Organizations must report myriad information to meet expanding global disclosure requirements and rising quality standards for mandatory and voluntary nonfinancial reporting, such as the EU's Corporate Sustainability Reporting Directive and the US implementation of its climate reporting rules, which is still playing out in court. Failing to do so may result in enforcement actions, shareholder lawsuits, and reputational risk.
To minimize these disclosure-related risks, organizations need effective disclosure processes that are efficient, reliable, and repeatable. General counsel overseeing nonfinancial disclosures -- such as those related to environmental, social, and governance; cybersecurity; and human capital -- should verify that processes for creating disclosures are rigorous and efficient.
For example, if legal and compliance teams spend too much time asking for information they need from internal stakeholders or third parties, find data quality is poor, or lack documentation or governance structures, these are signs that disclosure processes have room for improvement.
GCs wanting to improve such processes must do two things: define disclosure workflows and evaluate the data management technology strategy.
Organizations often have informal disclosure workflows but run into issues when the process lacks documentation. This leads to parties either duplicating efforts or, worse, items being overlooked.
GCs can address this challenge by implementing clear ownership, accountability, and workflows that ensure reliable data collection, management, and quality control. For each disclosure, GCs should document the workflow that includes disclosure requirements, disclosure policies, data collection, data signoff, verification, and reporting.
They also should include the functions and teams with primary responsibility at each stage. Effective cross-functional collaboration is key.
GCs must strengthen their relationships with the chief information officer, chief financial officer, and other relevant partners for each specific disclosure to ensure success. The disclosure workflows should be circulated among data owners, function heads, and internal stakeholders involved at any of the six stages to obtain necessary buy-in.
Another challenge GCs often face is pushback against workflow requests. GCs should assign roles and clearly delineate them to set internal accountability. A good way to do this is with a Responsible, Accountable, Communicated, Informed matrix that delegates responsibilities for each stage of the disclosure process.
When documenting these workflows, GCs also should integrate controls and oversight measures throughout the process to reduce risk of costly reporting errors and minimize time spent addressing issues. Quality measures include staff training on data-quality requirements such as disclosure procedures and data ownership responsibilities, working with audit and finance teams to sub-certify data points, and requiring disclosure committee sign-off.
The functional team with primary responsibility for the disclosure should create and regularly update documentation that includes regulations, information or data requirements, information type, current data location, published instances and inputs, and methodology. This team should revisit the records at a set cadence and as needed when regulations or data sources change. The organization's regulatory intelligence program can incorporate this process.
Data collection is often burdensome because of cross-functional team involvement and the sheer volume of disclosures. Organizations need optimal systems to manage this data collection.
First, GCs should review disclosure data needs and evaluate the workload required to meet them, thinking about whether the organization's current approach is efficient and facilitates verification. If not, work with the CIO to research other options, remembering that the CIO should thoroughly vet any external software vendors for scope, administrative burden, and costs.
Nonfinancial data management and reporting systems can support various data collection methods, including forms-based data entry and batch file import, which can improve efficiency. GCs should understand whether such capabilities are needed and if they would improve data auditability.
If so, GCs should work with the CIO to determine the desired data management capabilities, including data model, key performance indicators, data verification, data governance, and audit trail support -- focusing on vendors experienced in an organization's industry sector who have roadmaps that align with regulatory requirements in the area.
As global disclosure requirements expand and standards for nonfinancial reporting become more complex, GCs should follow these steps to lead their organization's creation of a rigorous process that provides high-quality, trusted information and mitigates the business risks of reporting failures.
This article does not necessarily reflect the opinion of Bloomberg Industry Group, Inc., the publisher of Bloomberg Law and Bloomberg Tax, or its owners.
Alissa Lugo is a senior director, analyst with the legal and compliance group at Gartner.