UK SRS assurance

The UK SRS assurance position

sustainability assurance sits within a framework with three distinct components: a UK assurance standard (ISSA (UK) 50001), an FCA regulatory position that does not currently mandate assurance (CP26/53), and a FRC interim register of sustainability assurance practitioners8 establishing quality markers for the profession.

The combined effect: third-party assurance over SRS standards disclosures is currently voluntary but increasingly expected by investors3. Where companies obtain assurance, ISSA (UK) 50001 provides the methodology, with disclosure under CP26/53 of the assurance level obtained, standard used, and provider identity.

ISSA (UK) 5000 — the UK standard

ISSA (UK) 50001 was published by the Financial Reporting Council on 12 November 20252. The standard is effective for engagement periods commencing on or after 15 December 20261.

The standard adapts the international IAASB ISSA 50004, which was finalised by the IAASB in September 20244 with the same effective date. The UK adaptation addresses UK-specific regulatory requirements while maintaining substantial alignment with the international standard — supporting cross-border consistency of UK assurance engagements1.

ISSA (UK) 50001 is a profession-agnostic standard. Both statutory audit firms and non-audit firms may perform engagements under it, subject to competence, independence, and quality control requirements1.

This is a significant distinction from financial audit, where only statutory audit firms may perform statutory engagements11.

The standard requires practitioners to apply1:

• FRC Ethical Standard for assurance engagements [11]
• ISQM (UK) 1 — quality management at the firm level [11]
• ISQM (UK) 2 — engagement quality reviews where applicable [11]
• Sufficient professional competence in sustainability reporting matters

FCA CP26/5 — not mandatory at this stage

The FCA published Consultation Paper CP26/53 on 30 January 2026, proposing mandatory UK SRS S2 reporting for in-scope listed companies from 1 January 2027. The consultation closed on 20 March 2026; a final Policy Statement is expected in autumn 20263.

On assurance, the FCA explicitly does NOT propose to mandate third-party assurance at this stage3. The reasoning addresses several considerations: ISSA (UK) 50001 only becomes effective from 15 December 2026; the practitioner market is still establishing competence and capacity; mandatory assurance with insufficient market capacity could compromise quality3.

Where companies obtain assurance voluntarily, CP26/53 requires disclosure of three specific elements:

• The assurance level obtained (limited or reasonable)
• The assurance standard used (ISSA (UK) 5000 [1] is the expected reference)
• The identity of the assurance provider

The FCA has noted possibility of mandatory assurance "in due course" pending market readiness assessment3. The final Policy Statement may include indicative timing for future mandatory assurance, but does not introduce a mandatory regime from year 1.

The FRC interim register of sustainability assurance practitioners

The FRC2 is establishing an interim register of sustainability assurance practitioners with targeted operational date of mid-20268. The register is voluntary — inclusion is not a precondition for performing engagements under ISSA (UK) 50001 — but is expected to become a market standard quality marker8.

Register operation8:

• Statutory audit firms are automatically eligible — they meet FRC competence and independence standards through existing registration [11]
• Non-audit firms apply with evidence of competence in sustainability assurance, independence and ethical standards compliance, and quality control systems consistent with ISQM (UK) 1 [11]
• FRC evaluates applications and publishes the register publicly
• Register is interim — a more permanent regulatory framework is expected as part of broader audit and corporate governance reform

For companies procuring assurance, the register provides a defensible quality marker when selecting a non-audit firm provider. For non-audit firms providing assurance, register inclusion signals market readiness alongside audit firms8.

Scope of UK SRS assurance

ISSA (UK) 50001 applies to assurance engagements over sustainability information generally — both UK SRS S1 (general sustainability) and S2 climate standard5 fall within its scope.

Within those disclosures, the practitioner makes engagement-specific judgements on scope1. Partial-scope engagements are permitted — for example, assurance over Scope 1 and 2 emissions only, with Scope 3 outside scope. The assurance report makes clear what was assured and what was not1.

Materiality is aligned with UK SRS — enterprise value materiality, not EU CSRD double materiality5. The assurance practitioner applies UK SRS materiality concepts in determining what disclosure misstatement is material to users1.

Forward-looking disclosure challenges

sustainability reporting standards5 requires substantial forward-looking disclosure — transition plans, scenario analysis (paragraph 2210), climate-related targets (paragraphs 33-3610), anticipated financial effects (paragraphs 18-2110). Forward-looking elements present specific assurance challenges that ISSA (UK) 50001 addresses through procedure design rather than scope exclusion.

The practitioner cannot verify the accuracy of a forward-looking estimate — by definition the future has not happened1. Instead, the practitioner evaluates:

• Methodology appropriateness — is the entity using a defensible approach to scenario analysis or target setting?
• Consistency of assumptions — are climate, macroeconomic, and policy assumptions consistent across related disclosures (scenario analysis, transition plan, financial statements connectivity)?
• Disclosure quality — does the entity adequately disclose the assumptions, methodology, and limitations of forward-looking statements per paragraph 22(b) [10]?
• Reasonableness of assumptions — are the assumptions consistent with currently available information and recognised external sources (IEA, NGFS, IPCC, etc.)?

Limited assurance over forward-looking disclosures typically results in a methodology-focused negative-form conclusion — "nothing has come to our attention that causes us to believe that the methodology, assumptions, and disclosures are materially misstated"1.

The assurance process

An ISSA (UK) 50001 engagement typically follows five stages:

1. Engagement acceptance

The practitioner evaluates whether to accept the engagement, addressing competence, independence, scope, and resources1. Independence requirements apply per the FRC Ethical Standard11. Engagement letter sets out scope, level (limited or reasonable), responsibilities, and reporting arrangements.

2. Planning

Risk assessment over the subject matter — the entity's sustainability disclosure1. Materiality is determined by reference to users of the disclosure and the materiality concept embedded in UK SRS5 (enterprise value affected). Engagement strategy reflects scope, level, and identified risks.

3. Evidence gathering

For limited assurance, primarily inquiry of management and analytical procedures, with limited substantive testing1. For reasonable assurance, controls testing and substantive procedures comparable to financial audit1. Practitioner evaluates the entity's controls over sustainability reporting — data collection systems, calculation methodologies, internal review processes.

4. Conclusion formation

Practitioner forms a conclusion based on evidence obtained1. For limited assurance, conclusion is in negative form. For reasonable assurance, conclusion is in positive form. Either conclusion may be qualified where scope limitations or disclosure deficiencies exist.

5. Reporting

Assurance report addressed to intended users (typically the audit committee, shareholders, or the board)1. The report identifies the subject matter, the criteria (UK SRS), the practitioner's responsibilities, the work performed, and the conclusion. Per FCA CP26/53, the entity's disclosure of the assurance arrangement includes assurance level, standard used, and provider identity.

Who can perform engagements

ISSA (UK) 50001 is profession-agnostic — both statutory audit firms and non-audit firms may perform sustainability assurance engagements, subject to competence, independence, and quality control requirements1.

Statutory audit firms

UK statutory audit firms (those eligible to audit UK listed companies under the Companies Act9) are automatically eligible to perform sustainability assurance under ISSA (UK) 50001. They meet FRC competence, independence, and quality control standards through existing registration11. Most large UK statutory audit firms have established dedicated sustainability assurance practices.

Non-audit firms

Non-audit firms — including dedicated sustainability assurance firms — may also perform engagements under ISSA (UK) 50001. The FRC interim register8 provides a quality marker for non-audit firms; inclusion signals demonstrated competence, independence, and quality control consistent with ISQM (UK) 111.

Independence considerations

Where the assurance practitioner is also the statutory auditor of the entity, FRC Ethical Standard11 independence requirements apply to the combined engagement. Sustainability assurance is generally permitted alongside statutory audit but requires careful management of self-review and advocacy threats, particularly where the audit firm has previously advised on sustainability reporting systems11.

IAASB context and global adoption

ISSA (UK) 50001 is the UK adaptation of IAASB ISSA 50004, finalised by the IAASB in September 2024 with the same 15 December 2026 effective date. ISSA 5000 is the international standard for general sustainability assurance and is being adopted by jurisdictions around the world4.

For UK-listed companies with international operations or capital, ISSA (UK) 5000-aligned engagements provide substantial comparability with assurance engagements performed under the IAASB standard in other jurisdictions1. The UK adaptation preserves international comparability — the methodology and conclusions are conceptually equivalent.

The EU is separately developing assurance standards for CSRD-required disclosures. The ESRS regime currently requires limited assurance from 2024 with reasonable assurance "by the end of 2028 at the earliest" subject to further EU Commission decisions4. EU and UK assurance regimes operate separately but with substantial methodological alignment through the IAASB framework.

Frequently asked questions