CSRD assurance evidence What should teams keep for limited assurance?

The core evidence traces each ESRS requirement to the reported disclosure: materiality assessment, selected disclosure requirements and datapoints, source systems, calculations, estimates, approvals, and final sustainability-statement text.

Limited assurance work still needs evidence that can be tested. Keep records for the process used to identify information included in the management report, value-chain information that was available or unavailable, references to financial-statement amounts, and any explanations for estimates, restatements, prior-period errors, or post-period updates.

CSRD sustainability reporting is placed in a clearly identifiable dedicated section of the management report. Evidence should match the version that management approves for issuance. Preserve working spreadsheets and draft narratives as supporting records, clearly separated from the published version.

If a subsidiary relies on a parent report exemption, the evidence should also retain the parent name, registered office, web links to the consolidated management report and assurance opinion, and the statement that the subsidiary is exempt from its own Article 19a reporting.

The assurance report must identify the entity, the sustainability reporting covered, the date and period covered, and the reporting framework applied. It must also describe the assurance scope, identify the assurance standards used, and include the assurance opinion required by the Accounting Directive as amended by CSRD.

Evidence should let the assurance provider verify the reporting framework, period, scope boundary, standard or national procedure used, and final disclosures covered by the opinion. The opinion covers compliance with ESRS, the process used to identify reported information, digital marking when the marking rules apply, and Article 8 Taxonomy reporting. Where more than one statutory auditor or audit firm is engaged, keep the joint report or separate opinions and reasons for disagreement.

CSRD says Member States must require statutory auditors and audit firms to use assurance standards adopted by the Commission. Until the Commission has adopted an assurance standard covering the same subject matter, Member States may apply national assurance standards, procedures, or requirements.

The evidence file should name the assurance basis actually used for the engagement. If the basis is national, retain the national standard, procedure, or requirement, the Member State communication or adoption reference where available, and the engagement instructions that show how the assurance provider applied it. ISSA 5000 is an international standard, but its publication or general effective date does not by itself make it the legal basis for a CSRD engagement in every Member State.

The current EU-level milestone is the Commission's delegated acts for limited assurance standards. Directive (EU) 2026/470 moves that deadline to 1 July 2027. Until applicable EU standards take effect, teams need to identify the national standards or procedures used for the engagement.

Directive (EU) 2026/470 also removes the former requirement to adopt reasonable assurance standards by 1 October 2028. The superseded date is no longer a future EU obligation.