CSRD Directive: Who is the 'sustainability auditor'?

On 10 June 2024, the Council of Ministers approved the legislative decree for the transposition of Directive 2022/2464/EU, known as Corporate Sustainability Reporting Directive (CSRD), which introduces new rules on corporate Sustainability Reporting and updates national legislation. The CSRD expands the obligations under the previous Non Financial Reporting Directive (NFRD) 2014/95/EU, which only applied to large companies with at least 500 employees. Now, SMEs (excluding micro-companies) and branches of non-European companies with at least 150 million revenues generated in the EU will also have to comply. The companies will have to prepare a standardised and homogeneous document at European level, included in the management report, describing the impact of their activities, including those of subsidiaries and the entire supply chain, thus broadening the scope of responsibilities.

The Council of Ministers has therefore preliminarily approved the draft decree for the transposition of the CSRD directive, which imposes obligations in the area of corporate sustainability reporting. The text, accompanied by the explanatory and technical report, is now awaiting parliamentary opinion. Member States will have to transpose the CSRD by 6 July 2024. This approval follows the conclusion of the public consultation period on the draft decree and introduces a new figure, that of the 'sustainability auditor'. The explanatory report accompanying the draft decree, defines the 'sustainability auditor' as "the statutory auditor registered in the Register and also qualified to perform the assurance activity of sustainability reporting."

The Draft Decree delegated for the transposition of the 2022/2464/EU "Corporate Sustainability Reporting Directive" (CSRD), whose approval process should be completed by July 2024, regulates in Article 8 the "attestation on the compliance of sustainability reporting". The CSRD thus requires that the sustainability reporting of companies be certified by an appointed party, the so-called 'sustainability auditor'. According to the draft decree, companies can engage a statutory auditor or auditing company for this attestation. This auditor can be the same person as the company's statutory auditor or another person, as long as he or she is entered in the register of statutory auditors and approved for the attestation of sustainability reporting.

Article 8 of the draft Decree stipulates that the sustainability auditor must be licensed in accordance with Legislative Decree 39/2010 and be appointed separately from the statutory audit of the company. This role entails specific responsibilities. The draft introduces a new Article 14-bis into Legislative Decree 39/2010, which requires the auditor to express in the report his or her conclusions on the conformity of the reporting to the relevant standards. It is also specified that the sustainability auditor may or may not coincide with the company's statutory auditor. An auditing company may take on the role of sustainability auditor, but the compliance report must be signed by a sustainability auditor, who is responsible for verifying the correct reporting of a company's positive and negative impacts.

A transitional regulation is provided for in order to avoid discontinuity in compliance attestation services for the companies concerned. The attestation assignments of the previous "non-financial statement", conferred pursuant to Article 3, paragraph 10, Legislative Decree 254/2016, shall remain valid until the agreed expiry date, with the possibility of early termination. Furthermore, the compliance statement must be drafted in accordance with the assurance principles adopted by the European Commission by 1 October 2026. In the meantime, the Decree draft provides for the development of national standards with the cooperation of authorities, industry associations and professional bodies and adopted by the MEF, after consultation with the Consob, on the basis of the same agreements already in place for the development of statutory auditing standards. Until the adoption of such standards, Consob may indicate the attestation standards to be used and regulate the terms of engagement by regulation.

The Article 9 of the illustrative report accompanying the decree draft, on the other hand, 'regulates the professional requirements necessary to carry out the activity of assurance and the related qualification procedures, providing, in line with European legislation, for a simplified transitional regime for auditors registered in the register by 1 January 2026. It also regulates the procedures for conferring the assurance engagement, distinguishing according to whether or not the audited entity is a public interest entity or an entity subject to an intermediate regime, the procedures for carrying out the engagement through the applicable principles of assurance, ethics and independence, as well as the contents of the report certifying the conformity of the sustainability report with the regulatory framework of reference."

The Article 10 of the explanatory report states that the directors are responsible for ensuring that the sustainability reporting complies with the decree, while the auditing body must supervise compliance and report to the shareholders' meeting in the annual report. On the other hand, the Consob has the power to apply administrative sanctions for violations, with a maximum limit of EUR 150,000 for the first two years, except for violations that constitute a crime. For minor violations, sanctions may include a public declaration or an order to eliminate the violation. In determining the sanctions, Consob considers 'not only the procedures adopted by the administrative body to prepare the sustainability report, but also whether it comes from third parties, be they subsidiaries or companies included in the value chain'.