CSRD and ESRS assurance-ready controls and evidence

Use ESRS 2 GOV-5 as the control spine for assurance preparation. GOV-5 asks for the main features of risk management and internal controls over the sustainability reporting process, including scope, risk assessment approach, main risks, mitigations, integration of findings into internal functions, and periodic reporting to governance bodies.

A practical control file should therefore identify the reporting process owner, the systems and spreadsheets in scope, the data owners for each disclosure area, the review checkpoints, the main risk of misstatement, and the corrective controls used before publication.

The materiality assessment is the starting point for ESRS reporting, so assurance evidence needs to show how the company identified and assessed impacts, risks, and opportunities. The file should not only list topics; it should preserve the criteria, stakeholder inputs, thresholds or scoring logic, source data, review comments, and final rationale for each material or non-material conclusion.

For every material IRO, keep the link to the affected ESRS disclosure requirement, related policy, action, target, metric, and reporting location. For omitted topical disclosures, keep the assessment record that explains why the topic was not material, and treat climate-change omissions with extra care because ESRS calls for a detailed explanation when E1 is assessed as not material.

Assurance-ready ESRS reporting needs a datapoint inventory, not only a narrative outline. EFRAG IG 3 describes the sector-agnostic ESRS datapoints and is useful for organizing disclosure owners, source systems, evidence types, and gap analysis, while the ESRS legal text remains the authoritative requirement.

Value-chain information needs separate controls because it often comes from suppliers, customers, public sources, estimates, or internal procurement systems. Where ESRS permits transitional handling because information is not available, keep evidence of the efforts made to obtain the information, why it could not be obtained, and plans to improve future collection.

CSRD assurance covers more than whether a sustainability statement exists. The assurance opinion addresses compliance with the Directive, the ESRS, the process used to identify reported information, the markup requirement, and Article 8 Taxonomy reporting requirements where applicable.

Prepare a single assurance index that points from the final sustainability statement to the control matrix, materiality file, datapoint inventory, value-chain evidence, estimate support, approval trail, and XBRL tagging review. The assurance provider should be able to select a disclosure and find the source evidence without relying on informal explanations.

A useful CSRD evidence file should be structured enough for repeatable assurance work across reporting periods. Treat each disclosure as a record with source, control, judgment, and publication fields rather than as a folder of disconnected attachments.

The most important design choice is traceability: the same IRO, policy, action, target, metric, and datapoint identifiers should appear in the materiality file, data inventory, control matrix, report draft, XBRL tagging review, and assurance request log.