CSRD Assurance: When to Use ISAE 3000 and When to Use ISAE 3410

The decision: which standard applies to your engagement?

The answer depends on what the assurance conclusion covers. If you’re providing assurance on the full CSRD sustainability statement (or any non-financial subject matter that isn’t specifically a GHG statement), ISAE 3000 (Revised) applies. If you’re providing a separate assurance conclusion specifically on a greenhouse gas statement, ISAE 3410 applies. If you’re doing both, both standards apply to the same engagement.

ISAE 3000 (Revised), issued by the IAASB and effective since December 2015, is the overarching standard for all assurance engagements other than audits or reviews of historical financial information. It covers ethical requirements, quality management, engagement acceptance, planning, evidence gathering, and reporting. Every subject-specific ISAE standard (3402, 3410, 3420, and future additions) sits under ISAE 3000 and references it as the parent framework. ISAE 3410 paragraph 2 states explicitly that the practitioner performing an ISAE 3410 engagement also complies with ISAE 3000 (Revised).

For CSRD engagements specifically, the CSRD does not mandate a particular assurance standard. It requires limited assurance from an independent assurance service provider (which, in most EU member states, means the statutory auditor). In practice, the IAASB’s standards have become the de facto framework. EU member states including France, Italy, Spain, and the Netherlands have adopted ISAE 3000 (Revised) as the basis for their national sustainability assurance requirements. The NBA (Koninklijke Nederlandse Beroepsorganisatie van Accountants) references ISAE 3000 (Revised) in its guidance for Dutch practitioners performing CSRD assurance.

The typical CSRD engagement is a single limited assurance conclusion on the sustainability statement under ISAE 3000 (Revised). GHG data appears within that statement (under ESRS E1-6), and the assurance procedures on the GHG data form part of the overall ISAE 3000 engagement. No separate ISAE 3410 engagement is needed unless someone requests a standalone GHG assurance report.

When does a separate ISAE 3410 engagement arise? Four situations. First: the client participates in a voluntary emissions trading scheme that requires independently assured GHG statements. Second: an investor or lender requires a separate GHG assurance conclusion as a condition of green financing. Third: the client voluntarily seeks reasonable assurance on GHG data while maintaining limited assurance on the broader sustainability statement. Fourth: the client’s group auditor requests a standalone GHG report from a component auditor in a jurisdiction where GHG assurance is conducted separately from sustainability assurance. In all four cases, the distinguishing factor is the same: someone needs a standalone conclusion on the GHG numbers, separate from the broader sustainability statement.

What ISAE 3000 (Revised) requires for CSRD assurance

ISAE 3000 (Revised) provides the framework for both limited and reasonable assurance engagements. The CSRD currently requires limited assurance, with a possible move to reasonable assurance in the future (the European Commission is required to assess this by October 2028).

The standard’s requirements follow the same logical sequence as ISA-based financial audits, adapted for non-financial subject matter. The practitioner must assess the suitability of the criteria (for CSRD, the criteria are the ESRS), assess the risk of material misstatement, design and perform procedures responsive to those risks, evaluate the evidence obtained, and form a conclusion.

For a limited assurance engagement under ISAE 3000, the procedures are primarily inquiry and analytical procedures, supplemented by observation and inspection where relevant. The practitioner is not required to perform the same depth of testing as in a reasonable assurance engagement. ISAE 3000 paragraph 12L specifies that limited assurance procedures are designed to reduce the engagement risk to a level that is acceptable in the circumstances but that is greater than for a reasonable assurance engagement. The practical effect: you’re asking “is there anything that causes us to believe the sustainability statement is materially misstated?” rather than “have we obtained sufficient evidence to conclude it is not materially misstated?”

The materiality concept under ISAE 3000 requires professional judgement. Unlike ISA 320 for financial audits, there’s no single benchmark. For a CSRD sustainability statement covering environmental, social, and governance topics, materiality may need to be set differently for different ESRS. A 5% variance on GHG emissions may be immaterial, while a misclassification of a fatality in the health and safety disclosure (ESRS S1-14) would always be material regardless of magnitude. Your working paper must document the materiality approach and the rationale for each threshold. The file should tell a story: a reviewer reading the materiality section should understand why you picked different numbers for different ESRS topics without having to ask you.

One ISAE 3000 requirement that catches first-time sustainability assurance practitioners is paragraph 46R/46L: the practitioner must consider whether the subject matter information is free of material misstatement, including misstatements from omission. For CSRD, this means evaluating whether the client has reported on all ESRS topics assessed as material in the double materiality assessment. If the client’s materiality assessment determined that ESRS E5 (resource use and circular economy) is material but the sustainability statement contains no E5 disclosures, that omission is itself potentially a material misstatement.

What ISAE 3410 adds for GHG-specific assurance

ISAE 3410 builds on ISAE 3000 with additional requirements specific to greenhouse gas statements. It was designed for engagements where the assurance conclusion covers a standalone GHG statement (typically Scope 1 and Scope 2 emissions, and sometimes Scope 3).

The additional requirements fall into four areas that ISAE 3000 doesn’t address at this level of specificity.

First: emission factor selection. ISAE 3410 paragraph 22 requires the practitioner to evaluate whether the emission factors the client used are appropriate for the client’s specific activities, geographic locations, and fuel types. Under ISAE 3000, you’d assess whether the methodology is reasonable. Under ISAE 3410, you go further: is the specific emission factor for natural gas consumption in the Netherlands (sourced from, say, the RVO CO2-emissiefactoren or the IPCC default factors) the right choice for this client’s operations? If the client switched from one emission factor database to another between reporting periods, ISAE 3410 requires you to evaluate whether the change is justified and adequately disclosed.

Second: boundary completeness. ISAE 3410 paragraph 19 requires the practitioner to obtain an understanding of the client’s GHG boundary (which entities, facilities, and emission sources are included or excluded). For a manufacturing group with ten production facilities, you need to evaluate whether all material emission sources at all facilities are captured. Under ISAE 3000 alone, the boundary question is more generic: is the scope of the subject matter information appropriate?

Third: quantification methodology. ISAE 3410 paragraph 21 requires the practitioner to evaluate the methods used to quantify GHG emissions, including whether measurement data (direct metering, fuel purchase records) or estimation techniques (engineering calculations, modelled outputs) are used appropriately. The standard recognises that GHG quantification involves inherent estimation uncertainty. Your working paper must document the quantification method for each material emission source and assess whether the uncertainty is acceptable.

Fourth: reporting requirements. ISAE 3410 paragraph 69 prescribes the assurance report content for a GHG engagement more tightly than the general ISAE 3000 report template.

The ISA 520 Analytical Review Calculator can support your GHG analytical procedures by benchmarking year-over-year emission intensity ratios against production volume changes.

When you need both standards on the same engagement

This is the scenario from the opening paragraph, and it’s becoming more common as CSRD reporting matures and investors demand GHG-specific assurance alongside the broader sustainability statement.

The practical answer: you run a single engagement with two conclusions. The ISAE 3000 engagement covers the full sustainability statement. The ISAE 3410 procedures run concurrently for the GHG data within that statement. You issue either one report with two conclusions or two separate reports. In our experience, most clients prefer the combined report unless the investor has specified otherwise.

The efficiency question matters for mid-market firms. If you’re already performing ISAE 3000 limited assurance on the sustainability statement, most of the GHG-related work is done. The incremental effort for an ISAE 3410 engagement focuses on the four areas described above: deeper testing of emission factor selection, boundary completeness assessment, quantification methodology evaluation, and the GHG-specific report. For a client with straightforward Scope 1 and Scope 2 emissions (gas-fired heating, company fleet, purchased electricity, no process emissions), the incremental effort may be 15-20 hours. For a manufacturing client with complex process emissions, the increment could be 40-60 hours.

Your engagement letter must specify both standards when both apply. ISAE 3000 paragraph 10 requires the engagement terms to identify the applicable criteria and the intended level of assurance. When ISAE 3410 also applies, the engagement letter should separately identify the GHG statement, the GHG criteria (e.g., the GHG Protocol Corporate Standard), the assurance level for the GHG conclusion, and the intended report format.

The reporting question deserves attention. When you issue two conclusions, you can do so in one combined report or two separate reports. A combined report is more efficient and avoids the risk of inconsistency between the two documents. But some investors and regulatory programmes specifically require a standalone GHG assurance report (not embedded in a broader document). We’ve seen this on about half the engagements where green financing is involved. Ask the client’s investor or programme administrator what format they need before you draft the report. Redoing the report because the format was wrong wastes time you’ve already spent on the substantive work.

For the ISAE 3410 report specifically, paragraph 69 prescribes the elements that must appear. These include identification of the GHG statement being assured, a description of the applicable criteria, a description of the entity’s responsibility versus the practitioner’s responsibility, and the assurance conclusion. If the GHG statement covers only Scope 1 and Scope 2 (which is common for voluntary assurance), make sure the scope limitation is clearly stated in the report. An investor reading the report should immediately understand what’s covered and what isn’t.

ISSA 5000: what changes in December 2026

The IAASB approved ISSA 5000 (International Standard on Sustainability Assurance) in September 2024. It applies to engagements for periods beginning on or after 15 December 2026, with early adoption permitted.

ISSA 5000 replaces ISAE 3000 (Revised) for all sustainability assurance engagements. It’s designed as a standalone standard: when performing sustainability assurance under ISSA 5000, you don’t also apply ISAE 3000. This is a structural change from the current framework, where ISAE 3410 sits under ISAE 3000 and cross-references it.

ISAE 3410 survives, but with a reduced role. ISSA 5000 incorporates the GHG-specific requirements from ISAE 3410, so for most CSRD engagements, ISSA 5000 alone will be sufficient. ISAE 3410 continues to apply only when the practitioner provides a separate conclusion specifically on a GHG statement (as distinct from GHG data within a broader sustainability statement). The IAASB has indicated that ISAE 3410 will eventually be withdrawn once ISSA 5000 is fully effective and the transition is complete.

For practitioners, the transition means learning one new standard rather than working across two existing ones. ISSA 5000 is more specific than ISAE 3000 on sustainability-relevant topics: it addresses estimation uncertainty in sustainability data, forward-looking information (targets, transition plans), qualitative disclosures, and value chain data, none of which ISAE 3000 was designed to handle.

The timing matters for engagement planning. If your client’s financial year ends 31 December 2026, and the sustainability statement covers FY2026, ISSA 5000 is available for that engagement (the period begins on or after 15 December 2026). If the financial year ends 30 June 2027, ISSA 5000 applies. For FY2025 engagements (reports issued in 2026), ISAE 3000 (Revised) remains the applicable standard. Your firm should be planning the methodology transition now, not when the first ISSA 5000 engagement lands.

ISAE 3000 (Revised) continues to apply for all non-sustainability assurance engagements (ISAE 3402 service organisation reports, compliance attestation, etc.). The standard isn’t disappearing. It’s being superseded for sustainability work only.

For mid-market Dutch firms, the transition has a practical dimension. Many SRA member firms are performing their first CSRD assurance engagements in 2025 and 2026 under ISAE 3000 (Revised). By the time the methodology is bedded down, ISSA 5000 will apply to new engagements. The risk of methodology fatigue is real. Nobody enjoys rebuilding their approach file a second time in two years, but that is what waiting will cost you. One approach that avoids rework: build your CSRD assurance methodology now using ISSA 5000’s structure (which is modelled on ISAE 3000 but adds sustainability-specific sections), and run FY2025 engagements using ISAE 3000 within that framework. When ISSA 5000 becomes mandatory, the structural transition is minimal.

The IAASB published supplemental materials and an implementation guide in January 2025 to assist practitioners with the transition. These materials map the ISSA 5000 requirements against the existing ISAE 3000 and ISAE 3410 requirements, which makes the gap analysis straightforward. Your firm’s quality management partner should have these materials in hand already.

Worked example: Kuiper Logistics B.V.

Kuiper Logistics B.V. is a mid-market transport and warehousing company based in Rotterdam. Revenue: €54M. Fleet of 86 trucks (diesel), four warehouse facilities, 312 employees. First CSRD reporting year: FY2025. The company’s largest client (38% of revenue) requires a separate GHG assurance report as a condition of their supply chain sustainability programme.

Documentation note: Document the emission factor source (RVO 2025) and verify the factor against the published document. For the fleet, reconcile total litres purchased to the fuel card provider’s annual statement. For electricity, reconcile kWh to supplier invoices for all four facilities. Document that no Scope 3 emissions are included in the standalone GHG statement and state the reason (the supply chain programme requires Scope 1 and 2 only).

Practical checklist

Common mistakes

• Applying ISAE 3410 to the GHG data within the CSRD sustainability statement when no separate GHG conclusion is required. This turns the engagement into a tick box exercise against two standards when one would do. If the GHG data is part of the broader sustainability statement and you’re issuing one conclusion on that statement, ISAE 3000 (Revised) is sufficient. ISAE 3410 applies only when a separate GHG conclusion is issued.
• Using the same materiality threshold for all ESRS topics under ISAE 3000. A 5% threshold may be appropriate for quantitative GHG emissions but inappropriate for qualitative disclosures on human rights incidents (ESRS S1-17) or governance matters (ESRS G1). The EY EU Taxonomy Barometer 2025 noted that many practitioners were unprepared for the level of evidence auditors required for objectives beyond climate change. The same principle applies to materiality: different topics require different thresholds.
• Failing to plan for the ISSA 5000 transition. ISSA 5000 applies from December 2026 and replaces ISAE 3000 for sustainability assurance. Firms that wait until H2 2026 to update their methodology will face a compressed timeline. The IAASB published implementation guidance in January 2025. Start the transition now.

Related content

• Double materiality: ciferi glossary entry on the assessment framework that determines which ESRS topics are in scope for the CSRD sustainability statement (and therefore in scope for your ISAE 3000 assurance engagement).
• ISA 520 Analytical Review Calculator: supports the analytical procedures on GHG data by benchmarking emission intensity ratios against production or revenue metrics.
• How to plan a first-year CSRD limited assurance engagement: covers the full engagement planning process from acceptance through reporting, including the transition from financial audit methodology to sustainability assurance methodology.

Related ciferi content

Related guides:

Put audit concepts into practice with these free tools:

Frequently asked questions

Further reading and source references

• ISAE 3000 (Revised), Assurance Engagements Other than Audits or Reviews of Historical Financial Information: the overarching standard for CSRD sustainability assurance.
• ISAE 3410, Assurance Engagements on Greenhouse Gas Statements: the subject-specific standard for standalone GHG assurance.
• ISSA 5000, International Standard on Sustainability Assurance: the IAASB’s standard replacing ISAE 3000 for sustainability engagements, effective December 2026.
• GHG Protocol Corporate Standard: the most commonly used criteria for standalone GHG assurance engagements under ISAE 3410.