ESG Audit and Assurance Standards for Sustainability Reports

ESG audit and assurance for sustainability reports is moving from voluntary, inconsistent arrangements to mandated, standardized engagements. ISSA 5000 anchors that structural shift, while jurisdictional rules determine who must obtain assurance and on what terms. Compliance readiness therefore depends on understanding the assurance level, defining the scope, and selecting a qualified provider, rather than simply commissioning an independent opinion.

Why sustainability assurance is no longer optional

Most large companies that report sustainability information now obtain some level of independent assurance, and participation has grown substantially since 2019. Investors, regulators, procurement teams, and supply-chain partners use ESG disclosures more and more to make decisions. Unsupported claims create exposure beyond the reporting team. Inaccurate or inconsistent disclosures bring reputational, regulatory, and legal risks, particularly where they raise concerns about greenwashing. ERM CVS describes assurance as “rapidly becoming an expectation rather than a differentiator”.

Assurance gives those users an independent way to judge how much they can trust the information. A qualified practitioner examines sustainability-related information, including ESG metrics, climate data, and methodologies, before issuing a formal conclusion. The work also looks at how companies report, their internal controls, the evidence behind their claims, and their data management systems. It is not simply a review of published wording. As that work becomes a compliance obligation, the profession has built a dedicated standard to anchor it.

What limited and reasonable assurance actually mean in practice

Limited assurance involves a narrower set of procedures and gives its conclusion in negative form. The practitioner “is not aware of any material modifications needed”, rather than affirming that the information is fairly stated. This generally makes the engagement less costly and less intrusive, but the conclusion is also less definitive. Its wording sets a boundary on stakeholder reliance.

Reasonable assurance calls for comprehensive audit procedures and a close, critical look at the source documentation. The conclusion is positive, affirming that “the information is fairly stated”. It represents the highest level of verification, but the appropriate level depends on the engagement’s requirements. The two conclusions are not interchangeable in practice. Regulators, investors, and counterparties need to distinguish them when interpreting an assurance report, while also considering which information the opinion actually covers.

The old patchwork: how assurance was done before a dedicated standard existed

ISAE 3000 (Revised) was the main standard used for sustainability assurance before there was a standard built for that work. It was a general assurance standard, so practitioners had to adapt financial-audit logic to ESG data. Sustainability consultants and certification bodies offered other ways to do the work through specialist frameworks. These providers often worked outside the rules for licensing, independence, and inspection that apply to financial audit firms.

The IAASB-commissioned Leeds University Business School and University of the Witwatersrand study found that a consistent quality baseline was essential for comparable reliance on assurance reports. Audit firms and specialists used different standards, while engagements also differed in scope and procedures. Investors could not reliably compare the resulting opinions across companies and jurisdictions. More voluntary guidance could not provide that common foundation. ISSA 5000 answers the problem with a purpose-built structure for sustainability assurance.

What ISSA 5000 establishes and why it is a structural break from what came before

The International Standard on Sustainability Assurance (ISSA) 5000, General Requirements for Sustainability Assurance Engagements, supersedes the general approach of ISAE 3000 (Revised) with requirements built for sustainability. Its architecture separates the assurance standard from the reporting framework. It can apply to information prepared under GRI, ESRS, IFRS Sustainability Disclosure Standards, or another recognized framework. The framework supplies the reporting criteria. The assurance standard governs the engagement used to evaluate the information against them.

That structure covers environmental, social, and governance information, including climate and greenhouse gas data. It accommodates both limited and reasonable assurance within one coherent standard. It is also profession-agnostic, allowing practitioners who are not professional accountants to use it. Technical expertise is therefore not confined to financial audit. Its provisions address group engagements, value-chain scope, and the entity’s materiality process, including double materiality, bringing sustainability-specific boundaries into the assurance architecture.

The IAASB 2026 Handbook incorporates ISSA 5000 in Volume 3 within its five-volume organization of quality management, auditing, and assurance standards. In January 2025, the IESBA published the International Ethics Standards for Sustainability Assurance (Including International Independence Standards) as a companion standard. That standard addresses conflicts of interest and threats to assurance integrity, including greenwashing. Both standards have a defined implementation horizon. ISSA 5000 applies to periods beginning on or after 15 December 2026, while the companion ethics standard is also effective December 15, 2026.

How CSRD and the Omnibus I changes define the EU's assurance obligation

The Omnibus I package was published in the Official Journal of the European Union on 26 February 2026 and entered into force on 18 March 2026. It substantially narrowed the Corporate Sustainability Reporting Directive’s reach. The original CSRD would have expanded mandatory sustainability disclosures from the comparatively small population covered by the Non-Financial Reporting Directive to tens of thousands of companies worldwide. Under the revised thresholds, the vast majority of those companies fall out of scope. That changes the starting point for compliance planning.

For companies that remain covered, Omnibus I permanently removed the obligation to escalate from limited to reasonable assurance. The Commission now has until July 1, 2027 to adopt limited assurance standards. Its requirement to move toward reasonable assurance standards was removed entirely as a cost-control measure. Limited assurance is now the settled destination under CSRD. For Wave 1 companies already in their second reporting cycle, planning no longer rests on an eventual increase to reasonable assurance.

The scope reduction does not remove the demanding work for companies still covered. Double materiality assessment and limited assurance remain their two most operationally demanding requirements, with European Sustainability Reporting Standards governing disclosures. Global standard-setting and EU legal adoption remain distinct. ISSA 5000 requires EU-specific adaptation before applying to CSRD-mandated engagements, which currently operate under ISAE 3000 (Revised).

The US picture: federal retreat, California law, and SBTi filling the gap

The Federal Register published a formal proposal to rescind the SEC climate rule in June 2026. The rule remains on the books pending final rescission, but none of its requirements currently apply. Its attestation requirements never took effect. As adopted, large accelerated filers would have needed limited assurance over Scope 1 and Scope 2 emissions from fiscal years beginning in 2029, followed by reasonable assurance from 2033.

California SB 253 creates a separate obligation for large companies operating in the state, with assurance requirements phased in from 2027. It is the most concrete operative US assurance requirement. Instead, companies face a fragmented combination of state law and commitments made under voluntary frameworks.

SBTi’s Corporate Net-Zero Standard V2.0, issued in June 2026 and used for validations from February 2027, requires at least limited third-party assurance of base-year emissions for Category A companies. It strongly encourages that assurance for others. ERM CVS supports SB 253 compliance as part of its work across frameworks, illustrating the multiple sources of assurance demand now facing US reporting teams.

Who is qualified to provide sustainability assurance and where provider gaps persist

Audit firms must be licensed, follow independence rules, and undergo regulatory inspection. Specialists often have deeper technical knowledge of GHG accounting, water, occupational safety, and social standards, but may sit outside equivalent oversight structures. Expertise gaps run in both directions. Financial auditors may lack the scientific knowledge needed for biodiversity metrics or GHG protocols, while sustainability specialists may lack familiarity with formal assurance procedures.

The Leeds/Witwatersrand study found that audit firms conducted more than half of sustainability assurance engagements globally in 2023. Co-assurance, where the same firm audits financial statements and sustainability information, has also risen markedly. France, Germany, and Italy show nearly exclusive use of audit firms for sustainability assurance, anticipating mandatory ESRS requirements. Yet provider type alone does not establish technical suitability. ERM CVS illustrates the specialist model, with more than 30 years of experience, ISAE 3000 and ISSA 5000 compliant engagements, and contributions to international assurance standards.

ISSA 5000 and the companion ethics standard establish ethics and independence requirements, but they do not settle jurisdictional permission, provider inspection, or responses to deficient work. Oversight remains fragmented, and capacity adds another constraint. Singapore, Malaysia, Indonesia, and Thailand have enacted mandatory sustainability disclosure, while third-party assurance capability lags years behind. In August 2025, ACRA and SGX RegCo extended the external limited assurance deadline for all listed companies from FY2027 to FY2029, citing varying resources and readiness. A mandate cannot itself supply the practitioners needed to deliver it.

What assurance scope actually covers — and the gap that quality research keeps exposing

The Leeds/Witwatersrand study evaluates assurance quality across three dimensions, namely Nature, Scope, and Extent. Nature covers how the engagement is set up, including the standards it uses, its independence statements, and its assurance level. Scope concerns the boundaries of the work, including systems, disclosures, forward-looking information, and capitals covered. Extent concerns the procedures performed, including controls testing, analytical procedures, substantive testing, and use of subject-matter experts. These dimensions distinguish better execution from broader coverage.

The study found substantial improvements in Nature and Extent between 2015 and 2023, but only marginal improvement in Scope across regions. Limited assurance was still the usual choice even as independence and ethics statements improved. Coverage stayed concentrated on historical environmental data. In 2023, natural capital accounted for nearly half of assured subject matters, while human, manufactured, and social and relationship capital each represented a small minority. The work covered very little financial capital and rarely tested forward-looking information or the systems behind it.

This focus leaves the least assurance where reporting is most complex, including governance disclosures, supply-chain social data, and forward-looking climate targets. ISSA 5000 addresses that gap directly through its provisions on value-chain scope and materiality. Whether practice broadens remains an open question. The standard’s value will depend in part on whether engagements cover more than the historical environmental metrics that have made up most assurance work.

What organizations need to do now to prepare for assurance under the new structure

Before an external assurance engagement, organizations should assess data quality, methodologies, governance, documentation, and internal controls with the rigor of formal assurance work. ERM CVS describes its readiness review as a way to identify weaknesses before they become findings in the final opinion. The decision is whether the reporting process can support the intended conclusion.

Although ISSA 5000 is framework-neutral, CSRD/ESRS, GRI, IFRS Sustainability Disclosures, and SASB impose different disclosure requirements and evidentiary demands. Teams should match technical expertise to the topics being assured, verify independence and oversight, and assess conformity with ISSA 5000 or ISAE 3000 for legacy engagements. Teams should also decide clearly on the scope before work begins. They should clearly define the subject matters, capitals, and organizational boundaries, because the narrowest scope costs less but carries less weight with sophisticated stakeholders.

GHG data is typically the practical starting point, with Scope 1 and 2 verification the most mature category and Scope 3 significantly harder to assure. EU companies still covered by CSRD should prepare for limited-level procedure and documentation expectations, subject to EU adaptation, rather than the removed escalation to reasonable assurance. For US companies subject to SB 253 or the relevant SBTi requirements, limited assurance of GHG data provides the corresponding starting point. Internal capability must support those choices. Training in emissions reporting, carbon accounting, Scope 3 methodology, and ESG internal auditing can bridge the divide between sustainability expertise and audit knowledge, and ERM CVS offers these programs for auditors, verifiers, and sustainability professionals.