CSRD Assurance in Practice: What Auditors Are Looking For

CSRD Assurance in Practice: What Auditors Are Looking For

The Corporate Sustainability Reporting Directive (CSRD) brought the sustainability statement within the scope of independent assurance. First-wave companies published their first European Sustainability Reporting Standards (ESRS) statements in 2025 for financial years beginning on 1 January 2024; the 2026 reporting cycle is when practitioners' early findings started feeding back into corporate processes (European Commission, Corporate Sustainability Reporting, 2026). Teams must therefore answer not only which datapoints to disclose, but also how each disclosure can be evidenced.

What Limited Assurance Means Today

The assurance level in force under the CSRD regime is limited assurance. The practitioner performs less extensive procedures than in a reasonable assurance engagement and reports whether anything has come to their attention that causes them to believe the sustainability statement is materially misstated. “Limited” does not mean evidence-free or control-free reporting: the practitioner considers the materiality process, compliance of disclosures with ESRS, the reporting boundary, and the support for selected datapoints (CEAOB, Limited Assurance Guidelines, 2024).

Omnibus I resolved an important uncertainty in 2026. Directive (EU) 2026/470 removed the empowerment for a future move to reasonable assurance standards and provides for the Commission to adopt limited assurance standards by 1 July 2027. Companies should therefore not base their plans on an assumption that mandatory reasonable assurance will arrive in 2028. Stronger controls remain worthwhile because limited assurance still requires sufficient appropriate evidence, consistent methods, and documented judgment (Directive (EU) 2026/470, 2026).

The International Auditing and Assurance Standards Board (IAASB) issued ISSA 5000 as a final standard in 2024. Early application is permitted, while the standard becomes effective for assurance engagements on sustainability information reported for periods beginning on or after 15 December 2026. Until then, national standards, ISAE 3000 (Revised), and the non-binding guidance of the Committee of European Auditing Oversight Bodies (CEAOB) continue to shape EU practice (IAASB, ISSA 5000, 2024; CEAOB, 2024).

The Materiality Process Is Also Subject to Assurance

Practitioners do more than recalculate the emissions total at the end of the report. They consider how the double materiality assessment identified impacts, risks, and opportunities; which stakeholders and evidence sources informed it; and how disclosure decisions were approved. Excluding a topic as “not material” needs as clear a decision trail as reporting the topic.

A robust file brings together the thresholds used, assessment criteria, stakeholder groups consulted, changes to scoring, and management approvals. EFRAG's IG 1 Materiality Assessment guidance treats the assessment as an entity-specific, evidence-based process rather than prescribing one universal scoring template (EFRAG, IG 1 Materiality Assessment, 2024). From an assurance perspective, the method needs to be applied consistently and the conclusion must be explainable from the evidence available.

Data Traceability: Returning from Disclosure to Source

For every material disclosure, teams need a two-way trail from the reported value to source evidence and from the source into the report. For a greenhouse gas datapoint, that trail typically includes:

• A source document such as an invoice, meter reading, travel record, or supplier declaration
• The rule used to determine the organisational and activity boundary
• The name, version, geography, and validity year of the emission factor
• Unit conversions, formulas, estimates, and the treatment of missing data
• A change log showing who made a correction, when, why, and the previous value
• Preparer and reviewer approvals

The practitioner may not test the entire chain for every datapoint; samples are selected according to risk and materiality. The reporting team cannot know in advance which item will be selected. Traceability should therefore be standard across the material disclosure population, not reserved for high-profile metrics.

Where Internal Controls and Estimates Break Down

Sustainability data often originates outside the financial close, which creates recurring control gaps. If one site sends energy data by email, another uses a different unit, or last year's factor is silently reused, the total may look plausible while the process remains unreliable. Practitioners pay particular attention to segregation of duties, completeness checks, period cut-off, consolidation eliminations, and manual adjustments.

Estimates also receive close attention. Using an estimate for Scope 3 emissions or value-chain workforce data is not inherently an error. The problem arises when the method is not disclosed, inputs are not tested for currency, or a methodology change disrupts comparability without explanation. ISSA 5000 provides an integrated framework for professional judgment, materiality, and sufficient appropriate evidence across both quantitative and qualitative sustainability information (IAASB, ISSA 5000, 2024).

How the 2026 ESRS Revision Affects the Assurance File

Following Omnibus I, the Commission adopted simplified ESRS on 3 July 2026. At the adoption date, the delegated act had not yet entered into force because publication in the Official Journal was still pending; teams should confirm with legal and assurance advisers which standard set applies to their reporting period (European Commission, Revised ESRS, 2026). Fewer datapoints do not lower the evidence standard for the disclosures that remain. They make the documentation of materiality decisions and controls over reported information more visible.

An Assurance-Readiness Plan for Your Team

Enterprise teams can establish the following operating rhythm before year-end:

1. Freeze the disclosure inventory. Map each material ESRS disclosure to its data owner, source system, method, control, and approver.
2. Define the evidence standard. Apply common file-naming, version, retention, and change-log rules across all sites.
3. Build a risk-control matrix. Connect risks such as omission, wrong period, incorrect factor, and unauthorised change to preventive or detective controls.
4. Run a sample-based dry run. Ask internal audit or the controls team to retrace selected disclosures from the report to source evidence.
5. Maintain a finding-closure record. Record the owner, due date, evidence, and retest result for every issue.

Key Takeaway: Assurance readiness is not a control layer added after drafting. It is the design of the entire reporting chain — from materiality decisions through data collection to management approval — so that the process produces evidence as it operates.

References

1. European Parliament and Council, “Directive (EU) 2022/2464 as regards corporate sustainability reporting,” Official Journal of the European Union, 2022.
2. European Parliament and Council, “Directive (EU) 2026/470 as regards certain corporate sustainability reporting and due diligence requirements,” Official Journal of the European Union, 2026.
3. Committee of European Auditing Oversight Bodies (CEAOB), “Guidelines on Limited Assurance on Sustainability Reporting,” 2024.
4. IAASB, “International Standard on Sustainability Assurance 5000 — General Requirements for Sustainability Assurance Engagements,” final standard, 2024.
5. EFRAG, “IG 1 Materiality Assessment,” 2024.
6. European Commission, “Revised European Sustainability Reporting Standards,” adopted 3 July 2026.