Standards and reporting
Sustainability assurance
Sustainability assurance examines specified information against stated criteria, so the scope, assurance level and report conclusion matter more than an assurance badge.
What does sustainability assurance cover?
An assurance conclusion concerns identified sustainability information measured or evaluated against applicable criteria rather than a general verdict that a business is sustainable Paragraphs 18 and 190.
Module 01 / 04
Information
Identify the metrics, statements or report sections actually covered.
Module 02 / 04
Criteria
Name the rules used to evaluate the selected information.
Module 03 / 04
Users
Agree who will rely on the report and for what purpose.
Module 04 / 04
Conclusion
Read the conclusion together with its scope and qualifications.
Read the detailed guidance and evidence
An attractive assurance logo cannot tell a reader which sites, periods or disclosures were included.
Begin with the report itself and compare its description of the subject matter with the claim made in the annual report.
Our sustainability reporting standards guide helps separate reporting criteria from assurance standards.
How do limited and reasonable assurance differ?
Limited assurance provides substantially lower assurance than reasonable assurance and uses different conclusion wording Paragraphs 18 and 190.
| Engagement | What the reader receives | What it does not mean |
|---|---|---|
| Limited assurance | A conclusion framed around whether a matter causing concern came to the practitioner’s attention | Confirmation that every figure is correct |
| Reasonable assurance | An opinion about preparation or fair presentation in all material respects | Absolute certainty or a promise of future performance |
| Combined levels | Different levels for identified parts of the information | One level automatically applying to the whole report |
Read the detailed guidance and evidence
Ask the provider to make the proposed level explicit before comparing fees or timetable.
The scope and criteria still matter when two proposals both use the words limited assurance.
Which criteria should the engagement use?
The practitioner considers whether applicable criteria are suitable and available to intended users before accepting the engagement Paragraphs 75–84.
Module 01 / 04
Reporting basis
Name the relevant standard, metric definition or disclosed methodology.
Module 02 / 04
Version
Specify the edition and any transition or relief used.
Module 03 / 04
Boundary
Document entities, sites, activities and reporting dates.
Module 04 / 04
Access
Make the criteria available in the form appropriate for the intended users.
Read the detailed guidance and evidence
An emissions inventory, workforce metric and transition-plan narrative need criteria appropriate to the information being examined.
Keep the reporting framework separate from the standard governing the practitioner’s assurance work.
A reporting consultancy brief can describe preparatory support without presenting that support as an independent conclusion.
What belongs in an assurance scope?
A useful engagement brief identifies the information, period, criteria, level and intended output before the work starts Paragraphs 85–88 and 190.
| Scope field | Working question | Evidence to attach |
|---|---|---|
| Entity boundary | Which entities and sites are included? | Entity and site schedule |
| Information | Which measures or disclosures are covered? | Numbered disclosure inventory |
| Period | Which dates and comparatives are included? | Reporting calendar |
| Criteria | What definitions and methods govern the figures? | Basis-of-preparation document |
| Level | Which parts receive which level? | Engagement terms |
| Output | Who receives what report? | Draft reporting expectations |
Read the detailed guidance and evidence
Record exclusions clearly enough that a reader cannot mistake a selected-metric engagement for assurance of the complete report.
Is sustainability assurance compulsory in the UK?
Publication of ISSA (UK) 5000 does not itself make sustainability assurance mandatory, and the government’s oversight policy describes a voluntary registration regime Government response.
Module 01 / 04
Reporting duty
Determine the applicable reporting requirement separately.
Module 02 / 04
Assurance choice
Identify any legal, contractual or voluntarily chosen assurance requirement.
Module 03 / 04
Provider regime
Do not confuse voluntary provider registration with a reporting entity’s duty.
Module 04 / 04
Jurisdiction
EU CSRD assurance requirements need a separate scope assessment CSRD assurance provisions.
Read the detailed guidance and evidence
The UK standard is a framework for engagements, not a law requiring every UK business to appoint an assurer.
CSRD has a limited-assurance architecture for in-scope reporting, which should not be imported into a general UK voluntary report Article 1 amendments to Accounting Directive Article 34.
The older environmental guidance should not be treated as current advice about which assurance standard to appoint 2019 guidance.
What changes on 15 December 2026?
ISSA (UK) 5000 is effective for periods beginning on or after 15 December 2026 or information as at a specific date on or after it, with earlier application permitted Paragraph 15.
| Item | Position on 26 October 2026 | Appointment question |
|---|---|---|
| ISSA (UK) 5000 | Issued but its normal effective date is still ahead | Will it be applied early or to a qualifying period? |
| International ISSA 5000 | Covers sustainability assurance across topics | Which jurisdictional version is relevant? |
| ISAE 3410 | Withdrawal approved, taking effect at ISSA 5000’s effective date | What transition basis will the engagement use? |
| ISAE (UK) 3000 | Listed by the FRC among its current standards | Explain the proposed UK engagement basis |
Read the detailed guidance and evidence
Do not read this date as a requirement to obtain assurance from December 2026.
The period beginning rule is different from the date a report is signed or published.
Are readiness, AUP and certification assurance?
Readiness work, agreed-upon procedures and management-system certification answer different questions from a sustainability assurance conclusion ISRS 4400 paragraphs 4–6 Certification explained.
Module 01 / 04
Readiness
Agree a gap review and improvement output without claiming an assurance conclusion.
Module 02 / 04
AUP
The practitioner reports agreed procedures and findings rather than an assurance opinion Paragraph 6.
Module 03 / 04
Certification
Identify the certified system and standard rather than treating a certificate as report assurance Certification explained.
Module 04 / 04
Verification
GHG verification has its own statement, criteria and applicable standard ISO 14064-3 scope.
Read the detailed guidance and evidence
A provider may offer several services, but the contract should name which service the buyer is commissioning.
UKAS describes validation and verification accreditation separately from management-system certification Validation and verification accreditation.
Ask for the exact form of deliverable rather than relying on the words audit-ready or certified data.
Which service answers your question?
Match the deliverable to the decision before selecting a provider or requesting a quotation.
| Reader need | Potential commission | Check before acceptance |
|---|---|---|
| Find gaps before appointment | Readiness review | Written findings and improvement actions |
| Check specified invoice reconciliations | Agreed-upon procedures | Exact procedures and factual findings |
| Obtain a conclusion over selected disclosures | Assurance engagement | Scope, criteria, level and signed report |
| Evaluate a GHG statement | Verification engagement | Statement boundary and verification criteria |
| Demonstrate a management system | Certification engagement | Certificate scope and issuing body |
Read the detailed guidance and evidence
An agreed-upon procedures report leaves intended users to draw their own conclusions from the findings Paragraph 4.
ISO develops standards but does not issue certification itself ISO’s role.
What evidence makes assurance preparation easier?
An organised evidence trail helps connect the reported information to source records and supports the practitioner’s evidence work Paragraphs 89–94.
Module 01 / 04
Definition
Keep the approved metric definition and boundary beside the figure.
Module 02 / 04
Source
Retain the record identifier and a controlled copy or location.
Module 03 / 04
Calculation
Show units, factors, assumptions and transformations.
Module 04 / 04
Review
Record preparation, approval and any unresolved exceptions.
Read the detailed guidance and evidence
A data owner should be able to reproduce a reported total from the evidence supplied rather than from memory.
The ESG data collection guide describes an original register that distinguishes missing values, estimates and confirmed zeroes.
Preparation records do not determine the practitioner’s sampling strategy or guarantee an unmodified conclusion.
What might a readiness issue look like?
This fictional manufacturer has a traceability problem, not a proven assurance failure.
| Fictional observation | Preparation response | Question for the practitioner |
|---|---|---|
| Energy total lacks two invoices | Log the gap and assess an explicit estimate | What evidence supports the treatment? |
| Entity list changed during the year | Document the boundary decision | Is the basis applied consistently? |
| Factor file was overwritten | Recover and version the factor reference | Can the calculation be reproduced? |
| HR total uses a different period | Reconcile the period and definition | Is the reported measure supported? |
| Marketing says all data is assured | Compare the claim with actual scope | Which information is covered? |
Read the detailed guidance and evidence
Keep unresolved items visible in the handover instead of removing them to make a dashboard look complete.
How should you compare assurance providers?
Compare proposed scope, competence, independence, method and deliverables rather than treating a general credential as proof of suitability Acceptance and quality-management requirements.
Module 01 / 04
Relevant work
Ask about experience with the information and criteria in scope.
Module 02 / 04
Independence
Request the applicable ethical and independence basis.
Module 03 / 04
Access
Confirm evidence access, component work and relevant specialists.
Module 04 / 04
Output
Understand the expected report, limitations and modification process.
Read the detailed guidance and evidence
The government’s response describes a voluntary oversight direction, not permission to invent a current registration or approval claim for a firm Government response.
Separate preparation responsibilities from independent assurance responsibilities in the procurement brief.
Ask how scope changes and incomplete evidence affect timing before agreeing a fixed publication plan.
What should the final report handover include?
Read the signed report together with the covered information, applicable criteria and any modified conclusion Paragraphs 188–212.
| Handover item | Reader check | Publication control |
|---|---|---|
| Signed report | Correct entity, period and information | Link to the actual version |
| Level and conclusion | Limited, reasonable or combined | Use wording consistent with the conclusion |
| Criteria | Clear basis of evaluation | Make referenced criteria accessible |
| Modifications | Qualifications or other limitations | Do not omit them from a summary |
| Unassured material | Clear distinction from covered information | Avoid an all-report assurance claim |
| Evidence archive | Final reconciliation and version references | Retain according to the organisation’s policy |
Read the detailed guidance and evidence
Reasonable assurance remains a conclusion in all material respects, not an absolute guarantee Paragraph 190.
How should an assured report be described?
State the provider, covered information, level and criteria accurately, and preserve any qualifications rather than converting limited assurance into a positive accuracy claim Paragraph 190.
Module 01 / 04
Exact information
Name the selected metrics or report sections.
Module 02 / 04
Exact level
Retain distinctions where levels differ.
Module 03 / 04
Exact conclusion
Avoid translating a limited conclusion into a guarantee.
Module 04 / 04
Accessible report
Let readers inspect the assurance report and its context.
Read the detailed guidance and evidence
An assurance conclusion concerns preparation of information under criteria rather than whether the company’s sustainability performance is good.
For selected-metric work, identify other narrative and metrics that remain outside the engagement.
Review public wording when the final report differs from the original engagement proposal.
How do you plan an assurance engagement?
Use this editorial nine-step sequence to prepare a concrete appointment and reviewable evidence handover.
- 101
Define the decision
Identify intended users and what confidence they need. - 202
Assess the trigger
Separate applicable legal duties from voluntary choices. - 303
Specify the information
List metrics, entities, sites and periods. - 404
Name the criteria
Approve definitions, methods and reporting basis. - 505
Compare proposals
Review level, competence, independence and output. - 606
Agree engagement terms
Record access, timetable and responsibilities. - 707
Prepare the evidence
Reconcile records and preserve unresolved issues. - 808
Review the report
Read scope, level, conclusion and limitations together. - 909
Control publication
Match public claims to the signed report and retain versions.
Can you download an editable working resource?
This original preparation resource supports evidence and review and does not establish reporting conformity.
| Step | Review |
|---|---|
| Adapt | Set the actual reporting basis, boundary, period and selected requirements |
| Retain evidence | Connect source records and judgements to each answer |
| Review | Resolve open issues before making the final reporting claim |
Frequently asked
Questions people ask
Does limited assurance mean the figures are correct?
It is a limited conclusion about whether matters causing concern came to the practitioner’s attention, rather than a positive guarantee of accuracy.
Does reasonable assurance remove all risk?
No, its opinion concerns the information in all material respects rather than absolute certainty.
Is ISSA (UK) 5000 mandatory from December 2026?
Its effective-date rule does not itself create a legal duty to obtain assurance.
Is an AUP report an assurance opinion?
No, agreed-upon procedures produce procedures and findings without an assurance conclusion.
Does ISO certification assure a sustainability report?
A certificate concerns its specified product, service or system and should not be presented as assurance of unrelated reporting information.
Has ISAE 3410 already been withdrawn?
On 26 October 2026 its approved withdrawal is still prospective because the IAASB links it to ISSA 5000’s effective date of 15 December 2026.
Sources
Primary sources
Primary provisions and official owner guidance checked on 26 October 2026; historical and draft resources are labelled in the guide.
- FRCISSA (UK) 5000: full standard
- FRCCurrent assurance standards
- IAASBISSA 5000 publication
- IAASBISAE 3410 withdrawal announcement
- IAASB / IFACISRS 4400 (Revised): AUP standard
- Department for Business and TradeGovernment response on sustainability assurance oversight
- ISOCertification and accreditation explained
- ISOISO 14064-3:2019 verification and validation
- UKASValidation and verification body accreditation
- European Parliament and CouncilCSRD: limited assurance architecture
- DESNZ / DefraEnvironmental reporting guidelines