More ESG Research and Insights are Available from GC Insights Contact: info@gc-insights.com for more information.
While sustainability-related reporting has evolved, key deliverables, oversights, and the involved compliance risks of sustainability-related assurance remain inconclusive. Generally speaking, companies, especially public companies rely on sustainability-related information assurance or ESG assurance to:
Build confidence in its ESG reporting
Fine-tune reporting and create an audit trail
Attain visibility across the value chain
Establish ownership for ESG reporting
Mitigate compliance risks, such as the EU Corporate Sustainability Reporting Directive (effective from 2024) and/or the US SEC’s proposal on Enhancement And Standardisation Of Climate-Related Disclosures - both require phased-in limited assurance towards reasonable assurance.
The EU Corporate Sustainability Reporting Directive (CSRD) imposes an audit requirement for sustainability reports, with phase-in limited assurance (a negative form of assurance stating that no matter has been identified by the auditor to conclude that the subject matter is materially misstated - a review) before October 1, 2026, towards reasonable assurance (assured at the same level as a financial statement audit) by October 1, 2028. GHG emissions would be subject to the same assurance as other sustainability information.
Under SEC’s Proposal on Enhancement And Standardisation Of Climate-Related Disclosures, footnote disclosure would be subject to assurance through the financial statement audit and internal control over financial reporting attestation requirements. Outside of the footnotes, only Scope 1 and Scope 2 GHG emissions would be subject to the required assurance. Scope 1 and scope 2 emissions would be subject to limited assurance in years two and three for large accelerated and accelerated filers, transitioning to reasonable assurance (Reasonable assurance will require more extensive procedures, including consideration of a company’s internal controls - an audit) beginning in year four.
While the International Financial Reporting Standards Foundation (IFRS)’s recently finalized International Sustainability Standards Board (ISSB)’s IFRS-Sustainability Disclosure Standards, which will be adopted by more nations as mentioned in the last issues and endorsed by The International Organization of Securities Commissions (IOSCO), has announced that sustainability information would be subject to assurance based on the rules of the jurisdictions adopting the standards.
Existing Standards for Sustainability-Relates Assurance
The mainstream sustainability-relates assurance standards including, ISAE 3000 (revised) on Assurance Engagements other than Audits or Reviews of Historical Financial Information, ISAE 3410 on Assurance Engagements on Greenhouse Gas Statements, the Extended External Reporting (EER) Guidance and ISO 14065 and the IESBA’s International Code of Ethics for Professional Accountants (including International Independence Standards).
Some of the jurisdictions adopted regional-based assurance standards, for example, US public company auditors used the American Institute of Certified Public Accountants (AICPA) Attestation Standards (including AT-C section 105 Concepts Common to All Attestation Engagements, AT-C section 205 Assertion-Based Examination Engagements and AT-C section 210 Review Engagements) to perform their assurance engagements.
Non-US-based public company auditors used the International Standard on Assurance Engagements ISAE 3000 (Revised) Assurance Engagements other than Audits or Reviews of Historical Financial Information (ISAE 3000). Cross-regional public company auditors might even use both the AICPA attestation standards and ISAE 3000 to perform their assurance engagement.
Some used the International Standardisation Organization (ISO) Standards (either ISO 14064-3: Greenhouse gases — Part 3: Specification with guidance for the verification and validation of greenhouse gas statements or ISO 14065: General principles and requirements for Bodies validating and verifying environmental information).
A study from the Center For Audit Quality (CAQ) found that S&P 500 companies referenced the following assurance/verification standards commonly used by other providers as well: International Auditing and Assurance Standards Board (IAASB) Standards (either International Standard on Assurance Engagements ISAE 3000 (Revised), Assurance Engagements Other than Audits or Reviews of Historical Financial Information or ISAE 3410, Assurance Engagements on Greenhouse Gas Statements) or Account Ability’s AA1000 Assurance Standard. Link
State of Play
However, as the International Federation of Accountants (IFAC) discovered in its “The State Of Play: Sustainability Disclosure & Assurance 2019-2021 Trends & Analysis” published in Feb 2023, 64% of the companies that discolored ESG data obtained assurance in 2021, and the International Auditing and Assurance Standards Board’s (IAASB) International Standard on Assurance Engagements 3000 (ISAE 3000 Revised) remained the most widely used assurance standard.
The International Organization of Securities Commissions (IOSCO) has in a statement published in Sep 2022, welcomes both the IAASB’s (The International Auditing and Assurance Standards Board) and IESBA’s (International Ethics Standards Board for Accountants) plans to develop sustainability-related standards that build on the requirements and principles of these existing standards –that could apply irrespective of whether an assurance engagement is provided by an audit firm or a non-audit firm.
The International Standard on Sustainability Assurance (ISSA) 5000
The International Auditing and Assurance Standards Board (IAASB) develops auditing and assurance standards and guidance for use by all professional accountants under a shared standard-setting process involving the Public Interest Oversight Board, which oversees the activities of the IAASB, and the IAASB Consultative Advisory Group, which provides public interest input into the development of the standards and guidance. The structures and processes that support the operations of the IAASB are facilitated by the International Foundation for Ethics and Audit (IFEA).
This International Standard on Sustainability Assurance (ISSA) 5000 introduced by the IAASB deals with assurance engagements on sustainability information. This ISSA applies to all assurance engagements on sustainability information, except when the practitioner is providing a separate conclusion on a greenhouse gas (GHG) statement, in which case ISAE 3410 applies.
With the goal of enhancing the trust and confidence investors, regulators and other stakeholders have in sustainability information, the IAASB has proposed the International Standards On Sustainability Assurance ISSA 5000 standard to serve as a comprehensive, stand-alone standard suitable for any sustainability assurance engagements. It will apply to sustainability information reported across any sustainability topic and prepared under multiple frameworks. The proposed standard is also profession agnostic, supporting its use by both professional accountants and non-accountant assurance practitioners. Link to proposal
The Scope of ESG Assurance
The scope of ESG assurance can range from a single metric, such as greenhouse gas emissions, to a full sustainability report. Levels of assurance may be limited (also referred to as a review) or reasonable (also referred to as an examination). Some ESG assurance might cover ESG Linked Finance related Assurance, in which case, the register shall indicate whether such auditors are registered for carrying out the financial audit, the assurance of sustainability reporting, or both.
For purposes of this newly introduced ISSA 5000, sustainability information is information about sustainability matters. An entity’s disclosures about such matters may relate to several different topics (e.g., climate, labor practices, biodiversity) and aspects of topics (e.g., risks and opportunities, governance, metrics and key performance indicators). Law or regulation or sustainability reporting frameworks may describe sustainability matters, topics or aspects of topics in different ways, and may also provide guidance for the entity in determining the sustainability information to be reported. This ISSA applies to all assurance engagements on sustainability information, except when the practitioner is providing a separate conclusion on a greenhouse gas (GHG) statement, in which case ISAE 3410 applies.
The scope of the assurance engagement may extend to all of the sustainability information expected to be reported by the entity or only part of that information. For example, in certain jurisdictions, law or regulation may require that only climate-related disclosures in an entity’s sustainability information be subject to assurance. When the assurance engagement does not cover the entirety of the sustainability information, the term “sustainability information” is to be read as the information that is subject to the assurance engagement. Sustainability information not subject to the assurance engagement that is included in a document or documents containing the sustainability information subject to the assurance engagement and the assurance report thereon is “other information”.
According to the EU Commission, in order for the statutory auditor ("statutory auditor' means a natural person who is approved in accordance with this Directive by the competent authorities of a Member State to carry out statutory audits and, where applicable, assurance engagements of sustainability reporting) to also be approved to carry out assurance engagements of sustainability reporting, it shall also cover at least the following subjects:
legal requirements and reporting standards relating to the preparation of annual and consolidated sustainability reporting;
sustainability analysis;
due diligence processes with regard to sustainability matters;
legal requirements and assurance standards for sustainability reporting;
The EU CSRD ESG Assurance
Under the CSRD Article 26a Assurance standards for sustainability reporting, EU member states may apply national assurance standards, procedures, or requirements as long as the Commission has not adopted an assurance standard covering the same subject matter. The EU Commission shall be empowered to adopt, by means of delegated acts in accordance with Article 48a, limited assurance standards before October 1, 2026, in order to set out the procedures that the auditor shall perform in order to draw its conclusions on the assurance of sustainability reporting, including engagement planning, risk consideration and repose to risks and type of conclusions to be included in the audit report.
In order for the statutory auditor or the trainee to also be approved to carry out assurance engagements of sustainability reporting, at least eight months of such practical training shall be in the assurance of annual and consolidated sustainability reporting or other sustainability-related services. An aptitude test is required, which shall cover the statutory auditor's adequate knowledge of the laws and regulations of that host Member State in so far as it is relevant to the assurance of sustainability reporting.
In order to ensure the quality and reliability of the reporting, the sustainability reports of third-country undertakings should be published alongside an assurance opinion by a person or firm authorized to give an opinion on the assurance of sustainability reporting, either under the national law of the third country undertaking or of a Member State. In the event that such an assurance opinion was not provided, the subsidiary or branch should issue a statement indicating that the third country undertaking did not provide the necessary assurance opinion.
GC Insights
As global policy scrutiny over ESG data quality and validated sustainability disclosures, ESG-related assurance will play a bigger role in assuring quality ESG engagement and disclosure information. While ESG assurance regulations will unfold gradually, companies could start their sustainability reporting as reporting requirements grow with oversight of limited assurance and assurance over data collection processes, such as materiality settings which could be challenging and crucial to get things right from the start. With ESG Connector - GC Insights proprietary ESG reporting platform, reporting companies could take comfort in understand their reporting requirements within the selected framework(s) and become clear with exactly where to place their sustainability messages. ESG Connector is available for demo here.