EU CSRD (Directive (EU) 2022/2464) Assurance ready controls and evidence

Auditors and other assurance providers will start by asking how the entity boundary, group boundary, and materiality process were established. If these are unstable, every downstream disclosure becomes fragile.

Keep an approved reporting boundary memo, a double materiality methodology, threshold logic, interview records, and a final IRO decision log.

Every reported metric should have a clear path back to source systems, transformations, assumptions, and reviewer sign off. This is especially important for value chain estimates, scenario based narratives, and any metric built from multiple source systems.

Do not allow manual last mile changes without a controlled log. Those changes become almost impossible to defend later.

Many assurance findings come from narrative disclosures that are not fully supported by evidence. If the report says a policy applies group wide, an action is implemented, or a target is monitored, there should be approved documentation behind that statement.

Narrative control should therefore sit beside metric control, not outside it.

The assurance opinion also looks at the requirement to mark up sustainability reporting. Markup cannot be treated as a final formatting step performed without content owners. Tagging choices, package validation, and publication quality checks need their own controls.

Where ESEF or XHTML publication rules apply, the final report package should be rehearsed before close.

The Commission must adopt limited assurance standards by 1 October 2026 and may later move toward reasonable assurance standards, with a target date no later than 1 October 2028 for delegated acts if feasible. Until Union assurance standards are in force for a subject, Member States may apply national assurance standards, procedures, or requirements.

That means you should build a control system strong enough for current limited assurance and flexible enough to mature further if the assurance depth increases.