What Happened
HSBC and Deutsche Bank's asset management arm, DWS Group, are facing allegations of greenwashing. The issue isn't that their marketing teams lied, but rather that their sustainability communications evolved separately from the financial controls meant to govern those claims. The problem was organizational design. Sustainability and risk functions optimized for different metrics without a governance structure to align their outputs. This led to public commitments to climate targets that conflicted with internal financial models, both appearing in the same annual reports.
Timeline
2017: The Task Force on Climate-related Financial Disclosures (TCFD) publishes voluntary climate disclosure recommendations. Sustainability claims remain largely in marketing, aspirational and public-facing, but outside the audited financial statement perimeter.
2017-2023: Organizations split into two groups. Some treat TCFD as a signal to redesign measurement infrastructure. Others see it as a communications framework, managing sustainability as a reputational function separate from financial controls.
2023-2024: IFRS S1 and S2 become mandatory in many jurisdictions, pulling sustainability claims into the same audit scope as revenue recognition and internal control over financial reporting. What was voluntary becomes a line item in audited statements.
February 2025: The EU begins modifying portions of the Corporate ESG Reporting Directive (CSRD) before most companies publish their first reports under the original standard. Regulatory uncertainty widens the gap between organizations with robust measurement architecture and those treating disclosure as a filing exercise.
2025 (ongoing): HSBC and DWS face allegations. A survey by the Weinreb Group finds nearly 90% of chief sustainability officers are spending more time on regulatory compliance than two years prior, with reporting lines shifting from strategy toward general counsel.
Which Controls Failed or Were Missing
Governance over Non-Financial Disclosures: There was no mechanism requiring sustainability targets and financial scenario assumptions to reconcile before publication. The sustainability function set public targets, while the treasury function modeled climate risk for balance sheet protection. No one ensured the two matched.
Control Objective Mapping Between Functions: Sustainability disclosures weren't mapped to the same control objectives that govern financial statement assertions. If a company commits to limiting warming, that claim should trigger the same level of documentation, management review, and audit trail as a revenue forecast.
Disclosure Controls and Procedures: Under the Sarbanes-Oxley Act and equivalent frameworks, disclosure controls ensure material information flows to decision-makers before publication. This infrastructure existed for financial metrics but not for sustainability claims, even after those claims became part of the same report.
Ongoing Monitoring of Public Commitments: Once a sustainability claim is public, it creates an ongoing obligation. Controls should track whether operational reality supports the claim, whether assumptions have changed, and whether updates are needed. This monitoring loop was missing.
What the Relevant Standard Requires
IFRS S1 and S2 mandate that sustainability-related financial disclosures receive the same audit treatment as other financial statement components. S1 covers general sustainability-related disclosures; S2 focuses on climate. Both require:
- Material sustainability information to be decision-useful to investors
- Consistency between sustainability metrics and financial statement assumptions
- Disclosure of significant judgments and estimation uncertainty
- Assurance over reported metrics
COSO Internal Control, Integrated Framework doesn't distinguish between financial and non-financial information when it's material to investors. If sustainability claims influence investor decisions, control activities must ensure:
- Information is accurate and complete
- Policies exist and are followed
- Segregation of duties prevents one function from both creating and validating claims
- Monitoring detects deviations before external reporting
AS 2201 requires auditors to obtain sufficient evidence about the design and operating effectiveness of controls over all material disclosures, not just traditional financial metrics. If climate commitments are material, they fall within scope.
The standards don't require perfection. They require a control environment where claims are documented, reviewed, reconciled with other material information, and updated when assumptions change.
Lessons and Action Items for Your Team
Map Your Most Aggressive Public Claim to a Control Owner. Review your last three sustainability reports. Identify the most ambitious commitment. Ask: Who signed off on this claim? What evidence supported it? Who checks if it's still accurate? If "communications drafted it and legal reviewed it" is the answer, there's a gap. The control owner should be in the same function that owns financial statement assertions.
Reconcile Climate Scenarios Across Functions. Your treasury team models climate risk for capital allocation, while your sustainability team models climate impact for public reporting. Compare both sets of assumptions. If they assume different warming trajectories or timelines, you're publishing contradictory material information. The solution isn't to choose one but to build a governance process requiring reconciliation before assumptions go public.
Treat Sustainability Metrics Like Revenue Recognition. Revenue recognition requires transaction documentation, management review, and an audit trail. Apply the same rigor to sustainability claims. If you disclose Scope 3 emissions reductions, document the calculation methodology, identify who reviewed it, and retain evidence. If you can't produce that documentation for a regulator, the claim wasn't controlled.
Close the Loop Between Communications and Compliance. Nearly 90% of chief sustainability officers now spend more time on regulatory compliance, with reporting lines shifting toward general counsel. This isn't a trend to resist; it's recognition that sustainability claims carry legal and financial exposure. If your CSO still reports to marketing or strategy without a formal review path through risk or legal, you're structurally exposed.
Audit Your Disclosure Controls. Sarbanes-Oxley Act Section 302 requires certification that disclosure controls are effective. If sustainability claims are material, they're within scope. Commission a review: Do your disclosure controls capture sustainability metrics? Is there a process for escalating material changes? Can you demonstrate that controls operated effectively over the past reporting period?
Organizations facing allegations today didn't fail because they were uniquely reckless. They failed because they built sustainability as a communications function and added compliance later. Those that built measurement infrastructure first absorbed regulatory shifts as formatting problems. Those that didn't are facing legal challenges.
