Integrated Management Systems

Key Challenge

Developing integrated managementand internal control systems to ensure alignment of sustainability performance to organizational objectives.

Background

Most jurisdictions with developed capital markets have codes of corporate governance that recommend that an organization maintains a sound system of internal control to safeguard shareholders' investments and the company's assets. Guidance on internal control and risk management is abundant, helping organizations to apply best practice and comply with governance requirements (e.g., The Financial Reporting Council's Guidance on Internal Control - UK, the Committee of Sponsoring Organizations (COSO) of the Treadway Commission guidance on Internal Control, an Integrated Framework, and Enterprise Risk Management, an Integrated Framework - US). Such guidance helps to support similar themes:

• Effective and efficient operations;
• Reliable financial reporting;
• Compliance with standards, laws, and regulations;
• A risk management approach that ensures a thorough and regular evaluation of the nature and extent of the risks to which an organization is exposed.

These internal control frameworks are considered integrated because they should be incorporated by an organization into its normal management and governance processes. It is best not to treat internal control as a separate exercise undertaken to meet regulatory requirements. An integrated internal control framework such as COSO's Internal Control Framework will help organizations to deliver on both business and sustainability objectives, and to ensure reliable internal and external reporting.

A sustainability or (environmental) management system and assessment can complement an internal control system to help an organization:

• Define its sustainability objectives, and ensure their alignment to business objectives;
• Identify sustainability challenges, risks, and opportunities; and
• Ensure that management and operational practices respond to these challenges, risks, and opportunities.

The importance of a sustainability management system applies to all sectors, for example it will be as important to a service based organization as it might be to a manufacturing organization (see Caption 15).

Key Considerations

Management systems to support (a) the integration of sustainable development into an organization's DNA (i.e. way of doing business) and (b) specific activities that support sustainable development, should be incorporated into the organization's overall internal control and management system: Many organizations find that the existence of a number of different management systems on different aspects of sustainability can be confusing, but the key to an effective plan-do-check-act (PDCA) management cycle is to incorporate sustainable development into the day-to-day management and running of an organization. Therefore, although an organization might have identified separate sustainability policies and objectives, each with separate management systems and practices, to ensure that these are delivered, separate sustainability management systems should align both to (a) overall business goals and objectives, and (b) the existing internal control and risk management approach. PDCA cycles can also be central to how an organization manages its sustainability performance. For example, Panasonic evolves its sustainability environmental management by nurturing capable personnel who can lead the implementation of environmental PDCA cycles, the implementation of which are overseen by a central Environmental Working Committee (see page 53 of Matsushita Environmental Data Book 2007). Honda takes a similar approach to ensuring the delivery of its environmental action plans.

Some organizations have felt it important to merge management systems. For example, Sharp's 2007 Social and Environmental report describes their efforts to create accuracy and efficiency with an integrated management system by merging its strategic management system, environmental management system and quality management system. The integrated system operates as part of the strategic management system. In taking this approach, Sharp expects to achieve two benefits: "First, Sharp expects performance improvements and risk reductions in the form of reduced greenhouse gas emissions from business activities, as well as fewer defective goods. Second, by refocusing separate S-EMS (environmental management system) and QMS (quality management system) programs into activities aimed at achieving the same company-wide management objectives, Sharp is able to put its management resources where it needs them the most." Sharp introduced its strategic management system using the balanced scorecard method (see Performance Evaluation and Measurement). The strategic management system breaks down company-wide organizational goals to the level of the individual in order to clarify the objectives of individual employees and specify their levels of achievement. Thus individual employees are evaluated for how well they have contributed to corporate management. The system helps employees make their objectives more practical and to obtain results that are in line with company-wide strategies.

Internal control effectiveness depends on effective governance and risk management: Governance, risk management and internal control are all important instruments in achieving sustainability objectives. Pirelli for example uses a ‘sustainable governance’ approach that integrates sustainability with the various different aspects of company management.  It categorizes governance, internal control and organizational structure as sustainability tools so that they are clearly linked to the long-term viability and success of the company. However, the effectiveness of an internal control system and supporting management systems is rooted in an organization's corporate governance infrastructure and approach to risk management The importance of effective governance was highlighted in a number of interviews captured in IFAC’s report, Internal Control from a Risk-Based Perspective.

John Fraser, Vice-President, Internal Audit and Chief Risk Officer at Hydro One Inc., the largest electricity delivery company in Ontario, Canada stated that, “To me, internal control is just one way of getting enterprise risk management to work. Internal control is a subset of governance and enterprise risk management. I would recommend having good governance and implementing enterprise risk management. The key is good governance.”

Rob Whiteman, Chief Executive, London Borough of Barking and Dagenham, a large suburban and industrial area lying just to the east of London, England Whiteman had to ensure that the whole process of risk management and internal controls were embedded into the governance process. “We have created a Project and Risk Board to ensure that all of our key projects and activities designed to achieve our objectives of customer care, service improvement and community cohesion through regeneration are adequately risk managed and that there are controls in place to deliver them”…. Whiteman also emphasized the importance of an integrated approach with performance management, “Risk management and internal control are part and parcel of effective use of resources and performance. We have therefore integrated risk management and value for money into our balanced scorecard approach to service planning.

Rigorous and useful internal reporting: to management, and external reporting to other stakeholders on environmental issues, can be supported by an Environmental Management System (EMS). EMS standards and certification are well-developed through the International Standards Organization (more so than for social issues). The ISO 14000 family addresses various aspects of environmental management. The first two standards, ISO 14001:2004 and ISO 14004:2004 deal with EMS. ISO 14001:2004 establishes requirements for an EMS, and ISO 14004:2004 gives general EMS guidelines.

The ISO standards covering EMS provide the elements of an effective EMS that (a) can be integrated with other management requirements, and (b) help organizations achieve environmental and economic goals. ISO 14001 is a management tool that enables an organization of any size or type to implement a systematic approach to setting environmental objectives and targets, to achieving them, and to demonstrating their achievement. This standard can be used for certification and/or self-declaration of an organization's EMS, so that the requirements of the standard can be objectively audited.

The standard includes internal audit requirements, so that an organization ensures the conduct of internal audits of the EMS at planned intervals to determine whether it has been properly implemented and maintained. The standard also requires a management review to ensure the continued suitability, adequacy, and effectiveness of the EMS. Many organizations with developed EMS frequently audit their management systems to assess the degree of compliance to ISO14001, but lose sight of whether it continues to be 'fit for purpose,' and whether the right environmental and sustainability risks are being identified and managed. This is particularly the case with ISO14001, as it emphasizes compliance with legal and other requirements for environmental impacts. ISO14001 should also be considered in relation to ISO9001:2000 (Quality Management Systems), and many large organizations expect their supply chain partners to certify against both international standards.

Caption 16 is useful for organizations using, or considering, the EFQM Excellence Model.