UK SRS Assurance — ISSA (UK) 5000, FRC Register, and What to Expect

Assurance is the area of sustainability reporting where regulatory intent and regulatory reality are furthest apart. Internationally, the direction is clear: sustainability disclosures will eventually be subject to the same level of independent assurance as financial statements. In the UK, the regulatory framework is being built in stages. Companies preparing for UK SRS need to understand what is required now, what is coming, and what strategic decisions they should be making in the interim.

The Current Position: FCA CP26/5

The FCA’s Consultation Paper CP26/5, published alongside the UK SRS implementation framework, addresses assurance in deliberately measured terms. The headline position is straightforward: companies within scope of UK SRS are not required to obtain external assurance of their sustainability disclosures. However, they must disclose whether they have obtained assurance and, if so, the nature and scope of that assurance.

Critically, there is no obligation to explain why a company has not obtained assurance. This is not a comply-or-explain requirement. A company may simply state that its sustainability disclosures have not been subject to external assurance. No further disclosure is needed. The FCA has chosen transparency over compulsion at this stage — the market can see who has and has not sought assurance, but no regulatory consequence attaches to the decision not to do so.

This approach reflects a pragmatic recognition of the current state of the assurance market. The supply of practitioners with the necessary expertise to assure sustainability disclosures to a meaningful standard is limited. Mandating assurance before the market can deliver it would risk creating a compliance exercise rather than a genuine quality control mechanism. The FCA has opted to let the assurance infrastructure mature before imposing mandatory requirements.

The FRC Interim Register of Sustainability Assurance Practitioners

The Financial Reporting Council is establishing an interim register of sustainability assurance practitioners, expected to be operational by mid-2026. This register will identify firms and individuals that the FRC considers competent to provide assurance over sustainability disclosures. It is an interim measure — the long-term intention is for a formal regulatory framework for sustainability assurance providers, but the register will serve as a market signal in the meantime.

The register is significant for two reasons. First, it provides companies that do choose to obtain voluntary assurance with a reference point for selecting a practitioner. Second, it signals the FRC’s intention to become the regulator of sustainability assurance in the UK, mirroring its role in the oversight of statutory audit. Companies should expect that when mandatory assurance is introduced, it will be the FRC — or its successor body — that sets the standards and supervises the practitioners.

For audit committees evaluating whether to engage an assurance provider now, the FRC register will become an important quality filter. Engaging a provider that appears on the register will carry greater credibility with investors and regulators than engaging one that does not. Companies that move early on voluntary assurance should ensure they select a provider with the credentials to appear on the register once it is published.

ISSA (UK) 5000 — The Assurance Standard

The International Standard on Sustainability Assurance (UK) 5000, or ISSA (UK) 5000, is the assurance standard that will govern sustainability assurance engagements in the UK. It is effective for periods beginning on or after 15 December 2026. This means the earliest reporting periods to which it will apply in practice are calendar year 2027 reports, or financial years ending from December 2027 onward.

ISSA (UK) 5000 is derived from the international ISSA 5000 standard issued by the International Auditing and Assurance Standards Board, with UK-specific modifications by the FRC. It establishes requirements for both limited and reasonable assurance engagements over sustainability information. Limited assurance provides a lower level of confidence — the practitioner concludes that nothing has come to their attention that causes them to believe the information is materially misstated. Reasonable assurance is the higher standard, equivalent to the level applied in a statutory audit — the practitioner forms a positive opinion on whether the information is free from material misstatement.

The expectation is that mandatory assurance, when introduced, will begin with limited assurance and transition to reasonable assurance over time. This mirrors the approach taken with financial reporting when auditing standards were first introduced. The practical implication for companies is that the data, systems, and internal controls infrastructure required for sustainability disclosures must be robust enough to withstand external scrutiny — initially at a limited assurance level, but ultimately at the same standard applied to financial statements.

What an Audit Committee Should Be Asking Now

Even though assurance is not yet mandatory, audit committees have a governance responsibility to prepare. The questions that should be on the audit committee agenda now fall into several categories.

The Trajectory Toward Mandatory Assurance

The direction of travel is unambiguous. The UK Government has stated its intention to introduce mandatory assurance of sustainability disclosures. The FRC is building the regulatory infrastructure. ISSA (UK) 5000 provides the technical standard. The only question is timing.

The most likely trajectory follows the international pattern: mandatory limited assurance introduced first, applying to the largest companies in scope, followed by a phased expansion to reasonable assurance and a broader set of reporting entities. The EU has already committed to this path under the Corporate Sustainability Reporting Directive, requiring limited assurance from 2024 with a transition to reasonable assurance by 2028. The UK is likely to follow a similar timeline, offset by the later start of UK SRS implementation.

For companies in the first wave of UK SRS reporting — those with accounting periods beginning on or after 1 January 2027 — the practical recommendation is clear. Treat assurance as inevitable. Build data systems and internal controls now that will be assurance-ready when the requirement arrives. The cost of retrofitting controls after mandation will be significantly higher than the cost of building them into the reporting framework from the outset.

Investors are increasingly treating the presence or absence of assurance as a signal of reporting quality. The FCA’s decision to require disclosure of assurance status — even without requiring assurance itself — creates a market mechanism that will exert pressure on companies to move toward voluntary assurance ahead of any formal mandate. Companies that lag behind their peers in obtaining assurance may find themselves at a disadvantage in investor engagement, regardless of the regulatory position.