CSRD assurance evidence What should teams keep for limited assurance?

The core evidence is not a generic policy note. It is the chain from ESRS requirement to reported disclosure: materiality assessment, selected disclosure requirements and datapoints, source systems, calculations, estimates, approvals, and final sustainability-statement text.

Limited assurance work still needs evidence that can be tested. Keep records for the process used to identify information included in the management report, value-chain information that was available or unavailable, references to financial-statement amounts, and any explanations for estimates, restatements, prior-period errors, or post-period updates.

CSRD sustainability reporting is placed in a clearly identifiable dedicated section of the management report. Evidence should therefore match the version that management approves for issuance, not a spreadsheet or draft narrative that later diverges from the published report.

If a subsidiary relies on a parent report exemption, the evidence should also retain the parent name, registered office, web links to the consolidated management report and assurance opinion, and the statement that the subsidiary is exempt from its own Article 19a reporting.

The assurance report must identify the entity, the sustainability reporting covered, the date and period covered, and the reporting framework applied. It must also describe the assurance scope, identify the assurance standards used, and include the assurance opinion required by the Accounting Directive as amended by CSRD.

Evidence should therefore let the assurance provider verify the reporting framework, the period, the scope boundary, the standard or national procedure used, and the final disclosures that the opinion covers. Where more than one statutory auditor or audit firm is engaged, keep the joint report or separate opinions and reasons for disagreement.

CSRD says Member States must require statutory auditors and audit firms to use assurance standards adopted by the Commission. Until the Commission has adopted an assurance standard covering the same subject matter, Member States may apply national assurance standards, procedures, or requirements.

The evidence file should name the assurance basis actually used for the engagement. If the basis is national, retain the national standard, procedure, or requirement, the Member State communication or adoption reference where available, and the engagement instructions that show how the assurance provider applied it.

The CSRD milestone to track is the Commission's delegated acts for assurance standards. The Directive requires limited assurance standards no later than 1 October 2026, covering procedures such as engagement planning, risk consideration, responses to risks, and the type of conclusions in the assurance report or audit report.

It also requires reasonable assurance standards no later than 1 October 2028, following an assessment of whether reasonable assurance is feasible for auditors and undertakings. The delegated acts may specify the date from which the sustainability assurance opinion must be based on a reasonable assurance engagement.