ESG Assurance Across Global Hospitality

Financial Crime

Regulators have greatly increased enforcement action against money laundering and corruption in hotels and casinos, driven by international standard-setters such as the Financial Action Task Force and domestic authorities like the UK Gambling Commission. Effective anti-money laundering programs depend on a risk-based framework that includes customer due diligence (CDD), transaction monitoring, employee training, and suspicious activity reporting (SAR).

Anti-corruption programs must prohibit bribery, kickbacks, and facilitation payments while maintaining transparent books and records. Many leading hospitality companies are also using AI-enabled transaction monitoring to reduce false positives and identify emerging risk patterns in real time.

Internal audit plays both a preventive and investigative role in addressing these risks. Auditors can determine whether CDD controls are functioning effectively by confirming that the company conducts enhanced reviews of high-risk customers and appropriately obtains source-of-funds evidence. They should also assess the reliability of transaction-monitoring models, evaluating whether system settings identify suspicious behavior without generating excessive false alerts. Moreover, reviewing SAR escalation procedures can help ensure warning signs are investigated and reported promptly.

Environment Stewardship

Hotels are resource-intensive. They use substantial amounts of energy and water, especially in regions facing water stress, and they produce waste streams from food service, day-to-day operations, and construction activity. Water stress occurs when the demand for safe, potable water exceeds the available supply of water or when poor quality restricts its use. Biodiversity risks can also arise through supply chains connected to deforestation and damage to marine ecosystems.

Energy risk is becoming a growing concern as Europe faces volatile gas markets and stricter emissions targets that directly affect operating margins. In response, hotel groups are investing in on-site battery storage, renewable energy purchasing agreements, and smart building technologies to manage costs and reduce exposure to energy price swings.

Internal auditors are now expected to review environmental information with the same discipline as financial data. Their work includes evaluating climate transition risks, such as regulatory compliance costs and energy price fluctuations and confirming that environmental capital investments produce measurable results. To conform with the Greenhouse Gas Protocol Corporate Accounting and Reporting Standard, companies now must provide assurance over Scope 1 and 2 emissions — and increasingly Scope 3. Through independent assurance over environmental metrics, internal audit can support progress toward net-zero emissions ambitions while also reinforcing operational resilience.

Social and Governance

Hospitality is a high-risk sector for forced labor, human trafficking, and the exploitation of migrant workers, particularly where subcontracting models and third-party recruiters are involved. Addressing modern slavery requires both preventive and corrective action, including:

• Targeted frontline training to identify warning signs.
• Multilingual whistleblower channels.
• Strong recruitment controls, supported by effective remediation processes.

Remediation frameworks may include supporting victims, repaying withheld wages, and terminating suppliers that fail to comply, with clear escalation to the board.

Internal audit should review labor law compliance, assess supply chain due diligence, and test whether human rights risk mapping is translated into real operational controls. Auditors should confirm that the organization enforces ethical recruitment standards, has effective supplier onboarding controls, and has accessible channels in place for vulnerable workers to report grievances. In countries with mandatory human rights due diligence requirements, such as the UK Modern Slavery Act, auditors should also consider whether the organization’s public statements accurately reflect remediation efforts and the traceability of the supply chain.

Board-Level ESG Assurance

The European Union’s (EU’s) regulatory framework has transformed hospitality ESG obligations into a broad assurance challenge. The EU Taxonomy, Corporate Sustainability Reporting Directive, European Sustainability Reporting Standards, Corporate Sustainability Due Diligence Directive, and Sustainable Finance Disclosure Regulation make hospitality ESG a core assurance issue, linking disclosures, value-chain accountability, and verified data to financial value creation.

ESG has become a fiduciary responsibility for boards. Failures in ESG oversight can trigger regulatory action, stakeholder claims, and credit-rating deterioration, placing board stewardship at the heart of organizational resilience. In this environment, boards depend on internal audit to embed ESG risk into enterprise risk management and evaluate it with the same discipline it applies to financial and operational risk.

Ultimately, ESG is more than a compliance obligation — it drives competitiveness, resilience, and long-term enterprise value. Hospitality organizations that embrace transparent, auditable ESG reporting are better positioned to secure financing, win the confidence of values-driven investors and guests, and withstand environmental disruption and social instability. With their independence, objectivity, and enterprisewide perspective, internal auditors can help transform ESG from a regulatory requirement into a source of trust, sustainable growth, and enduring board confidence.