Reasonable assurance is a high, but not absolute, level of confidence, given through an audit-type opinion. Limited assurance is a lower level, given through a review-type conclusion with less work behind it. ISAE 3000 (Revised) is the international standard for assurance engagements that are not audits or reviews of historical financial information. Both levels are real assurance. They differ in how much evidence the practitioner gathers.
Last reviewed: 17 October 2026. Facts checked. We confirmed that the IAASB issued ISAE 3000 (Revised) in 2013, effective for reports dated on or after 15 December 2015, from a secondary summary. We did not read the final text of the definitions paragraphs, and we did not verify ICAI's equivalent standard number or any reporting requirement in Indian regulations. Check those before relying on this page.
What assurance means
An assurance engagement is one where a practitioner gathers evidence to reach a conclusion that increases confidence in some information. The information is called the subject matter information. It could be a sustainability report, a controls description or a compliance statement.
Assurance is never a guarantee. The question is how much confidence the practitioner is giving, and the answer is one of two levels.
The two levels
| Reasonable assurance | Limited assurance | |
|---|---|---|
| Confidence | High, but not absolute | Meaningful, but lower |
| Evidence work | Extensive: testing, corroboration, detailed procedures | Less: mainly enquiry and analytical procedures, with limited testing |
| Conclusion style | Positive: "in our opinion, the information is fairly stated" | Negative: "nothing has come to our attention that causes us to believe it is materially misstated" |
| Cost and time | Higher | Lower |
| Familiar example | Audit of financial statements | Review of interim financial information |
The negative wording of a limited assurance conclusion is not a loophole. It signals that less work was done. Readers should treat the two levels differently.
What ISAE 3000 (Revised) covers
The full title is "Assurance Engagements Other Than Audits or Reviews of Historical Financial Information". It sets requirements for the practitioner on matters such as:
- accepting the engagement and checking that the subject matter is suitable,
- agreeing criteria against which the information is measured,
- planning and obtaining evidence,
- using the work of others,
- forming a conclusion,
- writing the assurance report.
It covers both reasonable and limited assurance, and both attestation engagements (where the practitioner assures information prepared by someone else) and direct engagements.
It sits above more specific standards. IAASB has issued topic-specific ISAEs, for example for service organisation controls and greenhouse gas statements. Sustainability reporting has its own newer standard, covered in our ISSA 5000 guide. In India, the ICAI issues its own assurance standards, so check the current ICAI pronouncement for engagements under Indian rules.
Where you meet these engagements
- ESG and sustainability reports, as in BRSR assurance,
- reports on internal controls,
- statements of compliance,
- key performance indicators in annual reports,
- service provider controls reports.
Choosing a level
- Who is the user? A regulator or lender may require a specific level.
- What risk does the user carry? Higher stakes point to reasonable assurance.
- What can the entity support? Reasonable assurance needs strong systems and records. If the records are weak, the engagement may not be feasible at that level.
- What does it cost? Limited assurance is a sensible first step for new reporting areas. Many entities begin there and move up.
What the practitioner needs first
Before accepting, the practitioner should be satisfied that:
- the subject matter is identifiable,
- the criteria are suitable and available to users,
- enough evidence can be obtained,
- the report will be in a form that fits the engagement.
If criteria are vague, no level of assurance is meaningful. This is why many ESG engagements begin by clarifying the criteria.
A short example
A company publishes a sustainability report with a figure for total electricity used. A practitioner engaged for limited assurance might ask how the figure was compiled, compare it with prior years and with utility bills in total, and test a few sites. A practitioner engaged for reasonable assurance would go further: test the data at more sites, trace readings to source meters and bills, and test the controls over data collection.
Both can give a useful conclusion. The reader needs to know which level was given, so the report must say so clearly.
How this relates to internal audit
Internal audit is not a formal assurance engagement under ISAE 3000. It follows internal audit standards and reports to the board. But the language is similar. Internal audit gives assurance to management and the governing body, and the levels of work still matter. See combined assurance and the three lines model.
Frequently Asked Questions
What is the difference between reasonable and limited assurance?
Reasonable assurance gives high confidence through extensive evidence. Limited assurance gives lower confidence through less evidence.
What does ISAE 3000 apply to?
Assurance engagements that are not audits or reviews of historical financial information, such as sustainability or controls reporting.
Is an audit reasonable assurance?
Yes. An audit of financial statements gives reasonable assurance, not a guarantee.
Why is limited assurance worded negatively?
The conclusion states that nothing has been found, because less work was done. It is not a statement that the information is correct.
Does ISAE 3000 apply in India?
Indian practitioners follow ICAI standards. Check the current ICAI standard for assurance engagements and any regulator rules.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error