Why every organisation needs a non-financial audit function, and almost none have one

Corporate financial statements used to be taken largely at face value too, until the market crashes of the 1920s and 30s showed what happens when financial information goes unverified. The regulatory response, mandatory audit, independence standards, accreditation, audit committee governance, took decades but was inevitable. ESG disclosure is in an analogous position now: the volume of non-financial information companies produce is enormous and growing, and the infrastructure that makes financial audit credible has not been systematically applied to it.

Fewer than 30% of FTSE 350 companies have a formal non-financial assurance programme covering more than one domain, and most of the rest default to a single provider handling both advisory and assurance work, a combination that would be prohibited outright under financial audit independence standards. The firm that advised on your CSRD implementation cannot credibly assure the report it helped produce. That is standard market practice today, and most boards aren't aware it's happening.

A real non-financial audit function looks like the financial audit programme it's modelled on: map the full assurance universe (ESG report assurance, GHG verification, certifications, ratings submission review, environmental claims review), appoint providers on independence principles rather than convenience, coordinate the evidence base across engagements instead of letting each provider start from scratch, and govern the whole thing at board level with the same seriousness financial audit findings get. Organisations that build this deliberately, before regulation forces the issue, end up with something coherent and cost-efficient. The ones that wait assemble it in a panic, from whoever is available.