Page 563 - COSO Guidance

1. Governance and culture for ESG-related risks

Voluntary responsibilities
In addition to an entity’s regulatory requirements, management and
the board should be aware of any voluntary codes or obligations The Reporting Exchange
undertaken or signed by the entity. This may also include any In partnership with CDSB and
sustainability, human rights, natural resource, supply chain and Ecodesk, WBCSD launched
commodity, privacy or environmental policies, or statements that a the Reporting Exchange
company approves. Some of these commitments are made at the CEO (reportingexchange.com) in
level (such as the UN Global Compact or PRI) and, while voluntary, 2017. It is the global resource
constitute a commitment to which an entity may be held accountable. for corporate sustainability
Companies that do not uphold the principles or requirements may reporting, with requirements
be exposed to reputational damage and scrutiny from shareholders, from over 60 countries.
customers, NGOs or communities. See Appendix III for some of the
commonly adopted voluntary frameworks and commitments.
There is also a multitude of voluntary sector-, issue- or geography-specific codes or standards that an entity
may choose to follow. For example, apparel companies that engage suppliers from Bangladesh may choose
to participate in the Bangladesh Accord, which targets building safety and working conditions of factories in
the region. Similarly, entities that are members of the Roundtable on Sustainable Palm Oil (RSPO) commit
15
16
themselves to advancing the production, procurement, finance and use of sustainable palm oil products. For the
seafood sector, the Marine Stewardship Council (MSC) and the Aquaculture Stewardship Council (ASC) provide
18
17
standards and certification for environmental sustainability and social responsibility for aquaculture producers,
seafood processors, retail and food-service companies, scientists, conservation groups and consumers.
Embedding ESG awareness in the entity’s culture

The COSO ERM Framework defines culture as the “attitudes, behaviors and understanding about risk, both
positive and negative, that influence the decisions of management and personnel and reflect the mission, vision
and core values of the organization.” Taken together, the mission, vision, core values and strategy describe
19
why an entity exists, who it is, what it intends to do and how it intends to do it. These elements provide insight,
20
offer motivation and point the way forward as the entity grows and achieves its goals. As such, embedding
ESG elements into the mission, vision and core values may help to cultivate a culture that exhibits “ESG
conscious” behaviors and decisions.

Stora Enso,a global leader in providing renewable solutions for packaging, biomaterials, wooden

constructions and paper, has demonstrated the importance of corporate governance for integrating
sustainability into ERM. Stora Enso’s stated purpose of “Do Good for the People and the Planet” embodies
21
the importance of sustainability. Sustainability is fundamental to the investor proposition and strategy.
Further, it is integral to decision-making across all of Stora Enso’s operations and activities such as the
production and sales of renewable products, buying trees from local forest owners, selling electricity
generated at its mills and managing its logistics on a global scale. 22,d

Specific events, such as leadership changes, mergers and acquisitions,
lessons learned from unforeseen incidents, negative publicity from NGO Guidance
campaigns, investigative journalism or consumer pressure on ESG issues,
may be a catalyst for change in culture. These events may challenge Consider opportunities for
or threaten the existing culture and provide an opportunity for the embedding ESG in the
organization to modify or strengthen its culture. entity’s culture and
core values

. . . . . . . . . . . . . . . .
d A full case study is available at wbcsd.org. (WBCSD (2017). “Stora Enso: A governance model and culture that enables enterprise risk management and
sustainability integration.”)
16 Enterprise Risk Management | Applying enterprise risk management to environmental, social and governance-related risks • October 2018