CSR audit: how to prepare in 2026?

Updated April 2026 - The expression CSR audit covers several realities. For some companies, this is an internal diagnosis of ESG data. For others, it is preparation for certification of sustainability information. In the cases we review, the difference between a useful audit and a simple inventory often comes down to one thing: the quality of the evidence.

Short answer: an effective CSR audit is not about producing a prettier report, but about verifying that the indicators, calculation methods, governance and supporting documents hold together. In 2026, this is the only truly defensible basis in the face of a publication, an external review or increased demands from customers and financiers.

See also: CSR indicators, Digitalization of companies and The missions of a chartered accountant.

Internal CSR audit

It aims to verify:

• the consistency of indicators;
• the existence of supporting documents;
• the scope of the data;
• production and validation responsibilities;
• the stability of the methods from one period to another.

The legal certification mission

The H2A recalls that the sustainability information certification mission concerns in particular the process of double materiality, the conformity of the information published with the applicable texts and the taxonomy information when it applies. In other words, it is not enough for the figures to be internally consistent: they must also be linked to a clear normative framework.

A serious audit does not stop at a review of tables. It must cover at least five blocks.

1. The perimeter

The first point is knowing what is included and what is not:

• parent company or subsidiaries;
• French or international sites;
• social data only or also environmental and governance data;
• reference year;
• indicators consolidated or not.

Without a precise scope, a CSR audit produces figures that are impossible to compare.

2. Calculation methods

Each indicator must refer to a simple and stable formula. This is often the weak point of SMEs: we know how to measure, but not document the method.

Examples:

• turnover rate;
• absenteeism;
• energy consumption;
• emissions linked to travel;
• share of women among managers;
• work accidents;
• training hours.

3. The audit trail

An ESG number must be able to be linked to proof. This is the heart of the matter:

• invoice;
• HR register;
• ERP export;
• HSE report;
• supplier certificate;
• internal procedure;
• contract or methodological note.

4. Governance

A credible audit must show who decides, who produces, who controls and who validates. In well-organized structures, this chain is clear. In the others, the discrepancies quickly appear at the time of the review.

5. The calendar

The calendar is often underestimated. A CSR report prepared after the accounting close generally arrives too late to be really useful to management.

1. The governance of the system

Who decides? Who collects? Who validates? Without a clear flowchart, ESG data becomes fragile. A good CSR audit often begins with role mapping rather than branding commentary.

2. Calculation methods

Each important indicator must refer to a documented method: formula, unit, sources, scope and consistency check. It is at this stage that the company knows whether its reporting is based on sustainable practices or on historical tinkering.

3. The audit trail

A CSR figure must be able to be linked to proof:

• energy bill;
• HR register;
• HSE report;
• SI extraction;
• internal procedure;
• supplier certificate.

Hayot Expertise Advice: the best preparation for a CSR audit is not a pretty report. It is simple, stable documentation shared between finance, HR, operations and management.

• publish indicators without a written method;
• change the scope from one year to the next without explaining it;
• confuse marketing objectives and auditable data;
• do not archive supporting documents;
• produce the reporting too late in the closing schedule;
• let each service produce its figures without a common rule.

The H2A published on January 20, 2026 an update to its guidelines applicable to the 2026 financial year for the certification of information relating to 2025 data. The H2A also indicates that there is a list of sustainability auditors maintained in its regulatory environment. At the same time, economie.gouv.fr has been reminding us since February 4, 2026 that the Omnibus package changes the CSRD framework.

For a company, this means a very concrete thing: the level of requirements does not drop because the text changes. On the contrary, we must strengthen the method and maintain a file capable of living despite adjustments in scope.

1. Take an initial inventory

List all ESG indicators already monitored, even those that are not published. We often discover discrepancies between finance, HR and operations figures.

2. Classify indicators by sensitivity level

All indicators are not equal. Some are purely internal, others are presented to clients or financiers, and still others may be included in a regulatory publication.

3. Clean up definitions

Simple words sometimes hide different definitions:

• effective;
• full-time equivalent;
• turnover;
• work accident;
• useful consumption;
• direct or indirect emission.

4. Check the evidence

Each sensitive indicator must be able to be traced without reconstituting the file by hand for three days. If the evidence is missing, the indicator must be corrected or removed.

5. Prepare the management comment

A good audit is not just about numbers. It explains deviations, causes and action plans. This is what gives credibility to the approach.

On the ground, blockages often come back to the same places:

• HR data dispersed between several tools;
• energy consumption monitored but not compared to surfaces or volumes;
• responsible purchases declared without supplier proof;
• lack of clear owner for the indicators;
• reporting produced too late to feed into management.

The good news is that these weaknesses are often corrected quickly when the framework is clear. There is no need to industrialize everything at once.

The right time is before closing, not after. A preparatory audit launched early allows you to:

• correct the definitions;
• secure the evidence;
• harmonize the calculations;
• avoid contradictions between services;
• document hypotheses before publication.

CTA: **Prepare a** audit or review of your CSR reporting

An industrial company was already tracking its energy consumption, but without distinguishing between square meters used, seasonality and site changes. The result seemed clean on paper, but the curve was not usable in the management committee.

After resuming the scope and adding a methodological note, the same indicator became readable. This is often what a good CSR audit is: not inventing new figures, but making the right figures reliable.