Sustainability assurance explained

What is sustainability assurance?

In an assurance engagement, a practitioner gathers evidence about information prepared by a company against criteria, such as the ESRS or the GHG Protocol, and reports a conclusion that increases users' confidence in it. The practitioner may be the company's financial statement auditor, another audit firm or, where the rules allow, a specialist provider. The company remains responsible for the information and for the controls and records behind it. See sustainability reporting explained.

What is the difference between limited and reasonable assurance?

Limited assurance reduces the risk of a wrong conclusion to a level acceptable in the circumstances but higher than in a reasonable assurance engagement. The work focuses on inquiries, analytical procedures and limited testing, and the conclusion is negative: nothing has come to our attention that causes us to believe the information is materially misstated. Reasonable assurance requires an understanding of controls, detailed testing of data and a positive opinion that the information is prepared, in all material respects, in accordance with the criteria. It costs much more and needs systems that can support it. See limited and reasonable assurance compared.

Which standards do assurance providers use?

ISSA 5000, General Requirements for Sustainability Assurance Engagements, issued by the International Auditing and Assurance Standards Board in November 2024, applies to engagements on information for periods beginning on or after 15 December 2026, with early application allowed. It covers limited and reasonable assurance, any topic and any reporting framework, and is profession-agnostic, so providers who are not accountants can use it if they meet its quality and ethics requirements. Until then, many engagements use ISAE 3000 (Revised) and ISAE 3410 for greenhouse gas statements. In the United States, accountants use the AICPA's attestation standards for examinations and reviews, and verifiers often use ISO 14064-3; see GHG verification and ISO 14064-3. IESBA's International Ethics Standards for Sustainability Assurance, issued in January 2025, set independence and ethics rules for all providers, with the same effective date as ISSA 5000. See ISSA 5000 and ISAE 3000 and ISAE 3410.

Sustainability assurance: what a limited assurance engagement finds

A manufacturer's draft scope 1 figure is 2,540 tonnes. The assurance provider sets materiality at 5% of the figure, 127 tonnes, compares each site's emissions with the prior year and production volumes, and traces a sample of fuel and refrigerant records to invoices.

Analytical review shows one depot's diesel emissions doubled with no change in its fleet: the same fuel cards were loaded twice, overstating emissions by 200 tonnes. A sample of maintenance records shows refrigerant top-ups at one plant that were not in the data, adding 100 tonnes. The overstatement alone exceeds materiality, so the provider could not give a clean conclusion on the draft. The company corrects both, reports 2,440 tonnes, and receives an unmodified limited assurance conclusion. It also fixes the data load process and adds refrigerant logs to its monthly checks. See calculating scope 1 and 2 emissions.

What does the CSRD require?

Sustainability statements under the CSRD need limited assurance from the statutory auditor, another audit firm or, where a member state allows, an accredited independent assurance services provider. The Omnibus I Directive removed the planned move to reasonable assurance. The Commission must adopt limited assurance standards by delegated act by 1 July 2027; in January 2026 it asked the Committee of European Auditing Oversight Bodies for advice on EU additions to, and carve-outs from, ISSA 5000 by 30 September 2026. Until EU standards apply, national standards and the CEAOB's 2024 non-binding guidelines are used. See the CSRD after the Omnibus.

What do California and the ISSB require?

California's SB 253 needs no assurance for the first reports due on 10 November 2026. Limited assurance of scope 1 and 2 is planned from 2027 under rules CARB is still finalising, with reasonable assurance from 2030, and CARB has proposed accepting several standards, including ISSA 5000, ISAE 3000 and 3410, the AICPA attestation standards and ISO 14064-3. The ISSB standards do not themselves require assurance; each adopting jurisdiction decides, and several phase it in, starting with limited assurance of emissions. See California SB 253.

How can companies prepare for sustainability assurance?

Treat sustainability data like financial data: document boundaries, methods and emission factors; keep evidence from invoices, meters and suppliers; add reviews and reconciliations to the reporting calendar; and run a readiness assessment with the provider before the first engagement. Internal audit can test the process in advance. See getting ready for sustainability assurance. Clear, consistent boundaries between the sustainability statement and the financial statements also reduce questions. Define each KPI precisely, as in ESG KPIs explained, and check that marketing claims match the reported data; see greenwashing risk.

This guide is general information. It is not tax or legal advice for your situation.