Limited and reasonable assurance

What is the difference between limited and reasonable assurance?

In both, the practitioner obtains evidence about whether sustainability information is free from material misstatement against criteria such as the ESRS, IFRS S2 or the GHG Protocol, and both require independence, professional scepticism and materiality. The difference is the level of assurance and so the extent of the work. In a reasonable assurance engagement, the practitioner reduces engagement risk to an acceptably low level and gives a positive opinion. In a limited assurance engagement, the risk is reduced to a level acceptable in the circumstances but higher, and the conclusion states only that nothing has come to its attention that causes it to believe the information is materially misstated. See sustainability assurance explained.

How does the work differ?

Under ISSA 5000, a limited assurance practitioner identifies the disclosures where material misstatements are likely to arise and designs procedures to address them, while a reasonable assurance practitioner identifies and assesses risks at the level of individual assertions, such as completeness and accuracy, and responds to each. Limited assurance requires an understanding of the reporting process; reasonable assurance requires an understanding of the relevant controls, and the practitioner usually tests their operation where it plans to rely on them. Reasonable assurance also uses larger samples, more external evidence, site visits and recalculation, and its findings must be resolved to a higher standard before an opinion is given. See ISSA 5000.

Limited and reasonable assurance: the same emissions data

A manufacturer reports scope 1 and 2 emissions from twelve sites. The same figures could be assured at either level; the work would look like this.

Suppose analytics show that one site's gas use rose 30% while production was flat. In a limited engagement, the practitioner asks why, and is told a new boiler was commissioned and an old one kept running for three months; it checks that explanation against a maintenance log and, if consistent, moves on. In a reasonable engagement, the practitioner also traces the meter readings to the gas supplier's invoices for every month, tests the control over meter data entry, and recalculates the site's emissions. The extra work explains much of the difference in cost and time, and it requires the company to keep evidence it may not have needed before.

How do the reports read?

A limited assurance report gives a negative-form conclusion. It says, in substance: based on the procedures performed and evidence obtained, nothing has come to our attention that causes us to believe that the information is not prepared, in all material respects, in accordance with the criteria. It describes the procedures, so readers can see how far the work went. A reasonable assurance report says: in our opinion, the information is prepared, in all material respects, in accordance with the criteria. Both can be modified where the practitioner finds a material misstatement or cannot obtain enough evidence. Engagements on periods beginning before 15 December 2026 usually follow ISAE 3000 and ISAE 3410.

Where is each level required?

The CSRD requires limited assurance; the Omnibus I Directive removed the planned move to reasonable assurance, and the Commission must adopt EU limited assurance standards by 1 July 2027. Under California's SB 253, CARB has proposed limited assurance of scope 1 and 2 from 2027, rising to reasonable assurance by 2030, as the law foresees; first reports due on 10 November 2026 need none. Singapore requires limited assurance of scope 1 and 2 for listed companies from 2029, Japan plans assurance a year after each wave of mandatory SSBJ reporting, starting with specified information, and Pakistan requires assurance from the second year. Financial statement audits are always reasonable assurance. See the CSRD after the Omnibus, who must report under SB 253 and ISSB adoption by country.

How can companies prepare for reasonable assurance?

Treat the step up as a project of several years: document controls over data collection and calculation, assign owners, keep source evidence for every site and supplier, reconcile emissions to energy invoices and production, and run a dry-run reasonable assurance engagement or internal audit review a year ahead; see getting ready for sustainability assurance. Companies that already have strong limited assurance results usually find their scope 1 and 2 data closest to ready, while scope 3 and qualitative disclosures take longer. See calculating scope 1 and 2 emissions.

This guide is general information. It is not tax or legal advice for your situation.