ISSA 5000: the sustainability assurance standard

What does ISSA 5000 cover?

ISSA 5000 is a stand-alone standard for all sustainability assurance engagements, whether required by law or voluntary, at limited or reasonable assurance, on any topic: emissions, workforce data, governance or a full sustainability statement. It is framework-neutral, so it can be applied to information prepared under the ESRS, IFRS S1 and S2, GRI or company-specific criteria. It replaces ISAE 3410 for greenhouse gas statements, while ISAE 3000 (Revised) continues for other subject matters. See ISAE 3000 and ISAE 3410.

What are the main ISSA 5000 requirements?

• Preconditions: suitable criteria and a rational scope, including how the company decided what to report.
• The company's materiality process: the practitioner understands and evaluates the process the company used to identify reported information, such as its double materiality assessment, without assuring the conclusion itself unless agreed.
• Materiality: set for quantitative and qualitative disclosures, considering users' needs.
• Risk procedures: proportionate to limited or reasonable assurance, with a greater focus on controls for reasonable assurance.
• Estimates and forward-looking information: procedures on methods, assumptions and data.
• Groups and value chain: work on information from components and from value chain partners outside the company's control.
• Using others' work: experts, other practitioners and internal audit.
• Fraud and greenwashing risk, documentation, and clear reporting, including separate conclusions where an engagement covers information at different levels. See greenwashing risk.

ISSA 5000 adoption around the world

Many jurisdictions have adopted ISSA 5000 directly or through a national version.

Australia approved ASSA 5000, its version, in January 2025 for periods from 1 January 2025, alongside a standard phasing in assurance of climate reports. The UK's Financial Reporting Council issued ISSA (UK) 5000 for voluntary use in November 2025. In the EU, the Commission must adopt limited assurance standards by 1 July 2027 and in January 2026 asked the Committee of European Auditing Oversight Bodies for advice on an ISSA 5000-based standard. In Pakistan, ICAP's Assurance Standards and Ethics Board issued a circular in September 2025 on adopting ISSA 5000 and the IESSA. CARB's proposals for SB 253 accept ISSA 5000 for engagements starting on or after 15 December 2026. See sustainability assurance explained.

What is different from ISAE 3000?

ISSA 5000 builds on ISAE 3000 (Revised) and ISAE 3410 but is written for sustainability information. It adds explicit requirements on the company's process for deciding what to report, more guidance on materiality for narrative and forward-looking disclosures, specific procedures for estimates and value chain information, clearer rules for group engagements and for using other practitioners, and reporting suited to statements that mix assured and unassured information. It also applies one standard to all sustainability topics, where practitioners previously combined ISAE 3000 with ISAE 3410 for emissions.

What ethics rules go with ISSA 5000?

IESBA's International Ethics Standards for Sustainability Assurance, issued in January 2025 and effective on the same date as ISSA 5000, set ethics and independence requirements for all sustainability assurance practitioners, accountants or not, including rules for engagements that cover value chain information. ISSA 5000 requires practitioners to follow these or requirements at least as demanding.

How does an engagement under ISSA 5000 run?

The practitioner agrees the scope and criteria, understands the company and its reporting process, evaluates its materiality process, sets materiality, assesses risks, performs procedures on the disclosures most likely to be misstated, considers the work of experts and others, evaluates misstatements, and reports. For limited assurance, the work focuses on inquiry and analytics; for reasonable assurance, it adds controls testing and more detailed evidence. See limited and reasonable assurance.

How should companies prepare for ISSA 5000?

Document the materiality process and its evidence, because the practitioner will evaluate it; build controls over data collection, estimates and value chain information; keep a clear trail from source data to every reported figure; and agree early with the provider which information will be assured and at what level. Groups reporting under several regimes should aim for one engagement that meets the strictest. See running a double materiality assessment.

This guide is general information. It is not tax or legal advice for your situation.