How to prepare for the audit
Hand your assurance provider a complete file and answer their questions from evidence you already have.
Introduction
Your DMA is the first thing an assurance provider looks at, because it sets the scope of everything else in your sustainability statement. Limited assurance does not mean the auditor re-runs your assessment: they test whether the process you describe is the process you followed, and whether your conclusions follow from your data.
Almost every question below has an answer that already exists in your report, your Excel export or a note you wrote earlier. The work is collecting it, not producing it.
Plan two conversations, not one. The first after you select your IROs and before you engage stakeholders; the second with the finished report. Thirty minutes at the first checkpoint is the cheapest insurance in the whole process, because anything the auditor disagrees with there can still be fixed. After data collection closes, it cannot.
What your auditor will ask
These are the questions our clients are actually asked, with the evidence that answers them.
| The question | Where the answer is |
|---|---|
| Did you map your value chain, and how? | The methodology section of your DMA report, and the value chain map with the sources it was built from. |
| How are IROs linked to their position in the value chain? | The upstream / own operations / downstream label on every IRO, in the IRO register and the Excel export. |
| How did you determine actual versus potential, and the time horizon? | The labels on each IRO in its passport, with the drivers and sources behind them. |
| How were IROs scored? | How results are calculated, and the full calculation reproduced sheet by sheet in your Excel export. |
| Were silent stakeholders taken into account? | Your engagement plan, the groups you defined, and the topic weights you set per group. |
| Why did you leave out certain subtopics or IROs? | The reason you wrote when you deselected them. This is the question that most often has no answer, so write the reason at the time. |
| Is your stakeholder sample representative? | Response counts per group against the targets in your plan, and the population size of each group. |
| How were conflicting stakeholder views handled? | The weighted average per group and the per-IRO detail in the Excel, which shows the spread behind every score. |
| Who signed off, and on what? | The minutes of the sign-off session and the pre-read you sent with it. |
| Did anything change after you saw the results? | The record of every weight or threshold change and its reason, written into the Discussion section of your report. |
What to hand over
- The Word report. The methodology, the engagement, the results and your decisions, with the document list that the analysis was built on.
- The Excel export. Every answer and every calculation step, from a single response to the final matrix. This is what an auditor uses to re-perform a number.
- Your own notes. Deselection rationales, the engagement plan, the sign-off minutes. These are not generated by Karomia; they are the part of the file that is yours.
Give your auditor access to the platform as a member if they want to look around rather than read exports. They see the same IRO register and results you do.
The member invitation screen, with the role selection, used to give an auditor read access.
What Karomia can do
We join the call with your assurance provider on request and explain the methodology directly, including the scoring formulas, the normalization and how the thresholds are derived. Ask through the in-app chat and we will set it up.
If your auditor asks for something the standard export does not contain, tell us. Several of the columns in the export today exist because an auditor asked for them.
Common findings, and how to avoid them
- No written reason for a deselected IRO or a skipped subtopic. The most frequent gap, and the easiest to prevent. A paragraph at the time is enough; reconstructing it a year later is not credible.
- A topic carried by a single respondent. One answer in one group can make a subtopic material. Check for it while you review your results and either engage more people or record why you accept it.
- A weight changed after the results were seen, with no rationale. Changing weights is legitimate; changing them silently is not. Write down what you changed and why, before you recalculate.
- An IRO added during data collection. It leaves respondents with different question sets and a register that no longer reconciles with the answers. See Review and select IROs.
- Anonymity promised to respondents but broken in the deliverable. Your report never contains names, email addresses or individual scores. If you rebuild tables yourself, keep it that way, and be careful with groups small enough that a single person could be identified.
Before you move on
- The report and the Excel export are final and consistent with each other.
- Every deviation from the calculation has a written reason.
- The sign-off is minuted, with the date and who was present.
- Your auditor has what they need, and you know who answers their follow-up questions.
Output
- A complete assurance file: the Word report, the Excel export and your own notes, consistent with each other.
- An answer, backed by evidence you already have, to each of the questions above.
- A signed-off DMA that sets the scope of your sustainability statement.