ESG and Sustainability Assurance: A Primer for CPAs Under the Attestation Standards

Clients are being asked for ESG data by lenders, customers, investors and, in some places, regulators. Many are asked to have that data checked by an independent party. For a US CPA firm, that request is an attest engagement on something other than financial statements: the subject matter is sustainability information, such as greenhouse gas emissions, energy use, workforce data or climate-related disclosures.

This primer explains the engagement types, what makes criteria suitable, how a greenhouse gas engagement works with a worked example, where the standards are headed and what the regulatory picture looks like today. It is about assurance on the information, not about how a client should build its sustainability strategy.

What counts as sustainability information

It covers environmental, social and governance matters that an entity reports: scope 1, 2 and 3 emissions, energy and water use, waste, injury rates, workforce composition, supply chain practices and the narrative disclosures around climate risk. Information can be quantitative or qualitative, and it can be prepared under a framework (GRI, SASB standards, the ISSB's IFRS S1 and S2, the GHG Protocol) or under criteria the entity develops.

For greenhouse gases, the GHG Protocol's corporate standard sets the categories: scope 1 is direct emissions from sources the entity owns or controls, scope 2 is indirect emissions from purchased electricity, steam, heating and cooling, and scope 3 is other indirect emissions in the value chain.

Engagement types

An examination produces an opinion on whether the subject matter conforms in all material respects with the criteria. A review produces a conclusion stated negatively: nothing came to the practitioner's attention indicating a material misstatement. An agreed-upon procedures engagement reports the procedures and findings, with no opinion or conclusion, and users decide what to make of them. See examination engagements, agreed-upon procedures and the overview of AU-C, AR-C and AT-C standards.

The AICPA's attestation guide on sustainability information, including greenhouse gas emissions information and climate-related financial disclosures, last updated in December 2022, is the main US practice reference.

Suitable criteria

An attest engagement needs criteria that are suitable and available to users. Suitable criteria are relevant, objective, measurable and complete enough to avoid omitting factors that would affect conclusions. For a GHG inventory this means stating the organizational boundary (equity share or control), the operational boundary (which scopes), the base year, the emission factors and their sources, and the global warming potential values used. A report on data "measured in accordance with management's methodology" can be examined, but the methodology must be disclosed so users understand the basis.

How a GHG engagement works

1. Acceptance. Assess competence, independence, the entity's ability to produce the data, and whether the criteria are suitable. Determine whether subject-matter specialists are needed. See using the work of a specialist.
2. Understand the process. How activity data (fuel, electricity, refrigerants, miles) are collected, who reviews them and what systems are used.
3. Assess risks of material misstatement by boundary, data source and estimate.
4. Respond. Test activity data to source documents, test the emission factors against the stated source and year, recompute, and use analytical procedures against prior year and operating drivers.
5. Evaluate misstatements against a materiality level set for the subject matter, not borrowed from the financial statements.
6. Obtain written representations, and report.

Worked example

All figures and factors are illustrative. In practice, use factors published for the relevant region and year, such as those in the EPA's emission factors resources.

A company reports:

• Scope 1: natural gas of 20,000 therms at an illustrative 5.3 kg CO2e per therm = 106,000 kg = 106 metric tons.
• Scope 2, location-based: purchased electricity of 1,200,000 kWh at an illustrative 0.40 kg CO2e per kWh = 480,000 kg = 480 metric tons.
• Total: 106 + 480 = 586 metric tons CO2e.

Testing: the practitioner agrees electricity to the utility invoices and finds 1,236,000 kWh on the invoices, 36,000 kWh more than reported. That is 36,000 / 1,236,000 = 2.9 percent of the activity. At 0.40 kg per kWh, the understatement is 36,000 x 0.40 = 14,400 kg, or 14.4 metric tons, which is 14.4 / 586 = 2.5 percent of the reported total. If the engagement materiality is 5 percent of the total, or 29.3 metric tons, the misstatement is below materiality individually, and the practitioner asks management to correct it and considers it with other misstatements. A small error is still a signal about the completeness of the meter list. Missing locations or meters is the question to ask.

Independence and competence

The AICPA's independence rules apply to attest engagements on sustainability information as they do to financial statement audits. If the firm helps the client build the GHG inventory, that is a nonattest service, and the requirements for nonattest services apply: no management responsibilities, someone at the client with suitable skill to oversee, and documentation. See independence and nonattest services for small firms. The engagement team also needs subject-matter competence, often through engineers or environmental specialists.

Where the standards are heading

• The IAASB issued ISSA 5000, a global standard for sustainability assurance, in November 2024. It is effective for assurance engagements on sustainability information reported for periods beginning on or after December 15, 2026, and it largely replaces ISAE 3410 for greenhouse gas statements.
• The AICPA's Auditing Standards Board has exposed proposed new attestation sections on sustainability information: AT-C 325 for examinations and AT-C 330 for reviews, built on revised AT-C 105, 205 and 210, using ISSA 5000 where appropriate for the US. They were out for comment in 2026. Until they are final, engagements are performed under the existing attestation standards and the AICPA guide.

Regulatory picture

• The SEC adopted climate disclosure rules in 2024. They never took effect, and the SEC stopped defending them in 2025. The litigation has been held in abeyance, and the SEC has moved to rescind the rules.
• Some states have enacted their own climate disclosure laws, with assurance requirements phased in. These laws have been subject to litigation and agency rulemaking, so a client's obligations depend on its footprint in each state. This is a question for the client's legal advisers.
• Voluntary reporting and contractual requests from lenders and customers are the more common driver for private companies.

Common mistakes

• Accepting an engagement without suitable criteria or a stated boundary.
• Using financial statement materiality for non-financial data without thought.
• Testing the calculation but not the completeness of the activity data.
• Relying on the client's emission factors without checking the source and year.
• Issuing an examination-level opinion where the evidence supports review-level work.
• Overlooking independence when the firm also built the inventory.

FAQ

What is the difference between limited and reasonable assurance?

Reasonable assurance, from an examination, is a high level of assurance expressed as an opinion. Limited assurance, from a review, is lower and expressed as a negative conclusion.

Which standard applies to ESG assurance by a US CPA?

The attestation standards: AT-C 105 with AT-C 205 for examinations and AT-C 210 for reviews, supplemented by the AICPA guide. New sustainability-specific sections are in development.

Do companies have to get ESG assurance?

Not under a federal rule in force. The SEC's 2024 climate rules never took effect. Some state laws and some lender or customer contracts do call for it.

Can an auditor also build the client's GHG inventory?

It is a nonattest service. It can be performed for an attest client only if the independence requirements for nonattest services are met.

What are scope 1, 2 and 3 emissions?

Scope 1 is direct emissions, scope 2 is indirect emissions from purchased energy, and scope 3 is other indirect emissions in the value chain.

Sources

• AICPA, Attestation Engagements on Sustainability Information (Including Greenhouse Gas Emissions Information and Climate-Related Financial Disclosures), described in the Journal of Accountancy, May 2026
• AICPA, AT-C sections 105, 205, 210 and 215; ASB exposure drafts of proposed AT-C 325 and 330 (2026)
• IAASB, ISSA 5000 fact sheet and FAQ on ISAE 3410
• World Resources Institute and WBCSD, Greenhouse Gas Protocol Corporate Accounting and Reporting Standard
• Case status for the SEC climate rules: Climate Litigation Database entry for Iowa v. SEC and SEC filings

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error