Clients ask for "assurance on our sustainability data" without saying which kind. The choice between an examination and a review drives the work program, the fee, the report and what users can rely on. The AICPA's Auditing Standards Board (ASB) has proposed new sections that spell out the difference for sustainability information. This post explains them, states their status as of November 5, 2026, and gives a way to choose.
For the engagement types in general, start with ESG assurance for CPAs. This post goes deeper on the proposed standards.
Status: exposure drafts, not final standards
The ASB issued two exposure drafts in 2026:
- February 2026: a proposed SSAE that revises AT-C 105 (concepts common to all attestation engagements), AT-C 205 (examination engagements) and AT-C 210 (review engagements), and adds AT-C 325 (examination of sustainability information) and AT-C 330 (review of sustainability information).
- March 2026: conforming amendments to AT-C 305, 310, 315, 320, 215 and 206.
Comments were requested by June 30, 2026. If issued as final, the standards would apply to engagements beginning on or after June 15, 2029. Early implementation of a revised 200-series section requires implementing revised AT-C 105, and early implementation of a 300-series section requires implementing the other applicable proposed sections.
The ASB used the IAASB's ISSA 5000, adjusted where appropriate for the US, together with the AICPA's sustainability attestation guide, as the basis for the added requirements. See GHG emissions assurance under ISSA 5000.
Until a final standard exists, US practitioners work from AT-C 105, 205 and 210 and the AICPA guide.
The building-block structure
The attestation standards are in layers. AT-C 105 is layer 1, with the concepts common to all engagements. The 200-series sections set the level of service (205 examination, 210 review, 215 agreed-upon procedures). The 300-series sections add requirements for particular subject matter. A sustainability engagement is performed under three sections at once: 105, plus 205 or 210, plus 325 or 330. That is the reason the drafts clarify the links between sections.
Examination: AT-C 325
An examination gives reasonable assurance, the highest level the attestation standards provide, and ends in an opinion on whether the sustainability information conforms in all material respects with the criteria.
Under the draft:
- Risk assessment is performed at the level of the underlying assertion.
- The practitioner obtains an understanding of internal control through inquiry and other procedures, covering the control environment, the entity's risk assessment process, its monitoring process, and the information system and communication.
- Further procedures may include tests of controls or substantive procedures, which include tests of details and analytical procedures.
- Performance materiality is set for quantitative disclosures (materiality itself is covered below, since it applies to both levels).
Review: AT-C 330
A review gives limited assurance and ends in a conclusion stated in negative form: nothing came to the practitioner's attention indicating material misstatement.
Under the draft:
- Risk assessment is performed at the level of the sustainability disclosure, not the assertion.
- Understanding of internal control requires inquiry only.
- Limited assurance may still be obtained through inquiries and analytical procedures alone, but tests of details are more likely to be performed than under AT-C 210 alone.
Both reports carry added statements that describe the procedures performed and note that the practitioner's work on internal control is not for the purpose of expressing an opinion on its effectiveness.
Side by side
| Feature | Examination (AT-C 325) | Review (AT-C 330) |
|---|---|---|
| Assurance | Reasonable | Limited |
| Conclusion form | Opinion | Negative-form conclusion |
| Risk assessment level | Assertion | Disclosure |
| Internal control understanding | Inquiry and other procedures | Inquiry |
| Tests of controls | May be performed | Not described in the draft |
| Tests of details | Part of the toolkit | More likely than under AT-C 210 |
Materiality criteria change the work
Under the drafts, for both levels the practitioner considers materiality for qualitative disclosures and determines materiality for quantitative disclosures. Where the criteria require both financial and impact materiality (double materiality), the practitioner takes both into account in setting materiality for planning and performing the engagement and in forming the conclusion. A client reporting under a framework that asks for impact materiality should not receive a workplan built on financial-statement thresholds.
Choosing between them today
Ask four questions at acceptance.
- Who reads it and what do they need? A regulator or lender that names the level settles the question. California's air regulator, at a July 21, 2026 workshop, proposed acceptable assurance standards for Scope 1 and 2 emissions, including AICPA AT-C 210. See California SB 253 and SB 261.
- Does the client have a controls environment for the data? An examination requires an understanding of the control environment, risk assessment, monitoring and the information system. A client whose emissions data comes from a spreadsheet maintained by one person may not support reasonable assurance without remediation first.
- Are the criteria suitable and available? Both levels need them. See the criteria discussion in the primer.
- Do you have the competence? Consider the need for a specialist. See using the work of a specialist.
An agreed-upon procedures engagement under AT-C 215 is a different product: findings with no assurance. See agreed-upon procedures.
Worked example of the choice
Illustrative. A client wants assurance on a Scope 1 and 2 inventory of 586 metric tons CO2e for a lender covenant, and a separate sustainability narrative for its website. The lender's agreement asks for a "limited assurance report." A review of the inventory fits. The website narrative has no named user requirement and no suitable criteria beyond management's own wording, so an engagement on it is declined until criteria are written down.
What to do now
- Read the exposure drafts so engagement letters and workpapers are structured to move to AT-C 325 or 330 later.
- Write acceptance memos that name the level, the criteria and the materiality basis.
- Keep sustainability engagements out of the financial statement audit file. Separate engagement letter, separate file.
FAQ
When would AT-C 325 and 330 take effect?
If issued as final, for engagements beginning on or after June 15, 2029, with early implementation permitted under the conditions described in the draft.
Is a review the same as limited assurance?
Yes. A review under the attestation standards gives limited assurance. An examination gives reasonable assurance.
Do the drafts replace ISSA 5000?
No. They are US attestation standards that use ISSA 5000 as a basis.
Sources
- Journal of Accountancy, Proposed new sustainability information AT-C sections (May 2026)
- Journal of Accountancy, Proposed attestation changes: what CPAs should know (April 2026)
- Journal of Accountancy, AICPA comments on assurance standards for California climate law (April 2026)
- AICPA, AT-C sections 105, 205, 210 and 215, AICPA Professional Standards
CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.
Part of CORAA University · Evidence and audit procedures: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error