Embedding ESG

and sustainability
considerations
into the Three
Lines Model
 Contents

Introduction | 3

Executive Summary | 4

1 The Three Lines Model: A timely update | 5

2 The relationship between governance and future-proof

businesses | 7

3 Embedding sustainability and ESG considerations into business

practices | 9

4 The Three Lines Model: Roles and sustainability responsibilities | 14

5 Recommendations and key questions | 20

WBCSD & IIA – Embedding ESG and sustainability considerations into the Three Lines Model 2
Introduction
The world faces three main are growing in importance. In 2021, the World Business
global challenges: There is no net-zero without Council for Sustainable
the climate emergency, nature.2 When we speak with Development (WBCSD) and The
the loss of nature and CEOs and CFOs, the question IIA established a collaboration to
is no longer if they should act, leverage each organization’s
growing inequality. Each
but how and if their businesses knowledge and expertise.
of these challenges poses should be part of the solution.
a threat to business, and For this, organizations need to The resulting collaborative
the events of the past embed practical and credible guidance:
two years— a global approaches into their business
pandemic, geopolitical models and across their 1. Considers how
supply chains.2 It is critical that environmental, social and
instability, continued
material sustainability issues governance (ESG)-related
extreme weather events risks and opportunities
and the biodiversity crisis are embedded into business
decision-making processes and should be embedded into
— have demonstrated the Three Lines processes
that governance mechanisms
the increasing to ensure efficient and
are in place to ensure effective
interconnectivity of our oversight of risk management effective risk management
operating environment. and controls. and internal oversight; and

There is a pressing need for In 2020, The Institute of Internal 2. Offers practical suggestions
a mindset shift within the Auditors (IIA) updated the and examples for integrating
business community to address Three Lines Model to include sustainability considerations
these challenges, build more a principles-based approach into the key roles and
resilience and future-proof that adapts to organizational responsibilities within the
organizations.1 Stakeholders’ needs.3 The model is grounded Three Lines.
expectations on businesses in governance and amplifies
are becoming increasingly The intended audience of
the need for robust risk this guidance document
demanding and developments in management and controls as a
the regulatory landscape mean includes corporate boards,
fundamental part of governance. C-suite representatives
that business needs to respond It helps organizations to identify
with an actionable and practical within large corporations,
the appropriate structures and and senior management
approach. In this volatile and processes that best support
uncertain environment, there is to provide information and
the achievement of business understanding on the role
a need for effective governance objectives to create and protect
structures and processes to of the respective lines in
value for the organization. overseeing the effectiveness
enable the achievement of
objectives, which should include of risk management and
key sustainability topics. internal audit processes.

While climate change remains

firmly on the corporate agenda,
business efforts toward nature-
positive and equitable societies

Rodney Irwin Anthony Pugliese

Chief Operating Officer, President and CEO,
WBCSD The IIA

WBCSD & IIA – Embedding ESG and sustainability considerations into the Three Lines Model 3
Executive Summary
In 2020, The IIA updated the • The governing body The outcome of the
Three Lines Model to guide oversees and establishes materiality assessment—
organizations toward effective governance mechanisms the double-materiality
governance, risk management that integrate the strategic matrix—shapes the ESG
and internal controls. Since its objectives with ESG and risk management strategy
launch, the Three Lines Model sustainability considerations. and helps the other roles
has helped organizations to These governance understand the evolving
identify the appropriate roles mechanisms make the context in which the
that could best support the governing body more aware business operates.
achievement of business and actively involved in the
objectives while creating value company’s ESG reporting • Internal audit, independent
for the organization, and its strategy and the impact of from the governing body
stakeholders. the business operations on and the management,
ESG issues. The governing assures the reliability of
The guidance in this document, body is also in charge of internal control processes
jointly drafted by WBCSD and identifying and engaging for ESG data disclosure and
The IIA, highlights internal and with a variety of reporting.
external factors that are driving stakeholders affected by
the integration of ESG and company operations. Due to the diversity of
sustainability into decision- governance models, roles and
making. It provides suggestions • Management develops organizations, each company
on how to bring these a multi-capital approach should decide how to apply
considerations into the key roles accounting for all the this guidance according to its
and responsibilities outlined financial and non-financial needs, strategic goals, culture,
in the Three Lines Model, capitals that the company resources and business context.
such as the governing body, business model requires to To make this guidance as widely
management (first- and second- ensure the effective applicable as possible, the
line roles) and internal audit. functioning of its operations. recommendations provided
The management also were driven by insights from
According to the revised version oversees the delivery of the 12 companies, practitioners
of the Three Lines Model, materiality assessment, and regulatory bodies, who
presented in this guidance, to which establishes the link participated in interviews that
embed ESG and sustainability between the operations of a have guided the content of this
considerations, all roles need company, their impact on report.
to work together to ensure ESG issues and relevance to
good governance and make the key stakeholders.
business model future-proof.

WBCSD & IIA – Embedding ESG and sustainability considerations into the Three Lines Model 4
 1 The Three Lines Model:
A timely update
The IIA’s Three Lines Model First-line responsibilities It must have assurance from
is recognized globally as a include providing products an objective and independent
critical resource in successful and services to clients or source that what has been
governance. It helps customers in compliance asked has been accomplished.
organizations identify structures with the requirements and Without that assurance, there
and processes to best manage expectations set by the is no governance. The model
risks and achieve objectives, second-line, who provide identifies internal audit as the
including an organization’s oversight, advice and assess board’s source for objective
ESG-related risks. The model and perform risk management internal assurance, independent
establishes the three essential activities, challenging the first of management. The internal
roles that define governance at line where required. These audit function can also play a
its most basic: accountability, roles and responsibilities are key role in supporting external
actions and assurance. It also the fundamental components assurance through their reliance
identifies the three essential of governance supported by and coordination.
players in governance: the a governing body that is truly
governing body, management accountable for the actions it has
and internal audit. asked management to perform.

Figure 1: The Institute of Internal Auditors Three Lines Model

WBCSD & IIA – Embedding ESG and sustainability considerations into the Three Lines Model 5
The Three Lines Model is an to look ahead rather than simply These timely changes enhance
updated and enhanced version reacting to circumstances. It also the model’s value to incorporate
of the well-respected Three underscores how the internal sustainability considerations,
Lines of Defense.3 audit function’s role goes well while guiding businesses toward
beyond identifying concerns and becoming more resilient and
The model was renewed in July encompasses forward-looking future-proof.
2020 to clarify and strengthen advice and consultation on key
some foundational principles, issues.3
expand its scope, and explain
how key organizational roles The current model also better
work together to facilitate illustrates the board’s and
strong governance and risk internal audit’s integral roles in
management. The name change risk considerations and how all
reflects a clarified focus. Instead three lines interact. It includes
of acting as a purely defensive an updated concept of risk and
tool—as the old name might better defines responsibilities of
have implied—the model is management, internal audit and
intended to reflect how an those charged with governance
organization’s structures and and their interactions.
processes should be designed

WBCSD & IIA – Embedding ESG and sustainability considerations into the Three Lines Model 6
 2 The relationship between
governance and future-
proof businesses
In 2021, WBCSD updated Vision Having a purpose and business At the same time, business
2050, which sets a framework model that demonstrates a models need to reflect and
for action towards a world in company’s contribution to account for a company’s risk to
which more than 9 billion people people, profit and planet means and from ESG-related issues,
can live well, within planetary that boardroom decision-making adopting a double materiality
boundaries, by mid-century.a can support the long-term approach (non-financial
This vision is still within reach, success of the organization.7 reporting in addition to financial
but we have to act faster and, in reporting - see Figure 2).9 To
the decade ahead, all businesses The Three Lines Model helps achieve this, companies need to
need to embed sustainability organizations consider the consider the changes required
into all aspects of their systems, roles needed for effective within their existing business
processes and practices to turn governance and management processes to better embed ESG
this vision into reality. of material ESG topics as well as into their operations.
broader sustainability reporting.
Governance is one of It encourages a deeper In the context of the Three
those key processes where understanding of these roles Lines Model, this means that
significant evolution is required. and how they work with each all roles are working together
Governance is defined as the other to support organizational to collectively contribute to the
set of processes that ensure success. Organizations can creation and protection of value
the overall effectiveness of an better determine the most when they are aligned with each
organization,4 and it must include appropriate structures for other and with the prioritized
oversight of risk management, their own needs, applying the interests of stakeholders.
controls and disclosure. In the model in conjunction with their The transition to a future-proof
context of Vision 2050, however, particular considerations— business will require new natural
it must include governance goals, circumstances, culture, resource relationships as part
of ESG-related issues, as resources—as the foundation of the business model. Nature
well as broader sustainability necessary to manage risk. must be considered alongside
considerations. climate, and should be seen as
To make a business resilient business critical when it comes
Effective governance builds and future-proof, those risks to managing risks and identifying
stakeholders’ confidence and need to be managed against a opportunities for long-term
trust that a company’s decisions, continually evolving backdrop. equitable and sustainable
actions, and outcomes can A future-proof business growth.
address priorities and achieve strategy8 connects to scientific
the organization’s corporate and social consensus on Understanding these ESG-
purpose.5 The purpose of progress towards a net-zero related risks and opportunities
business is defined by Professor and nature-positive economy. will require companies to have
Colin Mayer as ”to produce An inclusive approach robust internal and external
profitable solutions to the that considers value to all relationships and to ensure that
problems of people and planet, stakeholders is fundamental the quality of those relationships
and not to profit from producing to a company’s social license supports a business in its value
problems for people or planet.”6 to operate. Failing to take into creation process. This guidance
account ESG-related risks will support companies in this
and opportunities may impact process, and illustrates how to
an organization‘s strategic embed sustainability and ESG
resilience. considerations into business
practices.

a “
Living well” means that everyone’s dignity and rights are respected, basic needs are met, and equal opportunities are available for all.
And “within planetary boundaries” means that global warming is stabilized at no more than +1.5°C, and natural systems are protected, restored,
and used sustainably. It also means that societies have developed sufficient adaptive capacity to build and maintain resilience in a healthy and
regenerative Earth system.

WBCSD & IIA – Embedding ESG and sustainability considerations into the Three Lines Model 7
Figure 2: Double materiality perspective

MATERIALITY

DOUBLE MATERIALITY

Double materiality perspective is an extension of the key accounting concept of materiality. The double materiality concept
proposes that companies should consider reporting on sustainability issues (e.g. climate-related information, where they may affect
the financial performance of the company AND information should be reported for an understanding the external impacts of the
company).

Source: Graphic adapted from “Double materiality: what is it and why does it matter”, Grantham Research Institute on Climate
Change and the Environment, April 2021.10

WBCSD & IIA – Embedding ESG and sustainability considerations into the Three Lines Model 8
 3 Embedding sustainability
and ESG considerations
into business practices
Sustainability presupposes an The interviews highlighted 1. Corporate culture
inside-out lens as it describes several factors that contribute to & behavior change
how organizations impact the extent to which a company
society and the environment. integrates ESG and sustainability Corporate culture refers to
Sustainability is used as an considerations in its decision- the set of beliefs, behaviors
umbrella term for how an making processes. These factors and business practices that
organization can operate within are discussed in the following altogether establish how an
environmental thresholds sections of the report and organization engages with
and planetary boundaries. include: external actors, manages
Sustainability initiatives can outside business transactions,
include a company’s efforts 1. Corporate culture and and defines its attitudes towards
to reduce its impact while behavior change ESG-related risks.13
creating value on the external
environment (e.g., responsible 2. The maturity of an Corporate purpose and culture
sourcing or regenerative organization are equally important, as
agriculture). they show leadership while
3. The evolving regulatory characterizing the extent to
Environmental, social and voluntary disclosure which the leadership values
and governance (ESG) landscape and remunerates ESG
considerations presuppose an performance within the
4. Net-zero and nature-positive operations of an organization.
outside-in focus on how ESG commitments
issues (e.g., climate change) Changing an established
impact the company and its 5. Pressure from investors and corporate culture can be
value by posing new risks, other stakeholders challenging from a governance
threats and opportunities. perspective as it involves
ESG considerations are data- 6. Trust and reputation reviewing consolidated
driven and inform stakeholders behaviors across different
on the value of a company Embedding ESG and corporate roles and levels.
by quantifying the impact sustainability considerations
of ESG issues on financial into business practices is Insights from the interviews
performance.11 ESG is used also an opportunity. Leading highlight that there are both
when considering ESG-related companies have now realized internal and external drivers
risks and the integration of these that acting on nature is a chance that can ensure the behavioral
material topics into key business to win trust with customers, civil change necessary to develop
processes. society and investors. Major a corporate culture rewarding
investors are also pledging to ESG performance.b
To understand how ESG and eliminate deforestation from their
sustainability considerations portfolios by 2025; nature action
are currently embedded into demonstrates mitigation against
business practices and the roles significant risk exposure and
set out in the Three Lines Model, lowers the cost of capital.12
WBCSD and The IIA conducted a
series of interviews with leading
companies and experts. The
insights from these interviews
are included throughout this
report and have informed the
recommendations for
companies to evolve their
processes.
b
There are several behavioral change models available for organizations to implement. The most common push factors (resources, and internal and
external triggers) are inspired by: Crawford Hollingworth and Liz Barker, “Behavioural Change Models: An overview of the two best behavioural change
models and how to apply them”, The Behavioural Architects, 2020.

WBCSD & IIA – Embedding ESG and sustainability considerations into the Three Lines Model 9
Internally, the push towards These push factors, internal The interviews that we
behavioral change can be a top- and external, are not mutually conducted with companies
down or a bottom-up process. It exclusive but can lead to the provided interesting
is a top-down process when the desired behavioral change perspectives on
governing body directly leads supporting a corporate culture maturity levels:
the integration of ESG linked to ESG performance. The
and sustainability considerations governing body can ensure that 1. According to some
as part of the corporate the corporate culture includes organizations, there is a
strategy. For example, when an practices, resources and perceived risk of first-mover
organization acknowledges that processes allowing management disadvantage in integrating
climate change is a key risk for to challenge the status quo, ESG and sustainability
its operations, managing material highlight new ESG-related risk issues into governance, risk
ESG issues becomes part of trends and ensure relevant skills, management and disclosure.
the corporate strategy, and competencies and transfer of For example, disclosure of
sustainability part of the culture knowhow within an organization. impacts and dependencies
of the company. on sustainability factors
2. Maturity of an organization could present threats to
The behavioral change process competitive advantage.
can be bottom-up, however, For many companies, The extent to which
when management first- and embedding sustainability and companies choose to
second- line roles highlight ESG considerations within pursue these opportunities
new and emerging ESG-related their organizations presents and mitigate risks will largely
risks and opportunities that both a challenge and an be determined by the
should become part of the opportunity. This means that corporate culture.
corporate strategy. For example, often companies are at different
an organization might take a levels of maturity when it comes 2. For complex organization
proactive approach to identifying to integrated business practices. structures, for example
ESG-related risks rather than This maturity can be measured, organizations operating
reacting and managing them as for example, by identifying where across different regions
they occur. Management has a responsibility and accountability and sectors with multiple
role to play here in developing for sustainability sits within the business units, ESG and
and implementing the necessary organization,4 the alignment sustainability integration
processes. between ESG material topics requires more complex
and risk factors14 (See Figure 3), governance processes
Externally, pressure can come quality of ESG disclosure15 as and resources. More granular
from various sources, as outlined well as governance mechanisms ESG disclosure and the skills
in the following sections. and processes to oversee to prioritize ESG-related risks
These factors external to the and manage this integration.7 will vary depending on the
organizations continue to drive local contexts.
the need for behavior change
within the organization, ultimately 3. For companies that are
resulting in a corporate culture more advanced on their
that values and promotes sustainability journey,
sustainability and ESG being a first-mover on
considerations. ESG disclosure was seen
as less of a concern because
integrated strategies,
governance processes
and other internal decision-
making systems were in
place to ensure confidence
and reliability of any ESG
disclosure.16

WBCSD & IIA – Embedding ESG and sustainability considerations into the Three Lines Model 10
Figure 3: The level of alignment between sustainability disclosures and risk factors is one way to assess
the level of ESG integration

Source: Sustainability and Enterprise Risk Management: the first step towards integration. Full text available here

3. The evolving regulatory (EFRAG), has issued interim opportunities to understand their
and voluntary disclosure drafts for public consultation on short, medium and long-term
landscape European sustainability reporting value creation.
standards.20
The 10-fold increase in In addition to climate-related
ESG reporting requirements Much of this activity draws on financial disclosures, there
between 1992 and 2017 has, the existing work of voluntary is strong market momentum
unsurprisingly, led to calls from reporting organizations such towards including “nature
businesses and investors as the Task Force on Climate- positive” in corporate
alike for greater alignment Related Financial Disclosures disclosures through the work
and consolidation of the ESG (TCFD), the Sustainability of the Taskforce on Nature-
reporting space.17 These calls Accounting Standards Board, related Financial Disclosures
for consistency and alignment the Global Reporting Initiative (TNFD). The TNFD’s beta
have been heeded by global and others. framework requires disclosure
standards setters. In the past of businesses’ nature-related
few months, the International These new mandatory reporting risks and opportunities using
Sustainability Standards Board standards are being driven by the same four pillar approach
has issued two exposure draft the increasing recognition by as the TCFD – governance,
standards for consultation,18 regulators and others for the strategy, risk management and
the United States Securities need to build a common ground metric & targets – that has been
and Exchange Commission for disclosure to ensure effective widely accepted and adopted by
(SEC) has issued a proposed communications of ESG-relevant business and financial markets.21
climate disclosure rule,19 and information between corporates
the European Commission, and investors. Capital markets
through delegated responsibility need decision-useful and reliable
to the European Financial information around companies’
Reporting Advisory Group strategic sustainability risks and

WBCSD & IIA – Embedding ESG and sustainability considerations into the Three Lines Model 11
4. Net-zero and nature- These increasing levels of The board has a critical role to
positive commitments scrutiny mean that it will not play in challenging management
be sufficient to make net-zero and should encourage the
Against this evolving regulatory commitments in isolation. integration of financial and
landscape and the shifting Companies need to consider non-financial information so that
operating environment, how to embed action on stakeholders can be provided
businesses are under pressure climate and nature into their with investment grade data. But
to set net-zero and nature- business practices and drive the board in its oversight role
positive commitments. action down their supply should look beyond the views
For example, WBCSD updated chains. Commitments must of shareholders and consider
its membership conditions in be supported by coherent its responsibility to understand
2021 to require members to set strategies with interim stakeholder views firsthand
an ambition to reach net-zero targets to measure progress. to better inform boardroom
greenhouse gas emissions Governance structures and decision-making.25
no later than 2050 and create board responsibilities will need to
ambitious, science-informed be reconfigured to include more Research conducted by
goals that contribute to nature/ complex ESG information and WBCSD and DNV highlighted
biodiversity recovery by 2050.22 corporate ESG disclosures will that corporate culture is one
need to be transparent and have of the key barriers to effective
The United Nations Race to Zero high levels of external assurance. stakeholder engagement,
campaign also urges companies as in many organizations the
to commit to science-based 5. Pressure from investors governing body does not consult
emissions-reductions targets, & other stakeholders directly with a diverse pool of
but net zero commitments stakeholders or does not engage
will not be achieved without In his 2022 letter to CEOs, with them at all. Management
factoring in action on nature, BlackRock Chairman and CEO can support the governing
too. A total of 70% of net-zero Larry Fink focused on investment body in this task; for instance,
goals from governments and considerations when he said, by establishing governance
businesses are considered “We focus on sustainability not mechanisms to formalize
unachievable without ending because we’re environmentalists, operational relationships
deforestation23 within the but because we are capitalists between the governing body
decade and protecting the and fiduciaries to our clients.”26 and groups of stakeholders.29
marine life that absorbs up to
30%24 of global carbon today. The demand from investors is 6. Trust & reputation
At COP26, the launch of the clear. In a recent PwC Investor
Glasgow Climate Pact saw all Survey, 79% of respondents Building and maintaining
parties agreeing to focus on highlighted ESG risks and trust and confidence with
driving action across climate opportunities as an important stakeholders is necessary
mitigation, adaptation, finance factor in decision-making, to ensure that business and
and collaboration.25 In parallel, but only 33% believe that the investor decision-making
over 100 leaders reaffirmed current quality of reporting is can rely upon the information
their commitment to sustainable on average good.27 Ceres has exchanges that take place.
land use, and the conservation, urged corporate boards “to In Deloitte’s 2022 CxO
protection, sustainable systematically and explicitly Sustainability Report: The
management and restoration of oversee environmental, social Disconnect Between Ambition
forests and other ecosystems.25 and governance (ESG) risks in and Impactc, 97% of
order to keep their businesses respondents said their
resilient in the face of growing companies had been negatively
global climate and water affected by climate change,
crises.”28 including about half who saw
impacts on operations such as
disruptions to business models
and supply networks.

c
Full text available at: https://www2.deloitte.com/global/en/pages/operations/articles/deloitte-cxo-sustainability-report.
html?id=mt:2or:3pr:4cxosurvey2022:GC1000053:6oper:20220118:pressrelease

WBCSD & IIA – Embedding ESG and sustainability considerations into the Three Lines Model 12
They also reported feeling In its 2019 ruling in Marchand, in some cases directors,
pressure to act on sustainability the Delaware Supreme Court particularly on climate
concerns from a variety of referred back to the pivotal change matters and net-zero
stakeholders, such as regulators, Caremark case, stating that, commitments, but also supply
shareholders, consumers, and “If Caremark means anything, chain and human rights issues,
employees. The broad and it is that a corporate board must and informal ESG disputes
complex nature of sustainability make a good faith effort to on disclosed information and
topics means that organizations exercise its duty of care. allegations of greenwashing.30
need to raise awareness A failure to make that effort
and build capacity to ensure constitutes a breach of duty Addressing sustainability is
that multiple departments of loyalty.”d no longer a “nice to have”, it is
understand how the business a critical business issue that
could be impacted. Failure to uphold the board’s should be rolled into the broader
duty of care can pose a wide corporate governance, risk
Board members’ personal variety of risks for not only the management, disclosure and
liability is another important organization but also for boards, accountability frameworks of the
consideration that underscores a risk that directors should be company. It is thus imperative
the urgency in this area. aware of. that directors understand the
nature of their fiduciary duties
There continues to be an and take advice in circumstances
increase in ESG-related litigation where they are in doubt.7
against both companies and

d
Marchand v. Barnhill, 2019 WL 2509617 (Del. June 18, 2019)

WBCSD & IIA – Embedding ESG and sustainability considerations into the Three Lines Model 13
 4 The Three Lines Model:
Roles and sustainability
responsibilities
The Three Lines Model This section considers Within the Three Lines
identifies clear processes and how sustainability and ESG Model, ESG and sustainability
roles to guide organizations considerations can be integrated considerations can be integrated
towards good governance. An and embedded across the three as described in the visualization
organization that relies on good roles outlined in the model: below.
governance can identify, assess governing body, management,
and prioritize ESG-related risks and internal audit.
to inform decision-making.

Figure 4: Key actions for the Three Lines Model roles in sustainability and ESG considerations

Governing body Management Internal audit

Governing body roles: Management roles: Internal audit roles:

Establish governance Develop multi-capital approach Test internal controls and assure
mechanisms accuracy of ESG data
Undertake materiality
Oversee ESG reporting assessment to inform ESG risk Anticipate ESG disclosure
strategy management regulations

Engage with stakeholders Oversee ESG data quality Interact regularly with other lines
and reporting

All roles, governing body, include sustainability and ESG 1.2 Overseeing ESG reporting
management, and internal audit, considerations; ESG reporting strategy
work in close collaboration to strategy and engagement with
ensure feedback loops. Each role stakeholders. The governing body also has
is described in detail below. responsibilities to oversee the
1.1 Establishing governance ESG reporting strategy, make
1. Role of the governing body: mechanisms that include strategic integrated reporting
governance mechanisms sustainability and ESG decisions and adopt policies
considerations and processes that allow for
The governing body, including strengthened governance
the board of directors, defines Many companies have through risk management and
organizational objectives, as chosen to establish formal internal controls.31
well as appropriate structures governance mechanisms to
and processes for effective oversee sustainability and ESG The governing body has an
governance. The governing considerations. This may be a important role in developing a
body aligns the organizational dedicated committee, narrative around ESG data and
objectives with the ESG issues including members from the indicators in line with the
that stakeholders prioritize, board, or placed under the corporate culture and purpose,
setting the direction and defining responsibility of an existing to signal to stakeholders a
a corporate purpose that committee; for example risk strong commitment to ESG
includes broader sustainability management or audit. There is and sustainability
considerations. Specifically, a relationship between the considerations.
this can be achieved when internal audit function and audit
the governing body oversees committees which presents an
governance mechanisms that opportunity to leverage the
oversight responsibilities.

WBCSD & IIA – Embedding ESG and sustainability considerations into the Three Lines Model 14
Sustainability management has and intersectionality of the groups representing different
the necessary ESG knowledge to stakeholders that are material to local communities whose jobs
integrate the right ESG indicators the organization. rely on the operations of a
into the business strategy and company. Stakeholder groups
convey evolving ESG-related risk 1.3.1 Stakeholder inclusivity: selected under the principles of
trends to the governing body. Diversity between groups inclusivity and intersectionality
allow an organization to have
The Three Lines Model The governing body should a more in-depth look at and
provides clarity on the roles ensure that the pool of understanding of the context in
and responsibilities of the stakeholders is as inclusive which it operates, minimizing and
different parties when it comes as possible. An organization anticipating ESG-related risks.
to executing an integrated should first define and quantify
approach to risk management, the impacts that its operations An effective stakeholder
internal controls, disclosure and have on different ESG issues engagement strategy,
assurance to ensure that value (e.g., climate change, ecosystem coordinated by the governing
is created and protected within degradation, water scarcity) body, paves the way for the
an organization.31 When the and then map dependencies materiality assessment.
governing body understands between each ESG issue
and oversees how the three and one or more groups of 2. Role of the management:
roles can contribute to a concerned stakeholders. developing an integrated
resilient business model, there Mapping these dependencies approach to ESG risk
are clear expectations on how allows the organization to management
each role can contribute to an understand how ESG-related
organization’s external reporting risks can propagate based on Management oversees the
and assurance processes. their level of interconnectedness. achievement of organizational
A stakeholder-inclusive objectives and can include
1.3 Engaging with stakeholders approach may include NGOs, both the first- and second-line
local communities, customers, responsibilities for specific ESG
Compared to other roles, employers and suppliers. tasks. First-line management
management and sustainability roles are directly aligned
departments are traditionally 1.3.2 Stakeholder with the delivery of products,
more engaged with an intersectionality: Diversity services and overall support
organization’s stakeholders.29 within groups to the organization to identify
The relationship between ESG-related issues that the
the governing body and Stakeholder intersectionality operations of an organization
stakeholders may occur can simultaneously encompass affect.
through annual general society, nature capital and
meetings, reports from actors from diverse cultural, Second-line management roles
management or through regional, and socio-economic are responsible for specifically
advisory groups, panels or backgrounds that the operations assisting in ESG-related risk
forums. However, stakeholder of a company directly and management. Second-line
engagement should be indirectly affect.32 roles can focus on certain
a crosscutting activity The intersectionality principle components of ESG-related
that percolates up to the allows the governing body to risk management, such as:
governing body. When the ensure diversity within the same compliance with laws or new
governing body regularly group of stakeholders. ESG disclosure regulations;
engages with stakeholders, internal control; and ESG issues
and vice versa, both have a For instance, when identifying of quality assurance (internal and
mutual understanding of the NGOs impacted by the external).
expectations and the exposure operations of an organization,
of an organization to ESG-related a governing body can include Alternatively, in some
risks. both international NGOs as organizations, second-
well as others advocating line roles may oversee a
The integration of ESG issues for the rights of local broader responsibility for risk
within a sustainable business communities or operating management, such as the
model and a materiality in different socio-economic development of enterprise risk
assessment is therefore environments. In addition, to management (ERM)3 (pp.3-4).
dependent upon stakeholder ensure intersectionality, the
engagement. When engaging governing body can rely on
with stakeholders, the stakeholder and advisory
governing body should be groups, such as trade unions or
aware of both the inclusivity

WBCSD & IIA – Embedding ESG and sustainability considerations into the Three Lines Model 15
Under the Three Lines Model, on stocks and flows of capital 2.2 Developing a materiality
management oversees the (e.g. nature), which in turn will help assessment to inform ESG
following roles: i) developing them to understand risk management
a multi-capital approach; the effectiveness of their
ii) developing a materiality sustainability efforts.34 The materiality assessment
assessment to inform ESG- prioritizes ESG issues against
related risk management; and The IIRC (International Integrated two aspects: 1) importance to
iii) ESG data quality, internal Reporting Council)e developed a stakeholders; and 2) impact on
controls and reporting. 6-capital integrated framework the organization. The double
that helps management in this materiality matrix, the outcome
2.1 Developing a multi-capital task.4 Moving from traditional of the materiality assessment,
approach management processes to is a valuable tool to rank ESG
integrated ESG management issues and priorities in relation
Traditionally, management requires good knowledge of to key operations of the
measures an organization’s management practices and a organization.
value through financial and refreshed mindset based on
economic capital. Financial and integrated thinking. An integrated The more inclusive and diverse
economic capital relates to easily thinking mindset means the pool of stakeholders is, the
quantifiable assets that the that an organization moves more reliable the materiality
organization directly controls. In from a narrow focus on the assessment is in capturing
addition, the growth of financial maximization of financial capitals ESG-related risks, because it
capital can reassure current and assets to basing business helps identify and prioritize ESG
and potential investors on the decisions on the relationships issues in terms of how a risk
stability of an organization. between multiple capitals, both threatens the achievement of
Financial and economic factors tangible and intangible.33 an organization’s strategy and
are not the only flows of capital objectives.4
that management should Adopting an integrated thinking
account for. Many organizations approach can support: The materiality assessment
opt for a multi-capital approach, process will also guide the
which accounts for “the active • An adequate identification of disclosure of ESG data, as
consideration by an organization ESG-related risks it helps to align relevant
of the relationships between its ESG material topics with the
various operating and functional • A deep understanding of the corporate strategy and should
units and the capitals that the macro-context in which the be considered an important
organization uses or affects.”33 organization operates crosscutting tool to which all
roles in the Three Lines Model
Under this multi-capital • The value creation of an (governing body, management,
approach, the management of organization in the short, internal audit) can contribute.
an organization defines, medium, and long term.
quantifies and establishes the
relationships between physical
and intangible capitals that the
business model requires to
ensure the proper functioning of
the operations of an organization
and their impacts on ESG issues.
A multi-capital approach could
also enable a company to assess
their impacts and dependencies

e
Note: In November 2020, the IIRC and the Sustainability Accounting Standards Board announced their intention to merge into a Value Reporting
Foundation which was officially formed in June 2021. In November 2021, the IFRS Foundation has announced the consolidation of the VRF and the
Climate Disclosure Standards Board into the IFRS Foundation. The IFRS maintains the Integrated Reporting Framework under its responsibilities:
https://www.ifrs.org/news-and-events/news/2022/05/integrated-reporting-articulating-a-future-path/

WBCSD & IIA – Embedding ESG and sustainability considerations into the Three Lines Model 16
 Best practices in materiality assessments
Materiality assessments are most effective and meaningful when they:
1. Indicate a clear purpose
2. Articulate time horizons and review cycle
3. Compare results over time
4. Articulate perspectives used
5. Include and consider a thorough analysis of stakeholders
6. Account for divisional and regional differences
7. Score topics on multiple aspects
8. Identify ESG risks associated with each material topic
9. Ensure high-quality information and support assurance

Adapted from: WBCSD, Erasmus School of Economics The Reality of Materiality: Insights from real-
world applications of ESG materiality assessment, 2021. Full text available here

Traditional methods of assessing The interviews confirmed that Some companies have
and prioritizing risks consider good governance practices dedicated sustainability
impact and likelihood criteria, but are critical in overseeing and committees involving
there are alternative quantitative ensuring that management management roles (financial
and qualitative techniques to understands the potential and non-financial), or involve
integrate ESG-related risks impacts of ESG issues and members of the board or internal
so that the most appropriate risks on the achievement of audit to provide oversight and
risk response is implemented. the organizations’ strategic direction on all ESG issues. The
These techniques, such as risk objectives.4 During the presence of these committees
scenario analysis, combine interviews, some participants is usually welcomed by risk
the likelihood of an ESG risk highlighted that this has been management roles, as these
happening with future trends achieved by bringing together meetings allow for regular
or expected environmental different management functions; discussions on ESG issues
developments.35 In addition to for example, having sustainability and their integration within the
ESG scenario analysis, mapping and financial risk management corporate strategy.
the interconnectivities of risks work together to define an
and how they influence each integrated risk management When companies have clear
other gives insights into the strategy, or to set the most procedures to identify, measure,
speed of their impacts, and the appropriate financial and non- control and report ESG-related
diffusion of risks across the financial key performance risks, they can also become
different operations, upstream indicators (KPIs) and key more resilient in volatile
and downstream, that the responsibilities areas (KRA). operating environments.
organization manages.36 For example, business units
may have a more granular
overview of the context in which
the company is operating at
a country level and be able to
identify ESG-related risks and
implement rapid risk responses.
This vital risk information can
roll up to the group level for
inclusion and consideration
in the enterprise-wide risk
management process.

WBCSD & IIA – Embedding ESG and sustainability considerations into the Three Lines Model 17
2.3 ESG data quality reason why companies opt for ESG data disclosure and
and reporting lower levels of external reporting should be a forward-
assurance on their sustainability looking exercise guiding the
The interview participants disclosures. different roles towards ESG
suggested that collecting high- integration, effective risk
quality ESG data can be difficult Ensuring a consistent approach management and stakeholders’
to achieve and the nature of ESG to data collection, reporting engagement. ESG disclosure
issues means that impacts and and disclosure is necessary has to align with the financial
dependencies are often beyond to ensure that information is statements and the sustainability
the operating boundaries of the decision-useful. Understanding report, because different
company. For example, Scope the people, processes and groups of stakeholders will look
3 emissions data may have systems within an organization for coherent and consistent
to be provided by suppliers and how they can be governed information to make informed
or industry averages.37 Some to ensure the validity and decisions.
companies also suggested reliability of data is critical to
a lack of confidence in the improving the quality of ESG
information collected as a information.

Ensuring quality, validity and reliability in ESG data.

When determining which ESG data to use, how to collect and to aggregate them into indicators, it is
important to consider three factors: quality, validity and reliability. This is particularly important for new or
emerging ESG issues or risks. In assessing data quality, validity and reliability the management second-
line should ask the following questions:
1. Are the data of high enough quality to produce reliable results? Are these ESG data measuring what
an organization wants to measure (e.g., Scope 3 emissions, waste produced, electricity generated)
2. Are controls in place for internally collected data? Who oversaw the data collection process?
3. Are the data collected in accordance with an industry standard or an internationally recognized
standard?
4. Are there other open-source secondary data to challenge the model assumptions or triangulate
the results?
Management oversees these processes and may require regular training on ESG data disclosure,
as well as training on the research design of indicators to understand biases and validity issues in
measurement.

Source: COSO-WBCSD, Applying enterprise risk management to ESG-related risks, 2018. Full text
available here.

WBCSD & IIA – Embedding ESG and sustainability considerations into the Three Lines Model 18
3. Role of internal audit The internal audit and regulations, and 5) safeguard
– internal controls and sustainability functions have their assets’ internal control
compliance the opportunity to anticipate across the organization.39
future ESG disclosure trends.
Internal audit is ideally placed For example, internal auditors Internal audit is independent
to help companies evaluate can monitor the evolving from management, to ensure
opportunities, assess changes regulatory landscape and level of its objectivity, authority and
to operations and reporting, harmonization between different credibility. Internal audit provides
meet regulations, and be a regulatory frameworks. independent and objective
catalyst for innovation and assurance and advice on
improvement for sustainability. Internal auditors can also effective governance and ESG
While current practice is varied, test internal controls on ESG risk management processes
internal audit does not routinely disclosure and assure that and structures. The internal
take the lead when it comes to the ESG data are collected audit function should be well-
ESG information. There is an consistently to guarantee resourced and positioned
opportunity for the governing confidence in the data collection to ensure integrity, trust,
body to recognize that internal process. The internal control transparency, compliance
audit can add value to the environment presents clear and accountability. The IIA’s
company and that integration practices to ensure two-way International Professional
with the sustainability function communication and feedback Practices Framework (IPPF)
can move beyond compliance loops between management includes globally recognized
and take a more active and internal audit. The 2013 standards and authoritative
approach to monitoring material COSO Internal Control Integrated guidance that drive high-quality
sustainability topics. Framework39 introduces internal audit work.40
practices to establish an It achieves this through
The internal audit function effective internal control the regular disclosure of
also has close ties to the audit environment, a set of standards, sustainability and financial
committee, which provides processes and structures on reports, guaranteeing disciplined
further opportunity for a which an effective system of data collection processes, and
more integrated approach at internal control relies on. The expertise on ESG indicators.
board-level. In light of evolving internal control environment Internal audit reports its
regulatory developments in the enables organizations to: findings to management and
European Union, (the Directive 1) achieve strategic objectives, the governing body to promote
on corporate sustainability 2) provide reliable financial and and facilitate continuous
reporting, and Directive on non-financial reporting to internal improvement.3
corporate sustainability due and external stakeholders,
diligence) audit committees may 3) conduct their operations
be responsible for “overseeing efficiently and effectively,
sustainability reporting and 4) comply with laws and
related processes to identify
information reported.”38

A well-resourced, appropriately positioned internal audit function is:

1. Accountable to the governing body
2. Free from interference by management in its planning and operations
3. Empowered to access all people, data, and resources needed to undertake its work
4. Free from responsibility for executive decision-making
5. Thoroughly knowledgeable about all aspects of the organization
6. Compliant with the International Standards for the Professional Practice of Internal Auditing

Source: COSO-WBCSD, Applying enterprise risk management to ESG-related risks, 2018.

Full text available at www.wbcsd.org/erm

WBCSD & IIA – Embedding ESG and sustainability considerations into the Three Lines Model 19
 5 Recommendations
and key questions
This table summarizes the recommendations for companies in integrating ESG and sustainability
considerations into the roles set out in the Three Lines Model. The key questions are intended to
stimulate conversation within and between the different roles on the extent that sustainability and ESG
considerations are integrated into existing processes and practices.

GOVERNING BODY MANAGEMENT INTERNAL AUDIT

• Consider a multi-capital • Undertake a materiality • Monitor reliability of ESG data

approach to capital flows assessment that informs collection and internal control
• Undertake stakeholder enterprise risk management processes
engagement to understand processes • Build knowledge of
RECOMMENDATIONS

sustainability impacts and the • Bring sustainability and sustainability and ESG impacts
link with the business model finance functions together of the company
• Consider stakeholder to define integrated risk • Ensure regular interactions
diversity in any stakeholder management strategy between internal auditors and
engagement activities • Establish ESG data quality 1st, 2nd line roles
• Ensure the governing body and reporting alignment with
oversees risk management financial reporting cycles
• Ensure the internal audit
function is well-resourced
(ultimately may reduce costs
of external assurance)

To what extent is the governing How can management capture How can internal audit work
body overseeing ESG integration? and measure the impact of the with external auditors to provide
operations of a company on ESG assurance on the reliability and
How is the governing body currently issues? consistency of information?
engaging with the other functions
on material ESG issues? And what How can management ensure What role can internal audit play in
could be improved? that the ESG data is complete and helping the organization prepare
KEY QUESTIONS TO ASSESS LEVEL OF
ESG/SUSTAINABILITY INTEGRATION

accurate? for non-financial disclosures by

How is information on risks advising and providing assurance
provided to the governing body? How is operational vs strategic on structures, systems and
What are the current obstacles to management assessing and processes for decision-making and
integrating ESG risks? prioritizing ESG risks? reporting?

What role is corporate culture What practices and policies What controls ensure that
playing in the organization? Does it ensure that first- and second- sustainability data is collected,
include ESG issues to achieve long- line management roles have a analyzed and reported in a way that
term sustainability? holistic approach to ESG risk is useful to decision-makers?
management?
What processes and policies are
adopted to measure, monitor
and report on progress towards
company commitments?

How can internal audit advocate for

an organizational shift in mindset
to integrate sustainability into
governance and operations?

WBCSD & IIA – Embedding ESG and sustainability considerations into the Three Lines Model 20
Endnotes
1
WBCSD. WBCSD steps up the 10
‘Double materiality’: what is 18
International Sustainability
course for systemic business it and why does it matter? Standards Board,. IISB
transformation. (2021). Grantham Research Institute delivers proposals that create
on climate change and the comprehensive global baseline
2
WBCSD & WWF. WBCSD and environment https://www.lse. of sustainability disclosures.
WWF join forces to accelerate ac.uk/granthaminstitute/news/ (2022).
business action on nature, with double-materiality-what-is-it-
focus on deforestation and and-why-does-it-matter/.
19
United States Securities and
overfishing. (2022). Exchange Commission. SEC
11
Pollard, D. & Bebbington, Proposes Rules to Enhance
3
The Institute of Internal J. ESG and sustainability – and Standardize Climate-
Auditors. The IIA’s Three Lines different but related ideas. Related Disclosures for
Model: An update of the Three Investors. (2022).
Lines of Defense. https://www. 12
COP26. COP26 roundup:
theiia.org/en/content/position- Investors make commitment 20
European Financial Reporting
papers/2020/the-iias-three- on deforestation. (2021). Advisory Group. Sustainability
lines-model-an-update-of-the- Reporting Standards.
three-lines-of-defense/ (2020).
13
Freeman, R. E., Martin, K.
& Parmar, B. The power of 21
Taskforce for Nature-related
4
COSO & WBCSD. Applying and: responsible business Financial Disclosures. TCFD
enterprise risk management to without trade-offs. (Columbia Beta Framework v0.1. https://
ESG-related risks. https://www. University Press, 2020). tnfd.global/wp-content/
coso.org/Documents/COSO- uploads/2022/03/220321-
WBCSD-ESGERM-Guidance-
14
WBCSD. Sustainability and TNFD-framework-beta-v0.1-
Full.pdf (2018). enterprise risk management: FINAL.pdf (2022).
The first steps towards
5 WBCSD & PwC. Enhancing integration. https://www. 22
WBCSD. WBCSD Membership
the credibility of non-financial wbcsd.org/Archive/Assess- Conditions.
information: the investor and-Manage-Performance/
perspective. https://docs. Resources/Sustainability-and-
23
Jessop, S. UK climate tsar
wbcsd.org/2018/10/WBCSD_ enterprise-risk-management- urges companies to join Race
Enhancing_Credibility_Report. The-first-step-towards- to Zero campaign. Reuters
pdf (2018). integration (2016). (2021).

6 Mayer, C. & Roche, B. Putting 15

Reporting matters 2021:
24
World Economic Forum.
purpose into practice: The Time to Transform. https:// Protecting the ocean is key to
economics of mutuality. (Oxford www.wbcsd.org/rm2021 fighting climate change.
University Press, 2021). (2021). 25
United Nations & UK
7 WBCSD. Board Director 16
WBCSD. ESG Disclosure Government. COP26 The
Resources. Handbook. https://www.wbcsd. Glasgow Climate Pact. https://
org/Programs/Redefining- ukcop26.org/wp-content/
8 WBCSD. Future Proof Business Value/Redesigning-capital- uploads/2021/11/COP26-
Guide. https://www.wbcsd.org/ market-engagement/ Presidency-Outcomes-The-
Programs/Redefining-Value/ Resources/ESG-Disclosure- Climate-Pact.pdf (2021).
What-does-stakeholder- Handbook (2019).
capitalism-mean-for-business/
26
Larry Fink. Letter to CEOs The
Resources/Future-Proof- 17
WBCSD. Insights from the Power of Capitalism. (2022).
Business (2021). Reporting Exchange: ESG
reporting trends. https://
27
PwC. Global Investor Survey.
9 WBCSD. The state of docs.wbcsd.org/2018/02/ https://www.pwc.com/gx/en/
corporate governance in Reporting_Exchange_Report_ services/audit-assurance/
the era of sustainability risks ESG_reporting_trends_2017. corporate-reporting/2021-
and opportunities. https:// pdf (2018). esg-investor-survey.html
www.wbcsd.org/contentwbc/ (2021).
download/6706/112571/1
(2019).

WBCSD & IIA – Embedding ESG and sustainability considerations into the Three Lines Model 21
28
CERES. Running the Risk: 32
Hankivsky, O. Intersectionality. 37
WBCSD & FSR Danish
How Corporate Boards Can The Institute for Auditors. Guidance on
Oversee Environmental, Intersectionality Research & improving the quality of ESG
Social and Governance (ESG) Policy (2014). information for decision-
Issues. https://www.ceres.org/ making Developing a roadmap
resources/reports/running-
33
Council (IIRC), I. I. R. Integrated for companies. https://
risk-how-corporate-boards- Thinking & Strategy State www.wbcsd.org/Programs/
can-oversee-environmental- of play report. https://www. Redefining-Value/Making-
social-and-governance (2019). integratedreporting.org/wp- stakeholder-capitalism-
content/uploads/2020/01/ actionable/Assurance-
29
WBCSD & DNV GL. Boards and Integrated-Thinking-and- Internal-Controls/Resources/
their stakeholders: The state Strategy-State-of-Play- Guidance-on-improving-the-
of play. https://www.wbcsd. Report_2020.pdf (2020). quality-of-ESG-information-
org/Programs/Redefining- for-decision-making (2019).
Value/Making-stakeholder-
34
Natural Capital Coalition.
capitalism-actionable/ Natural Capital Protocol. 38
Accountancy Europe.
Governance-and-Internal- (2016). ESG Governance
Oversight/Resources/Boards- Recommendations for Audit
and-their-stakeholders-The-
35
WBCSD. Climate Scenario Committees. https://www.
state-of-play (2021). Analysis Reference Approach. accountancyeurope.eu/wp-
https://www.wbcsd.org/ content/uploads/220412-
30
Latham and Watkins. Programs/Redefining-Value/ ESG-governance-
ESG Litigation Roadmap. TCFD/Resources/Climate- recommendations-for-audit-
https://www.lw.com/ Scenario-Analysis-Reference- committees.pdf (2022).
thoughtLeadership/ESG- Approach (2022).
litigation-roadmap (2020). 39
COSO. COSO Internal Control
36
WBCSD & KPMG. An Integrated Framework. https://
31
International Federation of enhanced assessment of www.coso.org/Documents/
Accountants & Institute of risks impacting the food and COSO-CROWE-COSO-
Internal Auditors. Executing agriculture sector. https:// Internal-Control-Integrated-
the Board’s Governance www.wbcsd.org/contentwbc/ Framework.pdf (2019).
Responsibility for Integrated download/13750/199446/1
Reporting. https://www.ifac. (2021). 40
The Institute of Internal
org/system/files/publications/ Auditors. International
files/IFAC-IIA-Governance- Professional Practice
Responsibility-for-IR.pdf. Framework.

WBCSD & IIA – Embedding ESG and sustainability considerations into the Three Lines Model 22
DISCLAIMER ABOUT IIA ABOUT WBCSD
This publication is released in Established in 1941, The WBCSD is the premier global,
the name of WBCSD and the Institute of Internal Auditors CEO-led community of over 200
Institute of Internal Auditors. Like (IIA) is an international of the world’s leading sustainable
other WBCSD publications, it is professional association with businesses working collectively
the result of a collaborative effort global headquarters in Lake to accelerate the system
by members of the secretariat Mary, Florida, USA. The IIA is transformations needed for a net
and senior executives from recognized as the internal audit zero, nature positive and more
member companies. This does profession’s leader in standards, equitable future.
not mean, however, that every certification, education,
member company agrees with research, and technical guidance We do this by engaging
every word. throughout the world. Generally, executives and sustainability
members work in internal leaders from business and
ACKNOWLEDGMENTS auditing, risk management, elsewhere to share practical
governance, internal control, insights on the obstacles and
With thanks to 12 WBCSD information technology audit, opportunities we face in tackling
member companies and several education, and security. the integrated climate, nature
IIA volunteers who kindly and inequality sustainability
participated in the research Globally, The IIA has more than challenge; by co-developing
interviews that have guided the 215,000 members in nearly 200 “how-to” CEO-guides from these
content of this report. countries and territories. The insights; by providing science-
IIA in North America comprises based target guidance including
159 chapters serving more standards and protocols; and by
than 70,000 members in the developing tools and platforms
United States, Canada, the to help leading businesses in
Caribbean (Aruba, Bahamas, sustainability drive integrated
Barbados, Cayman Islands, actions to tackle climate, nature
Curacao, Jamaica, Puerto and inequality challenges across
Rico, and Turks & Caicos), sectors and geographical
Bermuda, and Trinidad & Tobago. regions.
The IIA’s Audit Executive Center
This work was funded by the provides chief audit executives Our member companies come
Gordon and Betty Moore relevant and timely thought from all business sectors and all
Foundation’s Conservation leadership and connections to major economies, representing a
and Markets Initiative. peers for benchmarking and combined revenue of more than
sharing best practices. USD $8.5 trillion and 19 million
For more information, employees. Our global network
please visit www.moore.org The IIA has awarded 180,000 of almost 70 national business
Certified Internal Auditor (CIA) councils gives our members
certifications. In addition unparalleled reach across the
to the CIA, The IIA offers globe. Since 1995, WBCSD has
the Certification in Risk been uniquely positioned to
Management Assurance® work with member companies
(CRMA®) and the Qualification in along and across value chains
Internal Audit Leadership® to deliver impactful business
(QIAL®) designations. IIA Quality solutions to the most challenging
Services has helped hundreds of sustainability issues.
organizations in various
industries around the world by Together, we are the leading
providing qualified audit voice of business for
professionals, a global sustainability, united by our vision
benchmarking database, and a of a world where 9+ billion people
repository of successful are living well, within planetary
practices. boundaries, by mid-century.

www.theiia.org www.wbcsd.org

Follow us on Twitter and LinkedIn Follow us on Twitter and LinkedIn

Copyright

Copyright © WBCSD, July 2022.

WBCSD & IIA – Embedding ESG and sustainability considerations into the Three Lines Model 23
World Business Council
for Sustainable Development

Geneva, Amsterdam, Beijing, New Delhi, London, New York City, Singapore

www.wbcsd.org

WBCSD & IIA – Embedding ESG and sustainability considerations into the Three Lines Model 24