CSRD and ESRS assurance-ready controls and evidence

Use ESRS 2 GOV-5 to organise the reporting-control evidence for assurance preparation. GOV-5 asks for the main features of risk management and internal controls over the sustainability reporting process, including scope, risk assessment approach, main risks, mitigations, integration of findings into internal functions, and periodic reporting to governance bodies.

A practical control file should identify the reporting process owner, systems and spreadsheets in scope, data owners for each disclosure area, review checkpoints, risks of misstatement, and controls used before publication. Separate control design, evidence that the control was performed, exceptions, remediation, and any conclusion about operating effectiveness.

The materiality assessment is the starting point for ESRS reporting, so assurance evidence needs to show how the company identified and assessed impacts, risks, and opportunities. The record should preserve the ESRS criteria, undertaking-specific thresholds or scoring logic, source data, relevant stakeholder inputs, review comments, and rationale for each material or non-material conclusion. ESRS does not prescribe one process or universal threshold.

For every material IRO, keep the link to the affected ESRS disclosure requirement, related policy, action, target, metric, and reporting location. For omitted topical disclosures, keep the assessment record that explains why the topic was not material, and treat climate-change omissions with extra care because ESRS calls for a detailed explanation when E1 is assessed as not material.

Assurance-ready ESRS reporting needs a datapoint inventory, not only a narrative outline. EFRAG IG 3 describes the sector-agnostic ESRS datapoints and is useful for organizing disclosure owners, source systems, evidence types, and gap analysis, while the ESRS legal text remains the authoritative requirement.

Value-chain information needs separate controls because it often comes from suppliers, customers, public sources, estimates, or internal procurement systems. Where direct information is unavailable after reasonable effort, retain the basis for estimates or proxies, the reasonable and supportable information used, accuracy limits, and planned actions to improve accuracy. Keep any applicable phase-in analysis separate from the general estimation rule.

CSRD assurance covers more than whether a sustainability statement exists. The assurance opinion addresses compliance with the Directive and applicable ESRS, the process used to identify reported information, Article 8 Taxonomy reporting where relevant, and sustainability markup once that requirement applies. ESMA states that sustainability markup is not required until the relevant rules are adopted by delegated regulation.

Prepare a single assurance index that points from the final sustainability statement to the control matrix, materiality file, datapoint inventory, value-chain evidence, estimate support, approval trail, and XBRL tagging review. The assurance provider should be able to select a disclosure and find the source evidence without relying on informal explanations.

A useful CSRD evidence file should be structured enough for repeatable assurance work across reporting periods. Treat each disclosure as a record with source, control, judgment, and publication fields rather than as a folder of disconnected attachments.

The most important design choice is traceability: the same IRO, policy, action, target, metric, and datapoint identifiers should appear in the materiality file, data inventory, control matrix, report draft, XBRL tagging review, and assurance request log.