considered to ensure consistent and replicable reporting of performance. The selected calculation methodology for some sustainability indicators has the ability to generate results of significant variance year on year. Such occurrences should be minimised. Data trails selected were identifiable and traceable, and the personnel responsible were able to reliably demonstrate the origin(s) and interpretation of data. The sustainability performance disclosures presented within the report appropriately reflects environmental, social and economic performance achieved during the period. Overall, it is AAA’s opinion that the information presented within the report is fair and accurate. The report was found to be a reliable account of ZZZ’s sustainability performance during the reporting period." "AAA believes that the Report generally meets the principles, content and quality requirements of GRI G3 and AA1000 AS (2008) for a Type 2 High Level of Assurance. Further conclusions and observations on the adoption of reporting principles and specified performance information are made below:
Inclusivity and Responsiveness: Overall, ZZZ has a good understanding of its stakeholders and their information needs and has used this knowledge to inform the content and structure of the Report. At Group level ZZZ engages regularly with SRI rating agencies, investors and shareholders, best practice groups, and industry associations. Engagement with local stakeholders is delegated to local operating companies, some of which have robust stakeholder engagement programmes, while others are beginning to implement more structured programmes. Materiality: While the Group does not have a formal structured materiality assessment process, it maintains a range of internal processes which are effective in bringing out CSR issues of relevance and importance for the Group and its stakeholders. Furthermore, through the above-described stakeholder engagement processes, ZZZ is able to continue to identify and understand the CSR issues which are material to the company and able to stay informed of trends and changes in CSR over time. These processes informed the content of the Report." "Assurance scopes 2 and 4: On the reliability of selected data and progress against selected commitments (reasonable assurance): The performance data and reported progress against commitments, marked with the symbol [*], on pages 54–57, are fairly stated.
Assurance scopes 3 and 5: On the reliability of selected data and progress against selected commitments (limited assurance): Nothing has come to our attention to suggest that the performance data and reported progress against commitments, marked with the symbol [**], on pages 54–57, are not fairly stated." Observations and/or recommendationsWhat we are looking forObservations and recommendations may be provided on how to improve adherence to the 3 principles, performance in the areas specified for assurance or for the reporting process. The statement must include observations and recommendations but it need not include observations and recommendations for all principles and for all specified performance information. It should provide observations and recommendations in the most material areas.
Possible formulations
"It was found that the report appropriately addresses ZZZ’s environmental, social and economic material issues. To assist ZZZ to continue to improve its reporting on sustainability performance, AAA has provided recommendations with regard to the formalisation of processes for identifying material issues, external stakeholder engagement, data management and greenhouse gas calculation methodology. These have been outlined in a more detailed report presented to ZZZ’s management."
"The following is an excerpt from the observations and opportunities reported back to the management of ZZZ to encourage continual improvement. However, these do not affect our conclusions on the Report.
• Continue to develop a more structured approach to stakeholder engagement at local site level and consider implementing a formalised materiality assessment process that would assist in informing the content and prioritisation of information reported. • Continue to progress the development of KPIs for environmental performance which are enduring and applicable to the diversity of ZZZ’s product range, in order to facilitate the assessment of performance as ZZZ’s composition / equity, production volumes and product characteristics change over time. • Continue to enhance the CSR-related data collection tools by implementing version controls or adopting processes that would further facilitate reporting and internal quality control. Consider tailoring data collection more specifically to the different types of operating companies and product lines. • Continue the robust focus on improving Health & Safety performance, while also encouraging ZZZ companies, where appropriate, to expand their focus on environmental management and reporting initiatives." "We provide ZZZ management with an internal report outlining our findings and areas for improvement. Without prejudice to our conclusions presented above, we present some of the key observations and areas for improvement below.
1. Monitoring of contractor compliance with the [company framework] is a challenge. We recommend greater guidance is provided by ZZZ Group around the audit processes and criteria. Targets should be set at an operating company level and progress monitored. We support the intention of ZZZ Group Internal Audit to perform a review of this area in 2009. We also recommend that reporting systems are extended to collect data on contractor health and safety performance, including lost time incidents, to help improve health and safety management and reduce more serious incidents. 2. Behavioural targeting is used increasingly in the development of new products and services. Processes and controls to protect consumer privacy will therefore be increasingly important. A recent ZZZ Group Internal Audit review highlighted a number of challenges with implementation of the ZZZ Group Privacy Policy that need to be addressed and closely monitored over the coming year. 3. ZZZ has taken on board the advice of stakeholders and has now set a smaller number of strategic long term objectives, linked to business strategy, which will drive a broad range of improvements. These will need to be supported by clear milestones, specific interim targets, and clear success criteria. The implications and expectations for operating companies will also need to be clearly defined. 4. In principle, ZZZ applies the same ethical and management standards across its global operations. In ZZZ [Subsidiary], however, the scale of the operations, the rate of expansion, and the number of contractors present ZZZ with an enormous challenge in relation to embedding the business principles and CR policies throughout all operations. Critical areas include licensing and compliance, health and safety, and contractor management. [Country 1] is also a significant contributor to ZZZ’s total CO2 emissions due to [fossil fuel use]. We support ZZZ’s initiatives in recent months to develop a CR road map and a Climate Change Strategy for its operations in [Country 1]. We recommend that ZZZ develops a timeline for this roadmap with interim milestones and targets, and reports regularly on progress." Notes on competencies and independenceWhat we are looking forA Statement of Independence may include the ethical guidelines under which the assurer is working, and could include the details of any other work completed for the company, and confirmation that the assurer did not prepare any part of the report.
A Statement of competence should include the professional and other qualifications that form the basis of that competence. Details of how readers can get more information on the competencies of the team can be included.
Possible formulations
"We conducted our engagement in compliance with the requirements of the IFAC Code of Ethics for Professional Accountants, which requires, among other requirements, that the members of the assurance team (practitioners) as well as the assurance firm (assurance provider) be independent of the assurance client, including not being involved in writing the Report. The Code also includes detailed requirements for practitioners regarding integrity, objectivity, professional competence and due care, confidentiality and professional behaviour. AAA has systems and processes in place to monitor compliance with the Code and to prevent conflicts regarding independence"
"AAA was not involved in the preparation of any information presented in the Report, aside from the [industry initiative] Assurance Statement and this Assurance Statement. AAA did not provide any services to ZZZ or its stakeholders during 2009 that could conflict with the independence of our work"
"Our assurance team has extensive relevant professional and technical competencies and experience. For a fuller description please refer to our website"
"Our assurance team has been drawn from our [sustainability assurance department], which undertakes similar engagements to this with a number of significant UK and international businesses. The work has been led and reviewed by [lead assurers]."
"The assurance team was composed of Lead auditors and [specialist] verifiers experienced in [relevant] sector, and trained in a range of sustainability, environmental and social standards including AA1000 AS, ISO 14001, OHSAS18001, ISO 14064 and ISO 9001. [Assurance provider] is a leading global standards and assessment body founded in [year]. The assurance is carried out in line with [our internal] code of practice"
"The assurance team comprised of [team names] with experience in AA1000, ISO 14001, and sustainability assurance. Over the past 7 years, the team have undertaken over 20 assurance statements in various locations, working for [assurance company] or independently"
Name of the assurance providerWhat we are looking forAt the very least this should include the name of the company engaged to provide assurance. Ideally this should also include the name of the lead assurance provider or the partner in charge.
Date and placeWhat we are looking forThis should be the date when publication of the report is agreed. No changes to the report can be made after the assurance statement is signed and dated.
Documentation'Using the Standard' Guidance Document View pdf (0.22Mb)What CorporateRegister.com looks for when assessing assurance statements. 02/2010 AA1000AS (2008) Assurance Standard View pdf (0.64Mb) The official AA1000AS (2008) Standard document from AccountAbility Guidance For AA1000AS (2008) Assurance Providers View pdf (0.19Mb) Further guidance for assurance providers on using the AA1000AS (2008) assurance standard. 09/2009 Guidance For Stakeholders Using AA1000AS (2008) Assurance Statements View pdf (0.08Mb) Further guidance for readers of assurance statements, written for a non-specialist audience. 09/2009 |
About CorporateRegister.com | Links | Contact us | Terms of Service | Copyright © 2010 CorporateRegister.com Ltd |
Download 'Using the Standard' as Pdf