Your Sustainability Report Now Needs an Audit Trail Like Your Books.

The CSRD requires assurance for companies in scope. Accountancy Europe explains that the directive introduced an EU-wide requirement for limited assurance over sustainability reporting, beginning with 2024 ESRS reports published in 2025. The later stop-the-clock Directive postponed application for large companies that had not yet started reporting and for listed SMEs, but it did not remove assurance for companies in scope for a reporting year.

An external practitioner examines the sustainability statement and issues a conclusion. Sorena AI ESG compliance helps teams keep the underlying data and evidence traceable.

An assurance engagement tests the reported information. Accountancy Europe describes a risk-based process across planning, execution, and reporting. The practitioner understands the company's environment and internal controls, then gathers and evaluates evidence by asking management, testing controls, analysing transactions and documents, and obtaining third-party confirmations.

KPMG explains that reasonable assurance follows a methodology similar to an audit: understand the company, review its controls, identify risks, and perform detailed testing before forming a conclusion. Limited assurance is less extensive but still tests whether reported figures have support.

The current requirement is limited assurance, while EU law allows a later move to reasonable assurance. The Commission may adopt reasonable assurance standards by 1 October 2028 after assessing whether the transition is feasible for companies and practitioners.

Accountancy Europe explains that a limited engagement uses fewer procedures and gathers less evidence. KPMG compares reasonable assurance with a full audit opinion and limited assurance with a lighter review. Both require evidence, but reasonable assurance involves more extensive testing. Build a traceable process that can support deeper testing if the standard changes.

Pick one reported ESG metric and test its evidence trail. The file should show the source record, reporting period, calculation method, owner, reviewer, version history, assumptions, control performed, exception handling, and final sign-off. If the disclosure is an Article 8 KPI, connect it to the EU Taxonomy eligibility and alignment evidence too.

The process must show where the number came from, who changed or reviewed it, and why the company considers it complete.

Missing or untestable data can affect the assurance conclusion. KPMG expects modified opinions to be relatively common in the early years when key data is missing or lacks sufficient quality or granularity. KPMG compares this with a qualified audit opinion while noting that it may not be as serious.

A reported number must be traceable to a source. ESG data often lives in spreadsheets, email threads, and one-off extracts that are difficult to reconstruct months later. If the practitioner cannot test a figure, the assurance conclusion may reflect that limitation.

Treat ESG data like financial data from the start. Every reported figure should trace to a source, carry an owner, and record how it was produced. An external practitioner can then retrieve and test the evidence instead of stopping at missing data.

Sorena AI Assessment Autopilot builds obligations from authoritative source texts, assigns clear owners, and tracks evidence as work progresses. Humans decide what the company reports; the system keeps every figure traceable to its source and ready for assurance review. When assurance season arrives, the materials should already exist.

The EU's common limited-assurance standard is still being developed. Directive (EU) 2026/470 moved the Commission's adoption deadline from 1 October 2026 to 1 July 2027. Until the EU standard is adopted, Member States may use national assurance standards, procedures, or requirements. The IAASB has also adopted ISSA 5000 as a global sustainability-assurance standard.

Companies cannot choose every standard that may govern an engagement, but they can keep their data sourced, owned, and traceable. That evidence trail supports review under the current rules and reduces rework if the standards change.

For in-scope companies, the sustainability statement is subject to assurance. A practitioner tests evidence, traces figures, and publishes a conclusion. Keep the underlying data sourced, owned, and traceable so each reported figure can be reviewed.