CSRD and ESRS Assurance Evidence Pack Workflow

Open the evidence pack by identifying the reporting undertaking, whether the file supports an individual sustainability statement, a consolidated sustainability statement, or a third-country sustainability report, and which management-report or annual-financial-report process will publish it.

Then record the assurance provider route under the applicable national law: statutory auditor, audit firm, or independent assurance services provider where the Member State permits one. The CSRD assurance opinion addresses compliance of the sustainability reporting with the Directive and ESRS, the undertaking's process for identifying reported information, Article 8 Taxonomy reporting where relevant, and sustainability markup once that markup requirement applies. An internal readiness review is not that statutory assurance opinion.

Organise the pack around conclusions, not around teams. A reviewer should be able to open a material topic or datapoint and see why it is in the sustainability statement, where the data came from, what control checked it, and how the final wording or number was approved.

Use the same structure for omitted topics. ESRS lets undertakings omit non-material topical disclosures, with special explanation expectations for climate change. The evidence file should preserve the materiality assessment result, the inputs considered, and the reason the omission is supportable. Under the 2023 ESRS, retain the topical process disclosures linked to IRO-1 even for a non-material topic: ESRS 1 paragraph 29 and ESRS 2 Appendix C require these alongside ESRS 2. IRO-1 concerns the process for identifying and assessing impacts, risks and opportunities.

Review judgement-heavy areas before assurance starts: double materiality thresholds, group and value-chain boundaries, estimates where direct value-chain data is not available, omissions, restatements, and public wording that is broader than the underlying evidence.

For each judgement, keep the conclusion next to its basis. The pack should show the evidence considered, alternatives rejected, how consistency was checked across entities or business units, and whether the conclusion changes a disclosure, metric, target, or omission. ESRS does not prescribe one materiality process or universal threshold, so record the undertaking-specific threshold and why it fits the ESRS criteria and facts.

Prepare for digital tagging while drafting, but keep legal status explicit. ESMA states that undertakings are not required to mark up sustainability reporting until markup rules are adopted by delegated regulation. The evidence pack can still preserve how each reported ESRS item maps to statement text, tables, metrics, and a candidate taxonomy concept so later tagging does not require rebuilding the reporting lineage.

For narrative disclosures, keep enough context for the tag reviewer to identify the exact passage being tagged. For metrics and semi-narrative items, keep the unit, period, consolidation boundary, dimensional breakdown, and any calculation support together with the final wording.

The final workflow step is a readiness review, not a legal sign-off. The review should test whether an assurance provider can trace every selected disclosure from ESRS requirement to management judgement, source data, control evidence, approved statement text, and digital-tagging review. ISSA 5000 can inform that readiness review, but it does not by itself determine the binding EU or national standard for the engagement.

Keep the close-out record concise: open items, waived items, management judgements, late changes, control exceptions, and the owner for post-publication improvements. That record helps avoid rebuilding the same evidence trail in the next reporting cycle.