CSRD Assurance: When to Use ISAE 3000 and When to Use ISAE 3410

The decision: which standard applies to your engagement?

The answer depends on what the assurance conclusion covers. If you’re providing assurance on the full CSRD sustainability statement (or any non-financial subject matter that isn’t specifically a GHG statement), ISAE 3000 (Revised) applies. If you’re providing a separate assurance conclusion specifically on a greenhouse gas statement, ISAE 3410 applies. If you’re doing both, both standards apply to the same engagement.

ISAE 3000 (Revised), issued by the IAASB and effective since December 2015, is the overarching standard for all assurance engagements other than audits or reviews of historical financial information. It covers ethical requirements, quality management, engagement acceptance, planning, evidence gathering, and reporting. Every ISAE standard (3402, 3410, 3420) sits under ISAE 3000 and references it as the parent framework. ISAE 3410 paragraph 2 states explicitly that the practitioner performing an ISAE 3410 engagement also complies with ISAE 3000 (Revised).

For CSRD engagements specifically, the CSRD does not mandate a particular assurance standard. It requires limited assurance from an independent assurance service provider (which, in most EU member states, means the statutory auditor). In practice, the IAASB’s standards have become the de facto framework. EU member states including France, Italy, Spain, and the Netherlands have adopted ISAE 3000 (Revised) as the basis for their national sustainability assurance requirements.

The typical CSRD engagement is a single limited assurance conclusion on the sustainability statement under ISAE 3000 (Revised). GHG data appears within that statement (under ESRS E1-6), and the assurance procedures on the GHG data form part of the overall ISAE 3000 engagement. No separate ISAE 3410 engagement is needed unless someone requests a standalone GHG assurance report.

When does a separate ISAE 3410 engagement arise? Four situations. First: the client participates in a voluntary emissions trading scheme that requires independently assured GHG statements. Second: an investor or lender requires a separate GHG assurance conclusion as a condition of green financing. Third: the client’s group auditor requests a standalone GHG report from a component auditor in a jurisdiction where GHG assurance is conducted separately from sustainability assurance. Fourth: a supply chain sustainability programme contractually requires standalone GHG assurance. In all four cases, the distinguishing factor is the same: someone needs a standalone conclusion on the GHG numbers, separate from the broader sustainability statement.

What ISAE 3000 (Revised) requires for CSRD assurance

ISAE 3000 (Revised) provides the framework for both limited and reasonable assurance engagements. The CSRD currently requires limited assurance.

The standard’s requirements follow the same logical sequence as ISA-based financial audits, adapted for non-financial subject matter. The practitioner must assess the suitability of the criteria (for CSRD, the criteria are the ESRS), assess the risk of material misstatement, design and perform procedures responsive to those risks, evaluate the evidence obtained, and form a conclusion.

For a limited assurance engagement under ISAE 3000, the procedures are primarily inquiry, analytical procedures, and observation. The practitioner is not required to perform the same depth of testing as in a reasonable assurance engagement. ISAE 3000 paragraph 12L specifies that limited assurance procedures are designed to reduce the engagement risk to a level that is acceptable in the circumstances but that is greater than for a reasonable assurance engagement.

The materiality concept under ISAE 3000 requires professional judgement. Unlike ISA 320 for financial audits, there’s no single benchmark. For a CSRD sustainability statement covering environmental, social, and governance topics, materiality may need to be set differently for different ESRS. A 5% variance on GHG emissions may be immaterial, while a misclassification of a fatality in the health and safety disclosure (ESRS S1-14) would always be material regardless of magnitude. Your working paper must document the materiality approach and the rationale for each threshold.

One ISAE 3000 requirement that catches first-time sustainability assurance practitioners is paragraph 46R/46L: the practitioner must consider whether the subject matter information is free of material misstatement, including misstatements from omission. For CSRD, this means evaluating whether the client has reported on all ESRS topics assessed as material in the double materiality assessment. If the client’s materiality assessment determined that ESRS E5 (resource use and circular economy) is material but the sustainability statement contains no E5 disclosures, that omission is itself potentially a material misstatement.

What ISAE 3410 adds for GHG-specific assurance

ISAE 3410 builds on ISAE 3000 with additional requirements specific to greenhouse gas statements. It was designed for engagements where the assurance conclusion covers a standalone GHG statement (typically Scope 1 and Scope 2 emissions, and sometimes Scope 3).

The additional requirements fall into four areas that ISAE 3000 doesn’t address at this level of specificity.

First: emission factor selection. ISAE 3410 paragraph 22 requires the practitioner to evaluate whether the emission factors the client used are appropriate for the client’s specific activities, geographic locations, and fuel types. Under ISAE 3000, you’d assess whether the methodology is reasonable. Under ISAE 3410, you go further: is the specific emission factor for natural gas consumption in the Netherlands (sourced from, say, the RVO CO2-emissiefactoren or the IPCC default factors) the right choice for this client’s operations? If the client switched from one emission factor database to another between reporting periods, ISAE 3410 requires you to evaluate whether the change is justified and adequately disclosed.

Second: boundary completeness. ISAE 3410 paragraph 19 requires the practitioner to obtain an understanding of the client’s GHG boundary (which entities, facilities, and emission sources are included or excluded). For a manufacturing group with ten production facilities, you need to evaluate whether all material emission sources at all facilities are captured. Under ISAE 3000 alone, the boundary question is more generic: is the scope of the subject matter information appropriate?

Third: quantification methodology. ISAE 3410 paragraph 21 requires the practitioner to evaluate the methods used to quantify GHG emissions, including whether measurement data (direct metering, fuel purchase records) or estimation techniques (engineering calculations, modelled outputs) are used appropriately. The standard recognises that GHG quantification involves inherent estimation uncertainty. Your working paper must document the quantification method for each material emission source and assess whether the uncertainty is acceptable.

Fourth: reporting requirements. ISAE 3410 paragraph 69 specifies the content of the assurance report for a GHG engagement, including a description of the applicable criteria, a statement identifying the GHG statement, and a specific conclusion on whether the GHG statement is prepared in all material respects in accordance with the applicable criteria. The report format is more prescribed than the general ISAE 3000 report template.

When you need both standards on the same engagement

This scenario is becoming more common as CSRD reporting matures and investors demand GHG-specific assurance alongside the broader sustainability statement.

The practical answer: you run a single engagement with two conclusions. The ISAE 3000 engagement covers the full sustainability statement. The ISAE 3410 procedures run concurrently for the GHG data within that statement. You issue either one report with two conclusions or two separate reports, depending on the client’s needs and the investor’s requirements.

The efficiency question matters for mid-market firms. If you’re already performing ISAE 3000 limited assurance on the sustainability statement, most of the GHG-related work is done. The incremental effort for an ISAE 3410 engagement focuses on the four areas described above: deeper testing of emission factor selection, boundary completeness assessment, quantification methodology evaluation, and the GHG-specific report. For a client with straightforward Scope 1 and Scope 2 emissions (gas-fired heating, company fleet, purchased electricity), the incremental effort may be 15–20 hours. For a manufacturing client with complex process emissions, the increment could be 40–60 hours.

Your engagement letter must specify both standards when both apply. ISAE 3000 paragraph 10 requires the engagement terms to identify the applicable criteria and the intended level of assurance. When ISAE 3410 also applies, the engagement letter should separately identify the GHG statement, the GHG criteria (e.g., the GHG Protocol Corporate Standard), and the assurance level for the GHG conclusion. Failing to scope the ISAE 3410 component in the engagement letter is a quality management deficiency that an EQCR would flag.

The reporting question deserves attention. When you issue two conclusions, you can do so in one combined report or two separate reports. A combined report is more efficient and avoids the risk of inconsistency between the two documents. But some investors and regulatory programmes specifically require a standalone GHG assurance report (not embedded in a broader document). Ask the client’s investor or programme administrator what format they need before you draft the report. Redoing the report because the format was wrong wastes time you’ve already spent on the substantive work.

For the ISAE 3410 report specifically, paragraph 69 prescribes the elements that must appear. These include identification of the GHG statement being assured, a description of the applicable criteria, a description of the entity’s responsibility versus the practitioner’s responsibility, and the assurance conclusion. If the GHG statement covers only Scope 1 and Scope 2 (which is common for voluntary assurance), make sure the scope limitation is clearly stated in the report. An investor reading the report should immediately understand what’s covered and what isn’t.

ISSA 5000: what changes in December 2026

The IAASB approved ISSA 5000 (International Standard on Sustainability Assurance) in September 2024. It applies to engagements for periods beginning on or after 15 December 2026, with early adoption permitted.

ISSA 5000 replaces ISAE 3000 (Revised) for all sustainability assurance engagements. It’s designed as a standalone standard: when performing sustainability assurance under ISSA 5000, you don’t also apply ISAE 3000. This is a structural change from the current framework, where ISAE 3410 sits under ISAE 3000 and cross-references it.

ISAE 3410 survives, but with a reduced role. ISSA 5000 incorporates the GHG-specific requirements from ISAE 3410, so for most CSRD engagements, ISSA 5000 alone will be sufficient. ISAE 3410 continues to apply only when the practitioner provides a separate conclusion specifically on a GHG statement (as distinct from GHG data within a broader sustainability statement). The IAASB has indicated that ISAE 3410 will eventually be withdrawn once ISSA 5000 is fully effective and the transition is complete.

For practitioners, the transition means learning one new standard rather than navigating the interaction between two existing ones. ISSA 5000 is more specific than ISAE 3000 on sustainability-relevant topics: it addresses estimation uncertainty in sustainability data, forward-looking information (targets, transition plans), qualitative disclosures, and value chain data, none of which ISAE 3000 was designed to handle.

The timing matters for engagement planning. If your client’s financial year ends 31 December 2026, and the sustainability statement covers FY2026, ISSA 5000 is available for that engagement (the period begins on or after 15 December 2026). If the financial year ends 30 June 2027, ISSA 5000 applies. For FY2025 engagements (reports issued in 2026), ISAE 3000 (Revised) remains the applicable standard. Your firm should be planning the methodology transition now, not when the first ISSA 5000 engagement lands.

ISAE 3000 (Revised) continues to apply for all non-sustainability assurance engagements (ISAE 3402 service organisation reports, compliance attestation, etc.). The standard isn’t disappearing. It’s being superseded for sustainability work only.

For mid-market firms, the transition has a practical dimension. Many firms are performing their first CSRD assurance engagements in 2025 and 2026 under ISAE 3000 (Revised). By the time the methodology is bedded down, ISSA 5000 will apply to new engagements. One approach that avoids rework: build your CSRD assurance methodology now using ISSA 5000’s structure (which is modelled on ISAE 3000 but adds sustainability-specific sections), and run FY2025 engagements using ISAE 3000 within that framework. When ISSA 5000 becomes mandatory, the structural transition is minimal.

The IAASB published supplemental materials and an implementation guide in January 2025 to assist practitioners with the transition. These materials map the ISSA 5000 requirements against the existing ISAE 3000 and ISAE 3410 requirements, which makes the gap analysis straightforward.

Worked example: Kuiper Logistics B.V.

Client: Kuiper Logistics B.V. is a mid-market transport and warehousing company based in Rotterdam. Revenue: €54M. Fleet of 86 trucks (diesel), four warehouse facilities, 312 employees. First CSRD reporting year: FY2025. The company’s largest client (38% of revenue) requires a separate GHG assurance report as a condition of their supply chain sustainability programme.

1. Engagement scoping

Two assurance conclusions needed. First: limited assurance on the full CSRD sustainability statement under ISAE 3000 (Revised), covering all material ESRS (E1 climate, E5 resource use, S1 own workforce). Second: limited assurance on the standalone GHG statement (Scope 1 and Scope 2 only) under ISAE 3410, to satisfy the supply chain sustainability programme requirement.

2. ISAE 3000 procedures on the sustainability statement

Materiality set at: 5% of total Scope 1 + Scope 2 emissions for E1, 10% of total waste generated for E5, and a qualitative threshold for S1 (any misclassification of fatalities or material understatement of the accident rate is considered material regardless of percentage).

Procedures: inquiry with the sustainability manager and fleet operations director. Analytical review of GHG emissions against fleet mileage data and fuel purchase records. Recalculation of a sample of emission calculations (selected 12 of 86 trucks, representing the four largest routes). Inspection of waste contractor invoices for E5. Inspection of HRIS records for S1 headcount.

3. ISAE 3410 additional procedures on the GHG statement

The GHG statement covers Scope 1 (diesel fleet emissions, gas heating at four warehouses) and Scope 2 (purchased electricity at four warehouses).

Emission factor assessment: Kuiper uses the RVO CO2-emissiefactoren (2025 edition) for all emission sources. The diesel emission factor is 3.256 kg CO2e per litre (well-to-wheel). Verified that this factor matches the current RVO publication and is applied consistently across the fleet.

Boundary completeness: confirmed all 86 trucks are included in the fleet register. Cross-checked the fuel purchase ledger against fleet records. One truck was sold in October 2025; verified that emissions were included only for the period January–October. Confirmed all four warehouse facilities are included (verified against the property register and electricity supply contracts).

Quantification methodology: fleet emissions calculated from litres of diesel purchased (direct measurement from fuel card records), multiplied by the emission factor. Warehouse gas heating calculated from cubic metres consumed (metered at each facility). Electricity calculated from kWh consumed (invoiced by the supplier). No estimation techniques used for Scope 1 or Scope 2.

4. Reporting

Two reports issued. Report 1: limited assurance conclusion on the full CSRD sustainability statement, citing ISAE 3000 (Revised) and the ESRS as criteria. Report 2: limited assurance conclusion on the standalone GHG statement (12,211 tCO2e), citing ISAE 3410 and the GHG Protocol Corporate Standard as criteria.

Practical checklist

1. At engagement acceptance: determine whether a standalone GHG assurance conclusion is needed in addition to the CSRD sustainability statement conclusion. If yes, both ISAE 3000 and ISAE 3410 apply, and both must be referenced in the engagement letter.
2. When setting materiality for the CSRD engagement under ISAE 3000: set separate materiality thresholds for each material ESRS topic. Document the rationale for each threshold. GHG materiality for the ISAE 3410 component should be consistent with (but may differ from) the materiality used for E1 within the broader ISAE 3000 engagement.
3. For GHG procedures under ISAE 3410: verify emission factors against the published source document (not the client’s internal spreadsheet). Check that the client hasn’t used a prior-year factor when the current-year factor is available.
4. Before December 2026: map your firm’s ISAE 3000 sustainability assurance methodology to the ISSA 5000 requirements. Identify gaps early. ISSA 5000 introduces new requirements on forward-looking information, estimation uncertainty, and value chain data that ISAE 3000 doesn’t cover.
5. For dual-standard engagements: reconcile the GHG figures across both reports before issuing. The GHG number in the CSRD sustainability statement (ESRS E1-6) and the standalone GHG statement must be identical. If the methodologies or boundaries differ, disclose and explain the difference.
6. Check whether the NBA has issued updated guidance for Dutch practitioners performing CSRD assurance. The regulatory interpretation of ISAE 3000 application in the Netherlands may include additional requirements beyond the IAASB standard text.

Common mistakes

• Applying ISAE 3410 to the GHG data within the CSRD sustainability statement when no separate GHG conclusion is required. If the GHG data is part of the broader sustainability statement and you’re issuing one conclusion on that statement, ISAE 3000 (Revised) is sufficient. ISAE 3410 applies only when a separate GHG conclusion is issued.
• Using the same materiality threshold for all ESRS topics under ISAE 3000. A 5% threshold may be appropriate for quantitative GHG emissions but inappropriate for qualitative disclosures on human rights incidents (ESRS S1-17) or governance matters (ESRS G1). Different topics require different thresholds.
• Failing to plan for the ISSA 5000 transition. ISSA 5000 applies from December 2026 and replaces ISAE 3000 for sustainability assurance. Firms that wait until H2 2026 to update their methodology will face a compressed timeline. The IAASB published implementation guidance in January 2025. Start the transition now.

Related Ciferi content

Related guides:

Put audit concepts into practice with these free tools:

Frequently asked questions

Further reading and source references

• ISAE 3000 (Revised), Assurance Engagements Other than Audits or Reviews of Historical Financial Information: the overarching standard for CSRD sustainability assurance.
• ISAE 3410, Assurance Engagements on Greenhouse Gas Statements: the subject-specific standard for standalone GHG assurance.
• ISSA 5000, International Standard on Sustainability Assurance: the IAASB’s standard replacing ISAE 3000 for sustainability engagements, effective December 2026.
• GHG Protocol Corporate Standard: the most commonly used criteria for standalone GHG assurance engagements under ISAE 3410.