CSRD Sustainability Audit: What to Take Away from the H2A Guidelines?

As the first CSRD sustainability reports need to be finalized by January 2025, the Haute Autorité de l’Audit (H2A) published its guidelines on October 2, 2024, regarding the certification mission of the published information.

Pending the publication of the European standard, they aim to guide French verifiers in carrying out their mission. In this article, we shed light on the scope and main steps of this sustainability audit!

Effective from January 1, 2024, the CSRD (Corporate Sustainability Reporting Directive) enhances and harmonizes the disclosure of environmental, social, and governance (ESG) information by large European companies and listed SMEs.

The aim is notably to facilitate the analysis and understanding of the data published by financial players in order to encourage investments towards sustainable activities and thus accelerate the low-carbon transition.

💡 Note : The CSRD directive was transposed in France by Ordinance No.2023-1142 of December 6, 2023 and implementing decrees No.2023-1394 and No.2924-60. 

To ensure the reliability of the information published, the CSRD directive requires that the sustainability report be subject to verification by an authorized verifier. This sustainability audit should notably allow verification that the reports faithfully reflect the company's performance and actions in terms of sustainability.

The directive provides that this certification mission can be carried out by:

• Either by the auditor certifying the company's accounts
• Or by an authorized auditor registered with the H2A
• Or by an independent third-party organization (ITO) accredited by the French Accreditation Committee (COFRAC)

🔎 Focus : The choice of verifier(s) is left to the discretion of the company.

The certification mission must comply with a European standard that is expected to be published by October 1, 2026 at the latest. In the meantime, the H2A guidelines published on October 2, 2024 apply to the first sustainability audits that must be conducted starting in 2025.

💡 Note : These guidelines update an initial version published in June 2023 to adapt to the entry into force of several important texts since that date:

> The first set of ESRS standards (European Sustainability Reporting Standards), published on July 31, 2023

> The transposition texts into French law of the CSRD directive, end of 2023

> The CEAOB guidelines (Committee of European Oversight Bodies) adopted on September 30, 2024

It is important to note that due to their transitional nature, the scope of these guidelines is limited. They indeed define the expectations for sustainability audits that will be conducted for the first entities subject to them in 2025.

1️⃣ Axes of the certification mission

The general regulatory framework of the sustainability information certification mission is established in articles L821-54 and L822-24 of the Commercial Code (created by the transposition ordinance of the CSRD directive).

These articles establish the four axes of the certification mission:

1. Verify the compliance of double materiality analysis with ESRS standards and the obligation to consult the social and economic committee (SEC) when the company is subject to it
2. Verify the compliance of the sustainability information published in the management report with ESRS standards
3. Verify the compliance of the information tagging (XBRL format) with the European standard (not yet published)
4. Verify the compliance with the publication requirements of information published in accordance with the “Taxonomy” framework

💡 Note : Since the European standard on information tagging in terms of sustainability has not yet been published, the H2A guidelines only cover axes no. 1, no. 2, and no. 4 of the certification mission.

2️⃣ Required level of assurance

It is important to remember that the certification mission must currently be carried out within the framework of limited assurance.

As explained by the CSRD directive, “the conclusion of a limited assurance mission is generally expressed in a negative form”. In other words, the auditor states that there is no evidence that would have led them to conclude that the report contains material inaccuracies.

💡 Note: The CSRD directive provides for a progressive strengthening of the required assurance level. Indeed, as of no later than October 1, 2028, companies will be required to have their report verified on the basis of a reasonable assurance mission.

The H2A guidelines revisit the various aspects of the certification mission and provide a number of details on the main elements examined by the verifier.

1️⃣ Steps prior to verification work

Prior to the commencement of verification work, the auditor must familiarize themselves with the entity and its environment. This is an essential phase that allows the verifier to “collect elements enabling them to define (...) the scope of verifications to be carried out in order to issue their report.”

The auditor must, in particular, become acquainted with the company's sector of activity, its characteristics, and its understanding of the legal and regulatory requirements concerning the sustainability report.

Based on the various elements collected, the verifier then plans their work (nature, scope of verifications to be carried out, number of hours of work required, etc.). This information is recorded in a mission plan and a work program.

2️⃣ Control of compliance of the double materiality analysis with ESRS standards

H2A specifies that verifiers are not practically expected to “duplicate” the double materiality analysis but to assess that it has been properly implemented in accordance with what the ESRS standards require.

The auditor must pay particular attention to the following points:

• The identification and evaluation by the company of its significant impacts on the environment and society (environmental and social materiality)
• The correct identification by the company of risks and opportunities related to ESG issues that may affect its financial performance (financial materiality)
• The relevance of the criteria used to identify and prioritize its risks and opportunities. These criteria must be adapted to its value chain and stakeholders
• The use of robust methods based on reliable data
• The integration of the double materiality analysis into the company's overall strategy

3️⃣ Control of compliance with ESRS sustainability information standards

This second aspect of the certification mission requires the auditor to ensure that the published information is clearly identifiable and meets the characteristics of relevance, faithful representation, verifiability, and understandability established by the ESRS standards.

However, given the volume of information, the verifier must only specifically verify certain of this information. The exercise of their professional judgment should thus enable them to select:

• Information that, in their view, presents a significant risk of non-compliance with regulatory provisions and the characteristics they must meet
• Information for which there are, in their view, strong user expectations

🔎 Focus : To verify this information, the verifier may use analytical procedures, physical observations, inspections, databases, and even experts when necessary.

As part of this verification, which is conducted under limited assurance, the auditor checks only for the absence of errors, omissions, or inconsistencies that are significant enough to challenge compliance with the ESRS.

4️⃣ Control of compliance with publication requirements of information stipulated by the “Taxonomy” framework.

As a reminder, the European taxonomy (also known as the “green taxonomy”) establishes a classification of economic activities considered “sustainable” from an environmental and societal point of view.

The “Taxonomy” regulation (Article 8) stipulates that all companies subject to CSRD sustainability reporting must include in their declaration information on the extent to which the company's activities can be deemed sustainable in the sense of the taxonomy.

The certification mission is not limited solely to sustainability information but also includes the verification of the absence of errors, omissions, or inconsistencies in the information required under the European taxonomy.

The auditor specifically verifies:

• That the procedures for identifying economic activities cover all the entity's economic activities and comply with the taxonomy requirements
• That the information is presented in accordance with what ESRS 1 standard and the taxonomy framework require

💡 Note : As with the previous axis, the auditor limits his verification to information that, in his view, presents “a significant risk of non-compliance with the taxonomy framework.”

He can use the same procedures as for the verification of sustainability information (physical observations, analytical procedures, etc.).

5️⃣ Preparation of a certification report

At the end of his verification work, the auditor presents the results in a written report intended for the body responsible for deciding on the company's accounts.

This report notably includes, for each axis of the mission:

• A description of the nature of the verifications carried out
• The expression of a compliance opinion, compliance with reservations, or non-compliance
• If applicable, the expression of an impossibility to express an opinion (motivated)

These conclusions may be accompanied by a number of observations deemed useful by the auditor.

Finally, the report also includes a description of the elements that received particular attention from the verifier (for each axis of the mission).

🔎 Focus: Annex III of the H2A guidelines provides verifiers with several certification report templates.

The disclosure of information that is both relevant, comparable, and reliable is an essential requirement of the new sustainability report established by the CSRD.

Choosing a software solution that complies with CSRD expectations like Greenscope allows you to efficiently prepare your company for sustainability audits.

Beyond simplifying the collection and analysis of your ESG data, our platform also allows you to benefit from expert support that will guide you in establishing a sustainability report compliant with new European requirements.