Assurance levels defined
Assurance engagements come in two recognised levels. Reasonable assurance, the level applied to statutory financial audits, results in a positive opinion: the auditor states that, in their opinion, the information is fairly presented, based on extensive testing of evidence and controls. Limited assurance results in a negative form of conclusion: the assurance provider states that nothing has come to their attention that causes them to believe the information is materially misstated, based on a narrower set of procedures such as inquiry of management and analytical review, rather than the detailed substantive testing reasonable assurance requires.
The standard behind it
The general framework for both levels is set out in ISAE 3000 (Revised), Assurance Engagements Other Than Audits or Reviews of Historical Financial Information, issued by the International Auditing and Assurance Standards Board (IAASB). The CSRD requires member states to ensure a specific assurance standard applies to sustainability statement engagements; where the European Commission has not yet adopted a dedicated EU assurance standard, member states may permit assurance providers to apply national standards or ISAE 3000 (Revised) directly in the meantime.
Who provides assurance
Under the CSRD, member states have the option to permit the sustainability statement to be assured either by the company's statutory auditor or by an independent assurance services provider accredited under national rules, rather than requiring the same firm that audits the financial statements to also assure the sustainability statement. This gives companies some choice over provider, though the assurance provider must still meet the independence and quality requirements the CSRD and national transposing law set out.
The review clause toward reasonable assurance
The CSRD includes a review clause requiring the European Commission to assess, by a set point after the directive's initial application, whether to move the assurance requirement from limited to reasonable assurance, and whether a dedicated EU sustainability assurance standard should replace reliance on ISAE 3000 (Revised) or national standards. Companies building assurance-ready processes now are, in effect, building toward a bar that is set to rise rather than one likely to stay fixed at the limited assurance level indefinitely.
Preparing for assurance
Preparing for limited assurance starts well before the assurance provider is engaged. Building an audit trail for each disclosed data point, documenting the methodology behind the double materiality assessment, and putting in place internal controls over sustainability data comparable to those already used for financial data are the main components. Aligning the sustainability reporting timetable with the financial reporting calendar reduces the risk of late findings, and engaging the assurance provider early — ideally while the double materiality assessment and data collection are still underway — allows issues to be resolved before the statement is finalised rather than after.