Prepare sustainability information for assurance without turning one standard into a universal mandate.

Freeze the reporting criteria before testing the evidence.

An assurance engagement needs a clearly defined subject matter and criteria. Record the reporting entity, period, framework/version, jurisdictional basis, materiality process, included disclosures, excluded disclosures, boundary, calculation methodologies, and any transition reliefs or elections. If multiple frameworks are used, map overlaps and differences explicitly.

For CSRD reporting, retain the applicable Accounting Directive/CSRD text, applicable ESRS version, national transposition where relevant, materiality documentation, and any allowed transitional provisions. For IFRS S1/S2 reporting, preserve whether application is legally required by a jurisdiction or voluntary and which reporting period/version is being used.

Do not describe an internal sustainability scorecard, supplier questionnaire, or voluntary benchmark as if it were equivalent to a statutory reporting criterion. Those tools may support evidence collection, but the assurance conclusion must be tied to the actual criteria of the engagement.

Build controls around the reporting process, not around the assurance provider.

Management owns the information and the controls that produce it. The assurance practitioner evaluates evidence under the applicable engagement standard; the practitioner should not become the owner of the process being assured.

Use the Infrastructure Sustainability Data & Reporting Guide for operational source-data design and the Data Quality Assurance Guide for quality controls.

Document both the reporting materiality process and assurance materiality judgments.

Materiality is not one reusable threshold. Reporting frameworks may define materiality differently, and assurance practitioners apply materiality in planning, performing procedures, evaluating misstatements, and forming conclusions. IAASB's 2026 ISSA 5000 materiality FAQs explicitly address qualitative and quantitative information and double-materiality contexts where the reporting criteria require them.

Management should preserve the process used to identify material sustainability matters, the evidence considered, thresholds or qualitative factors, stakeholder inputs where required, changes from the prior period, and the approval path. Assurance teams should be able to distinguish a management reporting decision from the practitioner's assurance materiality judgment.

High-risk evidence often includes estimates, value-chain data, manual calculations, newly implemented metrics, data aggregated from multiple systems, management overlays, restatements, and disclosures dependent on forecasts or scenario assumptions. Flag these early so control testing and assurance planning can focus on the areas where evidence is weakest.

Create a reproducible evidence package for every material disclosure.

A good evidence package should let an independent reviewer move from the disclosed value or narrative back to the governing criterion, source population, underlying records, calculation, review, and final approval. Use stable IDs rather than relying on folder names alone.

1. Requirement record: framework/version, paragraph or disclosure reference, applicability, reporting entity, owner.
2. Source record: system/export/document origin, extraction date, source owner, completeness reconciliation.
3. Transformation record: formulas, factors, mappings, assumptions, software/version, change history.
4. Review record: preparer, reviewer, questions, corrected items, unresolved exceptions, approval.
5. Disclosure record: final value/text, report location, linkage to source package, subsequent changes.

For narrative disclosures, preserve the same discipline. A statement about governance, transition plans, targets, risk processes, or supplier controls should link to actual approved policies, minutes, decisions, plans, metrics, or other evidence. Assurance readiness deteriorates when narrative is drafted first and evidence is assembled afterward.

Define the engagement boundary and request list before fieldwork.

Before assurance work begins, confirm the engagement subject matter, criteria, level of assurance, applicable assurance standard, intended users, reporting period, management responsibilities, practitioner responsibilities, evidence access, use of experts, component/value-chain evidence, and expected report form. If ISSA 5000 is being applied early or through a jurisdiction's adoption, record that basis.

Maintain a request tracker that connects each practitioner request to the disclosure/evidence package, owner, status, response date, follow-up, and final disposition. Do not create a parallel assurance spreadsheet that becomes a second uncontrolled reporting system.

Classify findings by what actually failed: source completeness, calculation, control design, control operation, unsupported judgment, inconsistent disclosure, insufficient evidence, or reporting-criteria interpretation. Management should own remediation; the board or audit committee should receive material issues according to the organization's governance structure and any applicable legal requirements.

ISSA 5000 supports limited and reasonable assurance engagements, but the level required by a particular law or jurisdiction is a separate question. In the EU CSRD regime after Directive 2026/470, the statutory model remains limited assurance and the prior path toward mandatory reasonable assurance standards was removed.

Current primary sources

• Directive (EU) 2026/470 — current CSRD scope and sustainability-assurance amendments, including limited-assurance-standard timing.
• Directive (EU) 2025/794 — stop-the-clock application-date changes.
• European Commission CSRD implementing and delegated acts — revised ESRS status.
• IAASB ISSA 5000 adoption and implementation and ISSA 5000 Implementation Guide.
• IFRS S1 and IFRS S2.
• SEC proposed rescission of the 2024 climate-related disclosure rules.

Sources and status reviewed September 2, 2026. Recheck EU delegated-act publication, ISSA 5000 jurisdictional adoption, and any applicable reporting regime before beginning an assurance engagement.