ESG Assurance Requirements: What Applies and How to Prepare

ESG assurance requirements depend on where you report and under which framework. Under the EU’s CSRD, the mandatory baseline is limited assurance by an authorised assurance provider, performed against recognised standards, with directors remaining responsible for the content. Voluntary reporters can choose limited or reasonable assurance. In every case the practical work is the same: make your sustainability data traceable, controlled and documented before an assurance provider arrives. We built Exereco around that preparation work, from ESG reporting software to disclosure training.

Key Takeaways

• ESG assurance is an independent check of sustainability information. It improves credibility but does not certify that a company is sustainable.

• Limited assurance gives lower, still meaningful confidence and a negative-form conclusion. Reasonable assurance needs more evidence and supports a positive opinion.

• CSRD assurance starts as limited assurance, and EU scope and timing have been narrowed by reform, so check the current text and your Member State’s transposition.

• ISSA 5000 is the global standard for sustainability assurance and is open to accountant and non-accountant practitioners.

• Readiness is mostly about data lineage, controls and governance, and you can build it well before the engagement starts.

What ESG assurance is and what it covers

ESG assurance is an independent external check of sustainability information. It may be mandatory or voluntary, and Accountancy Europe notes that it enhances the credibility of the information and supports decision-making. It does not validate a company’s performance as sustainable. The assurance provider tests whether what you reported is reliable, not whether what you did was good.

The scope is flexible. ICAEW says assurance can cover a one-off or recurring ESG report, selected ESG information such as a single metric, or the systems and controls used to prepare the information. Responsibility for the reported information stays with the entity’s directors, whoever signs the assurance report.

A typical engagement follows risk-based planning, execution and reporting. According to the same Accountancy Europe FAQ, the procedures include inquiries, control testing, analysis of documents and transactions, and third-party confirmations. Expect your assurance provider to ask for evidence behind numbers, not just the numbers.

Limited vs reasonable assurance

The level of assurance is the single biggest driver of cost, effort and the wording of the final report.

The distinctions in the table come from ICAEW’s guidance on limited and reasonable assurance. The Canadian Auditing and Assurance Standards Board adds that a limited-assurance report must summarise the procedures performed, which is why a limited report reads as longer and more descriptive than an audit opinion.

“Limited” does not mean light. The Dutch regulator AFM, in its 2026 report on CSRD assurance, says sustainability reporting can still demand extensive work because it includes non-monetary measures, value-chain information, stakeholders, estimates and long-term goals. A limited engagement on scope 3 emissions or a transition plan can take real effort from both sides.

CSRD assurance requirements

Under the CSRD, the assurance opinion on sustainability reporting must be based on a limited assurance engagement from the first year of application. The CEAOB guidelines say the procedures must support a conclusion on whether the reported information is free from material misstatement and addresses the applicable CSRD legal provisions and the EU-mandated reporting framework. They also confirm that limited-assurance procedures are less extensive than reasonable-assurance procedures, so the expected amount of work is lower in comparable circumstances.

Reasonable assurance is no longer the planned destination

The original CSRD envisaged a move from limited to reasonable assurance. According to a law firm summary of the final Omnibus I deal, the Commission’s deadline to adopt limited assurance standards is postponed to 1 July 2027, and the requirement to move toward reasonable assurance standards has been removed. Treat limited assurance as the working assumption for mandatory EU reporting, and read the current legislative text for any later change.

Who is in scope, and from when

Scope has been narrowed. The same summary reports that CSRD reporting now targets EU companies with more than 1,000 employees and more than €450 million net turnover, with separate rules for certain non-EU groups. The Dutch Social and Economic Council’s CSRD questions and answers recalls the original first wave: large public-interest entities for financial years beginning on or after 1 January 2024, with more than 500 employees and either a balance-sheet total above €25 million or net turnover above €50 million. It also cites the later timetable of 2027 for larger EU undertakings and 2028 for qualifying non-EU groups.

National transposition matters too. The CEAOB guidance notes that jurisdictions may apply national standards or pronouncements until EU-level standards are adopted, so read the guidelines alongside your national rules. If you operate in several Member States, check each one rather than assuming a single EU-wide timetable.

What about the UK?

British companies reach the CSRD in two ways: through EU subsidiaries, and through non-EU parent rules for groups with significant EU turnover. A UK company outside those routes has no CSRD assurance duty, but it may still commission voluntary assurance for investors, lenders or customers. For those engagements the same standards and the same readiness work apply.

Sustainability assurance standards

The global reference point is ISSA 5000. The IAASB describes it as a stand-alone standard for sustainability assurance engagements that covers any sustainability topic and information prepared under multiple frameworks. It is profession-agnostic, meaning it can be used by professional accountants and by other assurance practitioners.

Three features matter for preparers:

• Applies at any size. The IAASB implementation guide says ISSA 5000 applies to entities of all sizes and complexity, and to information prepared under any suitable framework or criteria.

• Built on existing standards. The IAASB’s EU-focused FAQ says it incorporates elements of ISAE 3000 (Revised), ISAE 3410 and foundational auditing concepts, while remaining a comprehensive sustainability-specific standard.

• ESRS as criteria. The same FAQ says the ESRS are suitable criteria for ISSA 5000 engagements, because EFRAG develops them under European Commission oversight and with transparent due process.

In other words, the reporting standard tells you what to disclose, and the assurance standard tells the provider how to test it. Your disclosure has to be specific enough to be tested against the criteria.

Who can provide ESG assurance

In the EU, the CSRD assurance role sits with statutory auditors, who Accountancy Europe notes must pass an exam and complete at least eight months of practical training in assurance of annual and consolidated accounts. Member States can also permit other providers, so check your national rules.

Globally, ISSA 5000 supports use by accountant and non-accountant practitioners alike. Jurisdictions then decide who may lead an engagement. Malaysia’s Securities Commission, for instance, proposed in 2025 that accountants and non-accountants may lead engagements if registered and competent. Its proposed requirements include a recognised qualification, six years of audit or assurance experience, two years supervising engagements, a recognised sustainability certification and 20 hours of annual training. It shows how global standards turn into local gatekeeping.

Independence and quality

Independence is non-negotiable. The ethics material from the IESBA, as applied in Australia’s APESB standard, requires independence throughout a sustainability assurance engagement and applies to both limited and reasonable assurance. Firms must identify, evaluate and address threats to independence.

The AFM adds that providers should obtain sufficient appropriate evidence, comply with applicable law and issue an appropriate report, and names capacity, expertise and organisational structure as quality considerations. For you, this means the provider should be independent of the people who prepared the report. A firm that also built your reporting system, or an adviser who wrote your disclosures, creates a threat that has to be assessed and managed.

What assurance providers will ask of you

Assurance cannot compensate for weak processes. ICAEW’s view is that assurance works best alongside strong reporting governance, transparent information and controls, and that it cannot transfer management responsibility. So the readiness work falls on you. Here is a practical sequence.

1. Fix the scope and criteria. Decide which framework (for example the ESRS) and which data points are in scope, and agree the level of assurance. Unclear scope is the most common source of rework.

2. Map every figure to a source. For each disclosed number, record the system or document it came from, who owns it, and how it was calculated. Providers test transactions and documents, so a figure with no trail is a finding.

3. Document methods and estimates. Emission factors, boundaries, conversion rates and assumptions for estimates need written justification. The AFM flags estimates and long-term goals as areas of extra effort.

4. Build controls around data collection. Define review steps, sign-offs and reconciliations, especially for data from suppliers, sites or business units. Control testing is part of a typical engagement.

5. Cover the value chain. Decide how you collect and evidence upstream and downstream information, and where you rely on estimates.

6. Assign governance. Make directors’ responsibility for the report explicit, and brief the board or audit committee before the provider’s fieldwork.

7. Run a dry run. Choose a handful of data points and trace them end to end, as a provider would, before the formal engagement.

8. Check independence early. Confirm that your chosen provider is not conflicted by other work for you, as the independence rules above require.

Treat the governance step seriously. Our guide to governance factors in ESG sets out the risks and opportunities that boards should be tracking, which are the same ones an assurance provider will probe.

Common gaps that slow an engagement

Some problems recur in first-time assurance preparations, and each is avoidable.

• Spreadsheet sprawl. Figures held in many unlinked files make version control and review evidence hard to produce.

• Undefined boundaries. If the reporting boundary differs between the sustainability report and the financial statements, expect questions.

• Narrative without data. Statements about targets or transition plans need support, because the AFM notes that long-term goals add to the work.

• Late data from the value chain. Information arriving after the reporting cut-off leaves no time for review.

• Unclear ownership. Metrics with no named owner stall because nobody can answer the provider’s questions.

A central data platform with audit trails, clear ownership and consistent definitions removes most of these in one move, which is the reasoning behind our own approach to reporting.

How Exereco helps you prepare

Exereco brings sustainability news, ESG advisory and compliance support, training and ESG reporting software together in one platform, with a focus on European and African audiences. For assurance readiness, that means your team can learn the disclosure requirements, structure the data in reporting software, and get advisory support for compliance.

If your team needs to understand what a disclosure must contain before it can be tested, our ESG Disclosure course is a practical start. To discuss reporting software, advisory or training for your organisation, begin at exereco.com.

For teams newer to the subject, the Introduction to ESG and ESG Principles courses give a shared vocabulary, and our article on ESG strategy development shows how strategy connects to what you report.

Choosing the right assurance level and scope

If the law requires assurance, the level is set for you: limited for CSRD. If assurance is voluntary, decide on three factors.

• Audience. Lenders, investors and large customers may expect a particular level or standard. Ask them what they rely on.

• Data maturity. Reasonable assurance needs more extensive evidence, so it fits metrics already under strong controls. Limited assurance suits newer or more estimate-heavy areas.

• Scope. Assuring a few high-stakes metrics, such as greenhouse gas emissions, is a common stepping stone before the whole report. ICAEW confirms that assurance can cover selected information or the systems used to prepare it.

The point of the exercise is trust in your numbers. A well-scoped limited engagement with clean evidence is worth more than a broad one that fails on traceability.

FAQ

What is the difference between limited and reasonable assurance?

Reasonable assurance requires more extensive evidence and supports a positive opinion, with assurance risk reduced to an acceptably low level, though never to zero. Limited assurance uses fewer or different procedures, leaves more residual risk and normally gives a negative-form conclusion. Both give meaningful confidence, at different levels.

Is CSRD assurance limited or reasonable?

CSRD assurance starts as limited assurance. The final Omnibus I deal, as summarised by a law firm, postpones the adoption of limited assurance standards to 1 July 2027 and removes the requirement to move toward reasonable assurance standards. Check the current EU text and your national law for the latest position.

Which standards govern sustainability assurance?

Globally, the IAASB’s ISSA 5000 is the stand-alone standard for sustainability assurance engagements. In the EU, the CEAOB guidelines on limited assurance apply alongside national standards until EU-level standards are adopted. The ESRS can serve as the criteria against which the assurance is performed.

Can a non-accountant provide ESG assurance?

ISSA 5000 is profession-agnostic, so it supports use by accountant and non-accountant practitioners. Who may actually lead an engagement is decided nationally, and for CSRD in the EU the role sits with statutory auditors unless a Member State permits others. Independence and competence requirements apply in every case.

Does assurance mean my company is sustainable?

No. Assurance enhances the credibility of the information you report, but it does not validate the company’s performance as sustainable. Directors remain responsible for the report, and assurance works best alongside strong governance and controls.

Recommended

• ESG Principles

• ESG Proficiency

• ESG Integration

• ESG Disclosure