Standards and reporting
CSRD assurance
CSRD assurance concerns a defined independent engagement and reporting perimeter, so preparing a clean evidence file is useful but is not the same as obtaining the required opinion.
What is the CSRD assurance task?
The architecture requires a limited-assurance opinion on the relevant sustainability reporting, including the information-identification process and Taxonomy Article 8 reporting CSRD amendments to Accounting Directive Article 34 Regulation 2020/852, Article 8.
Module 01 / 03
Reporting
Identify the statement and applicable criteria.
Module 02 / 03
Process
Retain how reported information was identified.
Module 03 / 03
Evidence
Support the matters within the engagement scope.
Read the detailed guidance and evidence
A populated spreadsheet or a consultancy presentation is preparation rather than the independent assurance opinion.
The sustainability assurance guide explains the wider engagement concepts.
Does CSRD automatically escalate to reasonable assurance?
No: the substantive Omnibus removed the reasonable-assurance standard-setting path and sets the limited-assurance standards deadline at 1 July 2027 Directive 2026/470, Article 1(3) and recital 5.
| Record | Useful distinction | Review question |
|---|---|---|
| Level | The current limited-assurance requirement. | Is an old escalation claim being reused? |
| Standards | The applicable engagement standard and legal route. | Has a future deadline been mistaken for a standard already adopted? |
| Period | The reporting basis and year. | Which requirements actually apply? |
| Conclusion | The engagement report and scope. | Is a broader assurance claim being made? |
Read the detailed guidance and evidence
A 2028 reasonable-assurance promise based on the deleted path is not the current legal sequence.
The Omnibus change map separates the adopted changes and their dates.
Why should scope be agreed before collecting files?
The reporting population, criteria and period determine what the engagement addresses rather than the number of documents uploaded.
Module 01 / 03
Subject matter
Identify the actual reporting set.
Module 02 / 03
Criteria
Name the applicable standards and basis.
Module 03 / 03
Boundaries
Retain entities, period and information covered.
Read the detailed guidance and evidence
In the fictional Redfern Group case, management proposes one assurance label for a package containing a revised statement and an older external data appendix.
Redfern is invented and no real engagement or assurance conclusion is implied.
Its first question is whether the assurance perimeter describes the same package the board intends to publish.
What would the fictional perimeter review find?
Separate the reviewed statement, referenced information and later changes so a reader can understand what was actually subject to the engagement.
| Record | Useful distinction | Review question |
|---|---|---|
| Statement | A specified report version. | Is this the version within scope? |
| Appendix | An external dataset with its own date. | Does the perimeter include it? |
| Later change | A revised metric or narrative. | Was it part of the reviewed package? |
| Public wording | A proposed assured-report label. | Does it match the actual conclusion and scope? |
Read the detailed guidance and evidence
Redfern’s team retains the version record and asks the engagement provider to confirm the perimeter.
A narrow conclusion should not be described as assurance over unrelated information or future performance.
Who may provide the CSRD assurance opinion?
The default and permitted alternatives depend on the Accounting Directive framework and Member State options rather than a universal rule that any adviser may sign Accounting Directive Article 34 as amended by CSRD.
Module 01 / 03
Default
Identify the statutory-auditor route.
Module 02 / 03
Alternatives
Check the applicable Member State options.
Module 03 / 03
Engagement
Confirm the provider’s actual role and scope.
Read the detailed guidance and evidence
The CSRD consultancy guide separates preparation and advisory deliverables from assurance.
Do not infer eligibility solely from a provider’s website label or a software integration.
The applicable national position needs its own verification rather than an EU-wide assumption.
Does ISSA (UK) 5000 automatically become EU law?
A published assurance standard and the legal CSRD engagement requirements are separate questions and need the actual jurisdictional basis recorded.
| Record | Useful distinction | Review question |
|---|---|---|
| ISSA 5000 | The international assurance standard. | What role does it have in this engagement? |
| ISSA (UK) 5000 | The FRC’s UK standard. | Is the UK source being presented as EU law? |
| EU framework | The current legal requirement and applicable standards. | What is actually adopted or permitted? |
| Engagement terms | The agreed criteria and responsibilities. | Are preparation and assurance separated? |
Read the detailed guidance and evidence
The IAASB publication and the FRC’s current standards page identify their respective sources, not a universal legal substitution ISSA 5000 publication FRC assurance standards.
ISSA (UK) 5000’s effective provisions permit earlier application and should not be reduced to an unsupported statement that no engagement may use it yet ISSA (UK) 5000, paragraph 15.
What evidence should management be able to explain?
A useful preparation file links the selected reporting information to sources, methods, decisions and report locations rather than merely accumulating attachments.
Module 01 / 03
Source
Identify the original record and owner.
Module 02 / 03
Method
Retain calculation or interpretation.
Module 03 / 03
Decision
Explain materiality, conditions and relevant limitations.
Read the detailed guidance and evidence
The revised ESRS reporting framework governs the information and its preparation, while the independent engagement evaluates the relevant reporting position ESRS 1 and ESRS 2.
Redfern’s fictional team maps an assurance request to the actual source rather than inventing a new number because the provider asked for evidence.
What should the information-identification file retain?
The assurance perimeter includes the process used to identify reported information, so the preparation file needs more than the final metrics Accounting Directive Article 34.
| Record | Useful distinction | Review question |
|---|---|---|
| Matter | Impact, risk or opportunity assessed. | What led to topic selection? |
| Information | Material answer selected. | Why is it included or omitted? |
| Method | Criteria, sources and judgements. | Can the decision be reconstructed? |
| Review | Challenge and change history. | What remains unresolved? |
Read the detailed guidance and evidence
The materiality assessment guide and template support the management record.
They do not supply an assurance conclusion.
Why must Taxonomy information remain visible?
Taxonomy Article 8 reporting is within the CSRD assurance architecture rather than an unrelated optional appendix Accounting Directive Article 34 Article 8.
Module 01 / 03
Population
Identify the relevant activities and reporting basis.
Module 02 / 03
Evidence
Keep the source supporting the disclosures.
Module 03 / 03
Review
Ensure the engagement perimeter describes the actual information.
Read the detailed guidance and evidence
Redfern’s fictional perimeter review does not drop a Taxonomy section merely because the sustainability narrative is complete.
A report map should distinguish what is addressed, what is cross-referenced and what remains unresolved.
The scope file must precede assumptions about the content population.
What does a useful evidence request register show?
A request register should explain the source and open issue rather than treating every uploaded file as a closed assurance matter.
| Record | Useful distinction | Review question |
|---|---|---|
| Request | The actual information sought. | What question does it address? |
| Source | Record, method and period. | Does it support this answer? |
| Limitation | Uncertainty or missing evidence. | Who must resolve it? |
| Status | Management response and review history. | Has the provider actually concluded? |
Read the detailed guidance and evidence
EFRAG’s supporting datapoints list cannot replace the reporting standard or become an automatic checklist Explanatory note, paragraph 1.
The CSRD readiness checklist develops the operational handover.
Does technical validation mean the report is assured?
No: a system’s validation result is different from the independent assurance conclusion over the defined reporting information.
Module 01 / 03
Validation
Technical consistency within the selected rules.
Module 02 / 03
Preparation
Management’s source and judgement record.
Module 03 / 03
Assurance
The independent engagement and its conclusion.
Read the detailed guidance and evidence
The draft XBRL taxonomy supports technical representation and does not make tagging mandatory at this stage EFRAG taxonomy release.
A valid digital field cannot establish that a materiality judgement or source estimate is adequately supported.
The ESRS datapoints guide explains why a populated row is not a complete reporting answer.
What should the final assurance handover preserve?
Retain the reporting version, engagement scope and conclusion separately from the management preparation record.
| Record | Useful distinction | Review question |
|---|---|---|
| Reporting set | Final version and locations. | Does it match the engagement perimeter? |
| Management file | Sources, judgements and limitations. | Can the answer be reproduced? |
| Engagement record | Provider, scope and relevant report. | What was actually concluded? |
| Later changes | Amendments and renewed review. | Did publication change after the engagement? |
Read the detailed guidance and evidence
Ask consultants to identify their preparation work and software suppliers to export evidence history without claiming to supply the opinion.
The original and revised ESRS versions should remain distinguishable in the file Original ESRS Revised ESRS.
What is the useful first assurance-readiness deliverable?
Start with a defined reporting perimeter and one complete evidence trail rather than an unqualified assured-ready percentage.
Module 01 / 03
Define
Name the reporting set and criteria.
Module 02 / 03
Trace
Connect one answer to source and judgement.
Module 03 / 03
Resolve
Assign the open evidence or scope question.
Read the detailed guidance and evidence
Redfern’s fictional review finishes with a clarified perimeter and a list of management actions, not a self-issued assurance certificate.
The standards homepage compares the reporting bases without conflating them with the assurance engagement.
How can a team prepare for CSRD assurance?
This editorial nine-step workflow organises management preparation rather than prescribing independent assurance procedures.
- 101
Confirm reporting scope
Retain the applicable route and year. - 202
Define the perimeter
Identify report, criteria and boundaries. - 303
Confirm provider role
Check the applicable national route. - 404
Map information selection
Retain materiality and judgement records. - 505
Trace source evidence
Keep method, period and limitations. - 606
Track requests
Assign unresolved questions and owners. - 707
Freeze the reporting set
Record the version under review. - 808
Check the conclusion
Match public wording to actual scope. - 909
Retain the handover
Keep management and engagement records distinct.
Frequently asked
Questions people ask
Does CSRD escalate to reasonable assurance in 2028?
The substantive Omnibus removed that reasonable-assurance standard-setting path.
Does the perimeter include the materiality process?
The architecture includes the process used to identify the reported information.
Are Taxonomy disclosures separate from assurance?
Article 8 Taxonomy reporting is included in the CSRD assurance architecture.
Can any consultant sign the opinion?
Provider eligibility depends on the applicable framework and Member State options rather than a universal adviser entitlement.
Does a completed readiness file supply assurance?
No: preparation and the independent engagement conclusion are different outputs.
Does technical validation prove assurance?
No: validation supports technical checks and does not replace the independent opinion or reporting judgement.
Sources
Primary sources
Primary provisions and official owner guidance checked on 26 October 2026; historical and draft resources are labelled in the guide.
- Official JournalOmnibus I: Directive 2026/470
- Official JournalCSRD: Directive 2022/2464
- Official JournalEU Taxonomy Regulation 2020/852
- Financial Reporting CouncilISSA (UK) 5000
- Financial Reporting CouncilCurrent assurance standards
- IAASBISSA 5000 publication
- Official JournalRevised ESRS: Regulation 2026/1563
- EFRAG Secretariat2026 draft datapoints explanatory note
- EFRAGRevised ESRS draft XBRL taxonomy release
- Official JournalOriginal ESRS: Regulation 2023/2772