What a CSR audit is, how it differs from a social audit, an ESG rating and sustainability assurance, and what GCC companies and their suppliers should expect.
Part of the reading list: ESG ratings, CSR and supply chains
A CSR audit is an independent check of how well a company manages its social responsibility, against a reference that it or its buyer chooses. It tests whether the policies a company publishes on labour, safety, environment, ethics and community are actually applied, with evidence, across the business. It is not a certificate in its own right, it is not an ESG rating, and in the GCC no law requires one. The demand comes from buyers, lenders and boards.
What is a CSR audit?
An assessment of a company’s social responsibility performance against a defined reference, ending in findings and a corrective action plan.
No issuer publishes a standard called “CSR audit”. The term describes the exercise, and the reference decides what kind of audit it is. A company testing its own CSR programme usually audits against the seven core subjects of ISO 26000. A buyer auditing a supplier uses its own code of conduct or an established scheme. Either way the auditor reviews documents, interviews management and workers, walks the site and samples records, then grades each finding and agrees a deadline to close it.
How is a CSR audit different from a social audit, an ESG rating and assurance?
They answer different questions, are done by different people and produce different outputs.
| CSR audit | Social audit | ESG rating | Sustainability assurance | |
|---|---|---|---|---|
| Question | Is the CSR programme real and working across the company? | Are workers at this site treated to the code? | How mature is the sustainability management system, on paper? | Is the reported sustainability information reliable? |
| Scope | Whole company: governance, labour, safety, environment, ethics, community, procurement | One site, mainly labour and health and safety | Policies, actions and reporting across set themes | The figures and statements in a published report |
| Reference | ISO 26000, a buyer code, or a scheme code | SA8000, SMETA, amfori BSCI, RBA | The rater’s methodology, such as EcoVadis | ISSA 5000 and the reporting framework used |
| Who performs it | Independent auditor, or a buyer’s appointed auditor | Accredited or scheme-approved audit firms | The rating agency’s analysts | Professional accountants or other assurance practitioners |
| Output | Findings, grading and corrective action plan | Certificate (SA8000), shared report (SMETA), A to E grade (amfori BSCI) | Score and scorecard, medal where earned | Limited or reasonable assurance conclusion |
The distinction matters when a customer sends a request. “Please share your CSR audit” from a European retailer usually means a social audit report from a recognised scheme. “Please complete your EcoVadis assessment” means a rating. A lender asking for “assured ESG data” means assurance. Sending the wrong document costs weeks.
Which frameworks is a CSR audit built on?
ISO 26000 for the company-wide view, and one of four scheme codes for the workplace.
- ISO 26000:2010 gives guidance on social responsibility across seven core subjects: organizational governance, human rights, labour practices, the environment, fair operating practices, consumer issues, and community involvement and development. It cannot be certified.
- SA8000:2026, from Social Accountability International, replaced SA8000:2014 from 1 January 2026. It is certifiable, only by bodies accredited through SAAS. All new certifications are to the 2026 edition from 1 January 2027, and SA8000:2014 certificates must move across at a recertification audit by 31 May 2029.
- SMETA 7 is the current version of the Sedex audit methodology, revised in 2024. It measures a site against the ETI Base Code, ILO conventions and local law, in two pillars (labour standards, health and safety) or four (adding environment and business ethics). Sedex describes it as a continuous improvement methodology, not a certification.
- amfori BSCI audits against the amfori BSCI Code of Conduct 2021, through 81 questions across 13 performance areas, each rated A to E and combined into an overall grade. It is not a certification.
- RBA Code of Conduct 8.0, in effect since 1 January 2024, covers labour, health and safety, environment, ethics and management systems. It began in electronics and is now used well beyond it. Its Validated Assessment Program is carried out by RBA-approved third-party firms.
What does a CSR audit cover?
Five areas, each tested against records rather than policy statements.
Labour and human rights. Recruitment fees and contracts, passport retention, wages paid on time and in full, working hours and overtime, accommodation, child and young workers, discrimination and harassment, freedom of association, and a grievance channel workers actually use. Where workers are recruited through agencies and housed by the employer, recruitment fees and accommodation are tested closely.
Health and safety. Risk assessments, permits to work, training records, fire safety, incident and near-miss logs, heat stress controls during summer, and whether corrective actions after an incident were closed.
Environment. Permits, waste records and contractor licences, energy and water data, chemical storage, and whether environmental targets have baselines and owners.
Ethics and anti-corruption. An anti-bribery policy that staff can describe, gifts and hospitality registers, conflict of interest declarations, whistleblowing, and data protection.
Community and procurement. How community investment is chosen, approved and measured; whether contributions match what was announced; and whether suppliers are screened against the same code the company is audited on.
Is a CSR audit required in the GCC?
Not in the UAE or Saudi Arabia. CSR is voluntary in both, and governments promote it through funds, platforms and recognition rather than an audit duty.
- UAE. Cabinet Decision No. 79 of 2022 defines social responsibility as a voluntary cash or in-kind contribution to social development. A contribution needs a special decision of the owners setting the percentage, is paid from profits, and must be covered with its beneficiaries in the audited financial statements. That is a financial audit point, not a CSR audit. The Majra National CSR Fund, formed under Cabinet Resolution No. 2 of 2018, verifies CSR projects through its Majra Verified programme.
- Dubai. The Centre for Responsible Business at Dubai Chamber of Commerce, established in 2004, now presents the Dubai Chamber of Commerce ESG Label as its evaluation framework, open to organisations established for at least two years. It replaced the Chamber’s earlier CSR Label; our guide to the ESG Label covers what it assesses and how to apply.
- Saudi Arabia. The Ministry of Human Resources and Social Development runs the National Social Responsibility Platform and launched the third edition of its Corporate Social Responsibility Award in May 2026, assessing both CSR practices and community contributions.
Listed companies face separate sustainability reporting rules, set out in our GCC disclosure guide by country.
Why do GCC suppliers get asked for one?
Because their customers have to show due diligence over their own supply chains.
Multinational buyers in retail, consumer goods, electronics, automotive and energy write supplier codes that require audit rights. A GCC manufacturer, logistics provider or facilities contractor on their approved vendor list will be asked for a scheme audit or a buyer-commissioned audit, and an EcoVadis rating on top. Failing to provide one, or failing to close findings on time, moves a supplier down the list or off it.
How should a company prepare for a CSR audit?
Find out which reference applies, then audit yourself against it first.
- Confirm the reference. Ask the buyer which code or scheme, which pillars, and whether the audit is announced or semi-announced.
- Run a gap assessment. Score yourself against every clause of that reference, using the evidence an auditor would ask for.
- Fix the records. Payroll, timesheets, contracts, training logs, permits, incident logs and supplier screening files carry the audit.
- Prepare people. Supervisors and workers will be interviewed. They need to know the grievance route and their rights, in their own language.
- Close and evidence. Every corrective action needs an owner, a date and proof it was done.
How ESGweise helps
We run pre-assessments against SA8000, SMETA and amfori BSCI criteria, carry out supplier audits commissioned by buyers against their own codes, and take corrective action plans through to verified closure. See social audits. Where the customer request is a rating, we prepare the evidence the methodology credits: see EcoVadis rating support. For companies building the CSR programme an audit will test, see sustainability strategy.
ESGweise does not issue SA8000 certificates or SMETA reports and is not affiliated with any scheme. The official audit stays with the accredited or approved firm.
Related reading
- Social audit standards: SA8000, SMETA and amfori
- ISO 26000 and social responsibility
- CSR, ESG and sustainability compared
- ISO 14064-3, ISAE 3000 and ISSA 5000 compared
Sources
All checked on the issuer’s website on 23 October 2026.
- ISO, ISO 26000 Social responsibility, and Discovering ISO 26000 (ISO, 2018).
- Social Accountability International, SA8000 Standard and SA8000:2026 transition, including SAI Notification 1/2026, Transition Requirements, Issue 2.
- Sedex, SMETA audit.
- amfori, amfori BSCI, amfori BSCI Code of Conduct 2021 and audit rating guide.
- Responsible Business Alliance, Code of Conduct 8.0 and onsite assessments.
- EcoVadis, Ratings.
- IAASB, ISSA 5000.
- UAE Government portal, Corporate social responsibility (updated 2 June 2026), and Majra National CSR Fund, About us.
- Ministry of Economy and Tourism, Companies’ legislations: Cabinet Decision No. 79 of 2022.
- Dubai Chamber of Commerce, Centre for Responsible Business.
- Ministry of Human Resources and Social Development, news on the Corporate Social Responsibility Award 2026 (3 May 2026).
Frequently asked questions
What is a CSR audit?
A CSR audit is an independent assessment of how a company manages its social responsibility: labour and human rights, health and safety, environment, ethics and anti-corruption, and its effect on communities and suppliers. It is measured against a chosen reference, such as the seven core subjects of ISO 26000, a buyer's supplier code of conduct, or a scheme code such as SA8000, SMETA, amfori BSCI or the RBA Code. The output is a findings report with a corrective action plan, or a certificate or grade where a scheme is used.
Is a CSR audit mandatory in the UAE?
No. UAE law treats CSR as voluntary. Cabinet Decision No. 79 of 2022 defines social responsibility as a voluntary cash or in-kind contribution to social development, and the u.ae portal describes it the same way. No federal rule requires a CSR audit. The one audit link is that a company's CSR contribution, approved by a special decision of its owners and paid from profits, must be covered with its beneficiaries in the audited financial statements.
What is the difference between a CSR audit and a social audit?
A social audit is a site-level check of working conditions against a labour code, such as SA8000, SMETA or amfori BSCI, and it is usually commissioned by a buyer for a supplier's factory or warehouse. A CSR audit is wider. It looks at the whole company, adds governance, ethics, environment, community investment and procurement, and can be commissioned by the company itself to test its own CSR programme.
Is EcoVadis a CSR audit?
No. EcoVadis is a rating. The rated company answers a questionnaire and uploads documents, EcoVadis analysts score the evidence across Environment, Labor and Human Rights, Ethics and Sustainable Procurement, and a scorecard from 0 to 100 is published, valid for 12 months. There is normally no site visit and no auditor interviewing workers, which is what separates it from an audit.
Can a company be certified to ISO 26000?
No. ISO 26000:2010 is guidance, not a requirements standard, and ISO states that any offer to certify against it, or claim to be certified, misrepresents its intent and purpose. It is used to structure a CSR audit or self-assessment. Where a certificate is needed for labour conditions, the certifiable route is SA8000:2026, issued by a body accredited through SAAS.