Getting ready for sustainability assurance

What is assurance readiness?

Assurance readiness is a state in which a company's sustainability information could be assured with few surprises: the scope and criteria are clear, the methods are documented and applied consistently, data can be traced to its source, controls operate, and judgements are explained. Getting there usually takes a year for a first engagement, because some fixes, such as new data collection or controls, need to operate for a full reporting period. See sustainability assurance explained.

Which companies need assurance, and when?

Under the CSRD, as amended by the Omnibus, companies in scope need limited assurance of their sustainability statement, and the Commission must adopt EU limited assurance standards by 1 July 2027. Under California's SB 253, CARB has proposed limited assurance of scope 1 and 2 emissions from 2027 reports, rising to reasonable assurance in 2030, with no assurance needed for the first reports due by 10 November 2026. Several jurisdictions adopting the ISSB standards phase in assurance; Australia moves from limited assurance of some disclosures to reasonable assurance of all climate disclosures by 2030. See the CSRD after the Omnibus and California SB 253.

How should a company prepare for assurance?

1. Agree the scope: which disclosures, which entities, which period, which criteria and which level of assurance.
2. Assess gaps in methods, data, systems and controls against those criteria.
3. Document the materiality assessment, including who was consulted and how thresholds were set.
4. Write down methods, estimates and assumptions, such as in a GHG inventory management plan.
5. Build evidence trails from source documents to each reported figure.
6. Add controls: reconciliations, variance reviews and independent sign-off.
7. Run a readiness assessment or dry run on a prior period or half year.
8. Appoint the provider and agree the timetable alongside the financial audit.

See building a GHG inventory.

Assurance readiness in practice: a readiness assessment

A company facing its first limited assurance engagement on its 2027 sustainability statement commissions a readiness assessment on its 2026 data.

Two areas are not ready. The scope 3 figures rest on a spend-to-category mapping that only one person understands, so the company documents the method and the emission factor versions. There is no independent review of any metric before publication, so it adds a sign-off by the controller's team. Three areas are partly ready and get targeted fixes; two are ready. The company repeats the exercise on half-year data before the first engagement. See the spend-based method and materiality thresholds and scoring.

How should a company choose an assurance provider?

Consider who may provide assurance in each jurisdiction: in the EU, the statutory auditor or another audit firm, or, where a member state allows it, an independent assurance services provider; under SB 253, an independent provider with greenhouse gas expertise. ISSA 5000 can be used by accountants and other providers who meet its quality management and ethics requirements. Check independence, including any consulting the firm has done on the same information, relevant industry and emissions experience, and how the engagement will be coordinated with the financial audit. See ISSA 5000.

What evidence will the provider ask for?

Typically: the reporting criteria and policies; the materiality assessment and its evidence; the GHG inventory management plan; source documents such as invoices, meter readings and payroll extracts; calculation files with version history; reconciliations and review sign-offs; support for estimates and assumptions; board and committee minutes; and the draft statement. Keeping these in one place, named consistently, saves time and fees. See limited and reasonable assurance.

How long does preparation take?

For a first engagement, many companies start about a year before the period-end, so that new controls operate for the whole year, and run a dry run around the half year. The engagement itself runs alongside the financial year-end close, so the sustainability timetable should be fixed early and data owners given firm deadlines. Later years are faster once methods and controls are stable. See GHG verification.

This guide is general information. It is not tax or legal advice for your situation.