Standards and reporting
Sustainability assurance software
Sustainability assurance software can organise engagement evidence and review working, while the independent practitioner’s conclusion remains a separate professional output Engagement and reporting requirements.
Which assurance-related workflow needs support?
Define whether the buyer needs preparer evidence management, practitioner working support or a controlled handover between them before comparing applications Engagement responsibilities.
Module 01 / 04
Information
Specify the metrics or disclosures intended for the engagement.
Module 02 / 04
People
Identify management, preparers and the independent practitioner.
Module 03 / 04
Working
Describe evidence requests, review and correction processes.
Module 04 / 04
Deliverable
Keep the practitioner’s actual conclusion distinct from system status.
Read the detailed guidance and evidence
The sustainability assurance guide explains engagement types and scope.
This guide tests the application’s ability to preserve evidence and decisions rather than evaluating a provider’s assurance quality.
What should a fictional assurance pilot contain?
An invented property-services business prepares two environmental metrics for review.
| Record or decision | What to preserve | Why it matters |
|---|---|---|
| In-scope metric | A defined emissions disclosure included in the proposed engagement | Keep its criterion, period and evidence requests identifiable. |
| Out-of-scope metric | A water-use disclosure shown on the same dashboard | Prevent a completed review status implying coverage of this metric. |
| Conflicting evidence | Two attachments share a filename but contain different source versions | Show which document each reviewer actually examined. |
| Late change | The preparer corrects the in-scope amount after initial review | Identify the affected working and practitioner communication. |
How should standards and engagement versions be recorded?
ISSA (UK) 5000 is the FRC’s UK text and international ISSA 5000 is a separate publication, so retain the actual basis agreed for the engagement UK standard International standard.
Module 01 / 04
Standard
Identify the named text and version selected by the practitioner.
Module 02 / 04
Period
Record the information period or specific date covered.
Module 03 / 04
Application
Keep any early-application decision explicit.
Module 04 / 04
Updates
Review changes before approved working is replaced.
Read the detailed guidance and evidence
ISSA (UK) 5000 is effective for assurance engagements on sustainability information reported for periods beginning on or after 15 December 2026, or as at a specific date on or after that day, with earlier application permitted Paragraph 15.
The FRC issued it for voluntary use, which does not make a software purchase compulsory Issuance statement.
Which adjacent labels should the software keep separate?
A product should preserve the engagement actually commissioned rather than treat different services as equivalent.
| Record or decision | What to preserve | Why it matters |
|---|---|---|
| Limited or reasonable assurance | The agreed assurance level and conclusion | Record the selected engagement rather than invent a universal level Scope and definitions. |
| Agreed-upon procedures | Agreed procedures and reported findings | Do not relabel findings as an assurance opinion ISRS 4400. |
| Management-system certification | Certification of the relevant management system | Do not imply assurance over the entire sustainability report Certification distinction. |
| GHG statement verification | The specified statement and verification basis | Keep its scope identifiable ISO 14064-3. |
How should the application prevent scope overstatement?
An engagement concerns specified information and criteria, so a shared dashboard should not suggest that every displayed measure has the same assurance coverage Engagement terms and report.
Module 01 / 04
Information
Link the included disclosure to its exact reported version.
Module 02 / 04
Criteria
Retain the applicable preparation criteria and reference.
Module 03 / 04
Boundary
Identify the entity, activity and period covered.
Module 04 / 04
Exclusions
Show information outside the engagement without an assurance badge.
Read the detailed guidance and evidence
The fictional water-use metric remains outside the stated engagement even when its data-collection task is complete.
Ask the demonstrator to generate a report preview and inspect whether that scope distinction survives.
A review-complete indicator should say which review it represents rather than invite a wider public inference.
What should the scope export contain?
This original handover identifies what the practitioner has actually been asked to address.
| Record or decision | What to preserve | Why it matters |
|---|---|---|
| Subject information | Disclosure ID and report location | Locate the exact metric or narrative. |
| Criteria | Named basis and relevant version | Explain what the information is assessed against. |
| Coverage | Entity, activities, period and assurance level | Avoid a broad organisation-wide claim. |
| Exclusions | Explicitly out-of-scope fields and unresolved scope questions | Preserve qualifications when the working is transferred. |
How should evidence requests and review history work?
ISSA (UK) 5000 addresses evidence and documentation, so a useful platform should make the review trace inspectable rather than count uploaded files Evidence and documentation.
Module 01 / 04
Request
Connect the evidence question to the relevant information and assertion.
Module 02 / 04
Response
Retain source documents and the preparer’s explanation.
Module 03 / 04
Review
Identify the document version examined and the reviewer’s decision.
Module 04 / 04
Exception
Keep unresolved evidence needs and follow-up ownership visible.
Read the detailed guidance and evidence
In the fixture, two differently dated files have the same filename, which tests whether the system can distinguish content and review history.
Ask a second reviewer to follow the accepted attachment and reproduce the evidence reference without relying on the original preparer.
Which evidence-control failures should the trial expose?
Use these original challenges to inspect the application’s review behaviour.
| Record or decision | What to preserve | Why it matters |
|---|---|---|
| Attachment replacement | Replace the source file after review | Can the reviewer identify what changed and what was previously examined? |
| Unsupported closure | Close a request without attaching the requested explanation | Does the unresolved evidence issue remain identifiable? |
| Wrong disclosure | Attach a valid document to an unrelated metric | Can the review trace reveal the mismatch? |
| Export loss | Download working without the exception comments | Does the buyer notice that the handover is incomplete? |
What should happen when reported information changes?
Keep a correction connected to the affected evidence and report version so the practitioner can evaluate its implications Misstatements, subsequent events and reporting.
Module 01 / 04
Change
Identify the original and replacement information.
Module 02 / 04
Reason
Retain the source correction and preparer’s explanation.
Module 03 / 04
Effect
List affected requests, working and proposed report wording.
Module 04 / 04
Communication
Record the practitioner’s review rather than assume automatic acceptance.
Read the detailed guidance and evidence
The fictional business changes its emissions amount after a review task has been marked complete.
The product should expose the affected working and require the appropriate people to decide the consequence.
An automatic status reset can support the workflow without itself determining whether the final conclusion changes.
How should a standards-change feature be tested?
Require an explicit source and period check rather than a silent replacement of engagement labels.
| Record or decision | What to preserve | Why it matters |
|---|---|---|
| Owner source | Open the current FRC standards index | Verify the available UK text before configuring the engagement Current index. |
| International transition | Read the IAASB’s ISAE 3410 withdrawal announcement | Keep its timing and jurisdictional scope explicit Withdrawal announcement. |
| Engagement consequence | Ask the practitioner which basis applies | Do not let the application choose a professional conclusion. |
| Change history | Retain the old and replacement configuration | Allow the next reviewer to understand the transition. |
How should permissions and independence responsibilities be allocated?
Ethical and independence requirements apply to the practitioner and engagement, so a permission setting alone does not resolve them Sustainability assurance ethics.
Module 01 / 04
Management
Retain responsibility for the information and relevant decisions.
Module 02 / 04
Preparer
Identify who supplies evidence and explains corrections.
Module 03 / 04
Practitioner
Keep the independent review and conclusion attributable.
Module 04 / 04
Access
Define who can change source data, review working and issued documents.
Read the detailed guidance and evidence
Ask whether the buyer is seeing a preparer collaboration area or the practitioner’s separate engagement working.
Where a supplier describes accreditation, inspect the actual body and scope rather than infer that the software itself has been accredited Validation and verification accreditation.
The government’s oversight policy is a separate professional-regime question, not a software certification scheme Government response.
What should a comparable proposal and exit pack specify?
Separate application functionality, implementation and independent professional work.
| Record or decision | What to preserve | Why it matters |
|---|---|---|
| Software | Requests, document versions, review and export behaviour | Specify what the pilot demonstrated. |
| Implementation | Migration, integrations, permissions and training | Name the work performed before live use. |
| Professional engagement | Practitioner, scope, criteria and assurance level | Keep the fee and engagement separate from the licence. |
| Handover | Accepted information, evidence references, exceptions and report version | Test usable continuity when access ends. |
What should the buyer accept after the pilot?
Accept the demonstrated evidence workflow and the separation of scope and conclusion rather than an audit-ready badge Evidence and reporting requirements.
Module 01 / 04
Replay
Follow the in-scope metric from request to reviewed source.
Module 02 / 04
Distinguish
Keep the water metric outside the assurance coverage.
Module 03 / 04
Correct
Trace the late change and practitioner response.
Module 04 / 04
Transfer
Open the evidence and exception record outside the system.
Read the detailed guidance and evidence
Use the assurance guide for the engagement decision and reporting consultancy for separately scoped preparation support.
The software guide and standards overview place this specialist workflow within the broader reporting process.
Use the CSRD assurance guide to define the reporting subject, engagement questions and evidence handover separately from report preparation.
How can the work be organised?
This nine-step sequence is an editorial workflow rather than a statutory timetable.
- 101
Define the workspace
Identify preparer collaboration, practitioner support and the intended handover. - 202
Agree the engagement map
Record information, criteria, period, boundary and assurance level. - 303
Prepare the fixture
Include an out-of-scope metric, conflicting files and a late correction. - 404
Check the standard
Inspect the named text, version and application-period decision. - 505
Trace requests
Follow evidence questions, responses and reviewer decisions. - 606
Challenge file history
Replace an attachment and inspect what the reviewer originally examined. - 707
Test the correction
Identify affected information and the practitioner’s response. - 808
Inspect claims and exports
Keep coverage qualifications and independent reporting distinct. - 909
Agree acceptance
Document delivered functions, responsibilities and usable exit records.
Frequently asked
Questions people ask
Does assurance software issue an independent conclusion?
The application can support evidence and review, while the practitioner forms and reports the assurance conclusion.
Is ISSA (UK) 5000 mandatory from December 2026?
It is for voluntary use, with an effective-period rule and earlier application permitted, rather than a universal requirement to purchase assurance.
Does completing a collection task mean a metric is assured?
No, because the engagement scope and practitioner’s report determine coverage rather than the dashboard’s task status.
Is an agreed-upon-procedures report an assurance opinion?
ISRS 4400 concerns agreed procedures and findings, so the software should not relabel that output as an assurance conclusion.
Can the product claim UKAS accreditation itself?
Inspect the actual accredited body and scope because UKAS describes accreditation of validation and verification bodies, which is different from a workflow badge.
Which pilot result is decisive?
The original fixture should preserve the reviewed source version, out-of-scope water metric and late-correction trail through the final handover.
The ISO 14064 software pilot examines the underlying inventory and correction records before they reach an assurance or verification workflow.
Sources
Primary sources
Primary provisions and official owner guidance checked on 26 October 2026; historical and draft resources are labelled in the guide.
- FRCISSA (UK) 5000: engagement, evidence, reporting and effective periods
- FRCAssurance standards: current owner index
- FRCISSA (UK) 5000 issued for voluntary use
- IAASBISSA 5000: international standard and scope
- IAASBISAE 3410 withdrawal announcement and timing
- IAASB / IFACISRS 4400 Revised: agreed-upon procedures
- DBTGovernment response on sustainability assurance oversight
- ISOCertification: management-system certification distinction
- ISOISO 14064-3: greenhouse-gas statement verification
- UKASValidation and verification body accreditation
- IESBASustainability assurance ethics and independence standards