ESG assurance means an independent practitioner checks sustainability information, such as emissions or workforce data, and gives a conclusion on whether it is fairly reported against stated criteria. The practitioner tests the reporting criteria, the materiality process, the data and controls behind each number, and any estimates. How deep they go depends on whether the engagement is limited or reasonable assurance.
Last reviewed: 17 October 2026. Facts checked. We searched for how limited and reasonable assurance differ in sustainability engagements and what the practitioner tests under ISSA 5000. The results were secondary commentary (ACCA, Chartered Accountants ANZ, training providers and others). We did not open the IAASB's ISSA 5000 text, so we state no effective date or issue date. One search result gave an approval date that conflicts with our existing ISSA 5000 guide, so we left dates out. Check the IAASB and SEBI/ICAI for current requirements.
What the practitioner starts with
Before any testing, the practitioner confirms that an engagement can be done at all.
- Subject matter: is it a suitable thing to assure, for example total emissions for a year?
- Criteria: the rules the information is measured against. They must be suitable and available to users. They may be a regulator's format, such as BRSR in India, or a recognised reporting framework.
- Responsibilities: management prepares the information. The practitioner expresses a conclusion.
- Access: to records, people and, where needed, sites.
If the criteria are vague, the conclusion would be vague too. This step often decides whether the work is workable.
Limited versus reasonable assurance
| Limited assurance | Reasonable assurance | |
|---|---|---|
| Procedures | Narrower | Much more extensive |
| Conclusion | Negative form: nothing has come to attention to suggest material misstatement | Positive form, like an audit opinion |
| Risk assessment | Commentary says at disclosure level | Commentary says at assertion level |
| Testing of controls | Understanding needed; testing operating effectiveness not required | Testing needed if the practitioner intends to rely on controls |
The level is usually set by the reporting requirement, not chosen freely. Our guide to reasonable vs limited assurance explains the general idea under ISAE 3000.
What gets tested
1. Materiality: the choice of what to report
Which topics matter enough to include? Where a framework asks for it, the practitioner looks at how management decided what is material, including whether a significant topic was left out. Ask: who was consulted, what was scored, what was dropped and why?
2. Data collection and controls
Most ESG numbers come from many sources: meter readings, utility bills, HR systems, supplier data. The practitioner asks how each number travels from source to report.
| Disclosure type | Typical source | What gets tested |
|---|---|---|
| Energy and emissions | Utility bills, fuel records, meter data | Completeness of sites; tracing to bills; unit conversion; emission factor choice and source |
| Water and waste | Meter logs, disposal records | Source documents; sample of sites; consistency of boundaries |
| Workforce data | HR system | Headcount agreed to HR; definitions (for example of "employee" or "worker"); injury records |
| Governance | Board minutes, policies | Documents exist, dated and approved; matches what is stated |
| Supplier data | Questionnaires and reports | How data is collected, checked and sampled |
Typical test steps: recalculate, trace to source, compare year on year, and ask for explanations when numbers move.
3. Boundaries and consistency
Does the report cover the same entities as the financial statements, or a different set? Were acquisitions, closures and joint ventures handled the same way as last year? Boundary changes are a common cause of misstatement.
4. Estimates and forward-looking information
Some ESG information is estimated or looks ahead, such as emissions from suppliers or targets for future years. Commentary says ISSA 5000 has dedicated requirements here that differ between limited and reasonable assurance. In practice the practitioner tests the method, the assumptions and the data used, and checks that uncertainty is explained.
5. Presentation and claims
Do the words match the numbers? Is a statement such as "reduced emissions" supported by the data, with the same base year and scope? Are limitations disclosed?
What management can do to prepare
- Write down the criteria and definitions used for each indicator.
- Keep a data trail from source to report for every number.
- Name an owner for each indicator.
- Run internal checks before the assurance provider does. Our BRSR ESG internal audit checklist is a practical start.
- Keep the working files: sources, conversion factors, calculations and approvals.
Why internal audit should care
Internal audit can give early assurance on data controls, so the external provider finds fewer surprises. It also fits the idea of combined assurance: management checks, internal audit reviews, and the external provider concludes.
Frequently Asked Questions
Is ESG assurance the same as an ESG audit?
People use the terms loosely. Assurance is the correct term for an independent conclusion on sustainability information. The level, limited or reasonable, defines how much work is done.
Who can give assurance on a BRSR in India?
We did not verify current Indian requirements for who may provide it. Check SEBI circulars and ICAI guidance. Our BRSR reporting guide covers the background.
Do assurance providers test every number?
No. They select disclosures and sample sources, based on risk and the level of assurance.
What is the biggest data risk?
Incomplete boundaries and unclear definitions are frequent causes. Manual spreadsheets also add risk. We have no verified statistic to give.
What is ISSA 5000?
It is the IAASB's standard for sustainability assurance engagements. For details and dates, see our ISSA 5000 guide and the IAASB's own text.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error