Environmental, social, and governance issues might have dropped down internal audit’s list of priorities as regulators in the United States have backed away from some of the more ambitious ESG initiatives of recent years. But if the regulatory pressures have eased, and the ESG headlines have faded, the underlying risks haven’t disappeared. ESG has become a more fragmented and complicated risk landscape—shaped by a patchwork of state and international requirements, stakeholder expectations, litigation, supply-chain pressures, and the increasingly tangible business consequences of environmental and social issues.
Sustainability assurance is entering a second generation. The first generation focused on disclosures, carbon metrics, governance frameworks, and regulatory compliance. Those areas remain essential and will continue to demand independent assurance by internal audit, regardless of the U.S. Securities and Exchange Commission’s latest rule-making posture. The next generation, however, is different. It focuses on the operational decisions that create sustainability performance in the first place.
Many of tomorrow’s ESG risks will not emerge from inaccurate sustainability reports. They will originate in technology investments, procurement decisions, supplier relationships, marketing practices, and day-to-day operations long before they appear in any disclosure. None of these risks are hypothetical. They already exist in many organizations, yet relatively few appear explicitly on internal audit plans. This is where internal audit can make its greatest contribution, not simply by verifying reported sustainability metrics, but by evaluating the business processes that produce them.
Among the many operational areas where sustainability risks can emerge, the following ten illustrate where internal audit can provide valuable assurance before they become regulatory findings or reputational issues.
1. AI’s Hidden Environmental Footprint
Artificial intelligence is rapidly becoming part of everyday business operations. Organizations are deploying large language models, intelligent automation, predictive analytics, and cloud-based AI solutions to improve productivity and decision-making. What receives far less attention is the environmental cost of these technologies. AI workloads consume significant amounts of electricity and water through the data centers that support them. As AI adoption accelerates, organizations may see higher energy use, larger cloud bills, and a growing environmental footprint without these impacts ever appearing on management dashboards. Internal audit should evaluate whether sustainability considerations have become part of AI governance rather than remaining an afterthought.
Questions for internal audit
- Does management understand the environmental implications of its AI strategy?
- Are sustainability considerations included when selecting AI vendors and cloud providers?
- Is AI governance integrated with the organization’s broader ESG governance?
Key takeaway
AI governance should extend beyond cybersecurity and ethics. Environmental sustainability deserves a place in the discussion.
2. Reverse Logistics: The Forgotten Sustainability Process
Sustainability does not end when a product reaches the customer. Returns, repairs, refurbishment, resale, recycling, and end-of-life disposal all influence environmental performance and resource efficiency. Because these activities span multiple business functions, responsibilities are often fragmented and oversight becomes inconsistent. Internal audit is well placed to assess whether reverse logistics supports both sustainability objectives and operational efficiency.
Questions for internal audit
- Are returned products refurbished, recycled, or responsibly disposed of?
- Are circular economy objectives monitored through meaningful performance indicators?
- Are responsibilities clearly defined across the reverse logistics process?
Key takeaway
In a circular economy, value is created not only when products are sold, but also in how they are recovered.
3. Labor Standards in the Subcontracted Workforce
While internal HR policies generally protect direct, full-time employees, modern operations rely heavily on third-party contractors, outsourced or temporary labor. Because these workers do not appear on standard payroll systems, they are frequently excluded from internal health, safety, and fair labor audits, creating operational blind spots and severe social (the “S” in ESG) exposure.
Questions for internal audit
- Do health, safety, and labor standards apply equally to contingent workers and third-party contractors on company sites?
- How does management monitor working conditions and fair compensation across outsourced operational functions?
- Are whistleblowing channels accessible and protected for non-employee contract staff?
Key takeaway
Social responsibility cannot be outsourced. Workplace risk follows the work, not the employment contract.
4. ESG Risk Doesn’t Stop at Tier-One Suppliers
Many organizations perform sustainability assessments on their direct suppliers. Unfortunately, ESG risk rarely ends there. Environmental violations, human rights concerns, and unethical sourcing frequently occur several tiers deeper within global supply chains. Organizations may know their suppliers well while having very little visibility into subcontractors or raw material sourcing. Internal audit should determine whether supplier due diligence extends beyond immediate contractual relationships.
Questions for internal audit
- Does supplier due diligence extend beyond Tier-One suppliers?
- How does management obtain assurance over higher-risk suppliers further down the supply chain?
- Are high-risk sourcing locations subject to enhanced oversight?
Key takeaway
Knowing your suppliers is no longer enough. Increasingly, organizations must understand their suppliers’ suppliers.
5. Carbon Reduction Projects That Nobody Verifies
Organizations are investing heavily in renewable energy, energy-efficiency initiatives, electrification projects, and other decarbonization programs. These investments are often announced enthusiastically. Far less attention is paid to whether they actually achieve the environmental and financial benefits that justified the investment. Internal audit can provide valuable assurance by evaluating post-implementation performance rather than simply reviewing project approval.
Questions for internal audit
- Were the projected emission reductions achieved?
- Are reported benefits supported by objective evidence?
- Are lessons learned incorporated into future sustainability investments?
Key takeaway
Approving a carbon reduction project is only the beginning. Demonstrating that it delivered measurable results is where assurance becomes valuable.
6. Sustainability Data Quality: Can Management Trust the Numbers?
Every sustainability report depends on data. That data often comes from multiple business units, suppliers, operational systems, spreadsheets, and manual calculations. If those sources are weak, the resulting ESG metrics become difficult to rely on. Many organizations still produce sustainability information using disconnected systems and significant manual intervention. Even when disclosures comply with reporting requirements, poor data quality can undermine management decisions and reduce confidence in reported performance. Internal audit can provide assurance over the controls that support sustainability information.
Questions for internal audit
- Can reported ESG metrics be traced back to reliable source data?
- Are calculations independently reviewed and consistently applied?
- Are manual adjustments appropriately controlled?
Key takeaway
Reliable sustainability reporting begins with reliable sustainability data.
7. Green Procurement Without Verification
Many organizations publish sustainable procurement policies. Far fewer confirm that purchasing decisions actually reflect those commitments. Sustainability criteria may appear prominently in procurement procedures while having little influence over day-to-day buying decisions. Environmentally preferred products may be approved but rarely selected in practice. Internal audit should examine purchasing behavior rather than procurement policies alone.
Questions for internal audit
- Do sustainability criteria influence supplier selection?
- Are environmentally preferred products consistently purchased?
- Do procurement decisions support the organization’s public sustainability commitments?
Key takeaway
Policies do not improve sustainability. Purchasing decisions do.
8. Unverifiable Sustainability Claims
Consumers, investors, and regulators increasingly scrutinize environmental claims such as “100 percent recyclable,” “responsibly sourced,” or “carbon neutral.” These statements often originate in marketing or product development, while the supporting evidence may be incomplete, outdated, or inconsistent. As regulatory attention to greenwashing continues to increase, unsupported claims create legal, regulatory, and reputational risk. Internal audit can evaluate whether effective governance exists over sustainability communications.
Questions for internal audit
- Is every public sustainability claim supported by documented evidence?
- Are claims reviewed before publication?
- Is supporting evidence periodically reassessed?
Key takeaway
Every public sustainability claim should be supported by evidence. If evidence cannot be produced, the claim should not be published.
9. Sustainability in New Product Development
Material selection, packaging, repairability, recyclability, durability, and end-of-life considerations are often established before production begins. Decisions made during product development can influence an organization’s environmental footprint for years to come. Internal audit can provide assurance that sustainability considerations are embedded within product development and stage-gate approval processes rather than being addressed after products reach the market.
Questions for internal audit
- Are sustainability criteria incorporated into new product development and approval processes?
- Are packaging, material selection, and end-of-life impacts evaluated during design?
- Are sustainability objectives considered alongside cost, quality, and customer requirements?
Key takeaway
The most sustainable products are not created after launch. They are designed that way from the beginning.
10. Sustainability Metrics in Incentive and Performance Systems
Organizations often publish ambitious sustainability targets while leaving those targets disconnected from the performance systems that actually drive behavior. Internal audit can examine whether sustainability objectives are translated into measurable performance criteria and whether accountability mechanisms exist beyond the sustainability report.
Questions for internal audit
- Are material sustainability targets reflected in executive incentives?
- Are incentive metrics independently verified?
- Do incentive structures balance short-term financial performance with long-term sustainability objectives?
Key takeaway
What gets measured and rewarded gets managed. Sustainability targets that sit outside incentive systems remain aspirational rather than operational.
Looking Beyond the Sustainability Report
The first generation of ESG assurance focused on disclosures, governance structures, and reported metrics. The next generation should focus on the operational decisions, data, controls, and business processes that create those metrics. Many of tomorrow’s sustainability risks will not first appear in an annual report. They will emerge in technology investments, procurement decisions, supplier relationships, marketing claims, logistics processes, and capital projects. This is where internal audit can make its greatest contribution.
It’s true that U.S. regulators, including the SEC have de-prioritized regulation of ESG reporting. But state regulators and those in other regions, such as the European Union, have not, and some have even upped their vigilance to fill in the gap.
Rather than asking only whether sustainability information is reported accurately, internal auditors should also ask whether sustainability is embedded in the way the organization operates. Organizations that identify these operational risks before regulators, investors, or customers do will strengthen not only compliance, but also resilience, credibility, and long-term value. The future of ESG assurance is not simply auditing sustainability reports. It is auditing the business processes that make sustainability performance possible. 