CSRD in Austria: Implementation Guide for Auditors

From NaDiVeG to NaBeG: what actually changed

The NaDiVeG (Nachhaltigkeits- und Diversitatsverbesserungsgesetz) has been in force since 2017, implementing the NFRD in Austria. Under the NaDiVeG, large public-interest entities with more than 500 employees were required to include a non-financial statement in their management report (Lagebericht), covering environmental, social, employee, human rights, and anti-corruption matters. The NaDiVeG prescribed no specific reporting standard. Companies used GRI, the Austrian Sustainability and Diversity Improvement Act’s own requirements, or ad hoc formats. No external assurance was required.

The NaBeG changes all of that. Sustainability information must now follow the European Sustainability Reporting Standards (ESRS). Reporting is integrated into the management report, not a standalone document. External limited assurance is mandatory. The double materiality assessment becomes the foundation of the report. And the scope expands beyond PIEs to include all large companies meeting the revised thresholds.

For auditors who worked with NaDiVeG clients, the transition is real. Under the old regime, the non-financial statement was often a few pages in the annual report, prepared with minimal auditor involvement. Under the NaBeG, the sustainability statement requires paragraph-level ESRS compliance and must survive an assurance engagement. At firms like ours, the honest internal conversation is that the first-year work volume for sustainability roughly matches the financial audit itself. That catches partners off guard when they see the budget.

The NaBeG also aligns Austria with the EU Taxonomy Regulation requirements. Wave 1 companies must include Article 8 Taxonomy disclosures in their sustainability statements, reporting on the proportion of their activities that qualify as environmentally sustainable under the Taxonomy’s technical screening criteria. This was already partially required under the NaDiVeG for certain PIEs, but the NaBeG formalises the obligation and links it to the ESRS reporting framework.

Who is in scope and when (post-Omnibus I)

The NaBeG transposes the CSRD in stages, following the EU’s wave structure. But the interaction between the NaBeG and Omnibus I creates a complex transitional picture.

Wave 1 covers large PIEs previously subject to the NaDiVeG. These entities were required to produce CSRD-compliant sustainability reports for financial years beginning on or after 1 January 2024. In Austria, this affects approximately 120 companies. Because the NaBeG entered into force on 19 February 2026, the transitional provisions are important: if an entity’s FY 2025 balance sheet date fell before 19 February 2026, it had no NaBeG obligation for that year (though it could voluntarily adopt CSRD reporting, and the NaDiVeG requirements remained applicable). For calendar-year entities, the NaBeG obligation first applies to the FY 2026 financial year (reported in 2027), unless they voluntarily adopted it earlier for FY 2024 or FY 2025.

Omnibus I allows member states to exempt Wave 1 entities that fall below the revised thresholds (1,000 employees, EUR 450 million net turnover) from reporting for FY 2025 and FY 2026. The NaBeG includes this exemption. Companies previously in scope under the NaDiVeG but below the new Omnibus I thresholds are not required to report under the NaBeG for those years, though they may voluntarily opt in.

Wave 2, covering large non-listed companies meeting the revised thresholds, is not yet addressed by the NaBeG. The Austrian legislator explicitly stated that a separate legislative package will cover this group. Based on Omnibus I timelines, Wave 2 companies will likely report for FY 2027 (published in 2028). For Austrian audit firms, this means the legislation governing Wave 2 assurance engagements hasn’t been enacted yet. Planning is based on the directive and Omnibus I rather than domestic law.

Listed SMEs are removed from mandatory scope by Omnibus I. They may voluntarily report under the VSME standard once adopted (expected June 2026). Non-EU parent companies with qualifying Austrian subsidiaries or branches report from 2029 onward.

The simplified ESRS, which EFRAG published in draft in July 2025 (reducing mandatory datapoints by approximately 61% (EFRAG, Technical Advice on Draft Simplified ESRS, 3 December 2025)), are expected to be formally adopted by the European Commission by September 2026. These may be applied voluntarily for FY 2026 reports and will become mandatory from FY 2027 onward.

The grey zone: FY 2024 and FY 2025 reporting obligations

Austria’s late transposition created practical ambiguity that auditors need to understand. The CSRD required Wave 1 entities to report for financial years beginning on or after 1 January 2024. Austria had no domestic legislation implementing this obligation until 19 February 2026. During that gap, entities operated under the NaDiVeG (which required non-financial reporting but not under ESRS and not with mandatory assurance).

For FY 2024, many Austrian Wave 1 companies chose to prepare their reports under the NaDiVeG while voluntarily incorporating ESRS elements. Some prepared full CSRD-compliant reports on a voluntary basis. The FMA (Austria’s financial market supervisor) encouraged early adoption but couldn’t enforce CSRD requirements without a domestic legal basis.

For FY 2025, the picture depends on the balance sheet date. Calendar-year entities (31 December 2025 balance sheet date) were not subject to the NaBeG for FY 2025 because their balance sheet date fell before the law entered into force. They will first report under the NaBeG for FY 2026. Non-calendar-year entities with balance sheet dates after 19 February 2026 (for example, a 31 March 2026 year-end covering the April 2025 to March 2026 financial year) may already be caught by the NaBeG for their current financial year.

This creates an asymmetry. Two Austrian companies of identical size, both Wave 1 PIEs, may have different first NaBeG reporting years depending solely on their balance sheet date. Auditors must verify each client’s specific situation.

The first thing to do with any Austrian Wave 1 client is confirm the balance sheet date and determine whether the NaBeG applies to the current financial year. If it does not, clarify whether the entity is voluntarily reporting under CSRD/ESRS or continuing under the NaDiVeG for one more cycle. Do not assume the client has worked this out on their own. In our experience, several entities were genuinely unsure which regime applied to them.

Assurance requirements under Austrian law

Under the NaBeG, sustainability reporting is subject to mandatory external limited assurance. The assurance must be performed by a Wirtschaftsprufer (statutory auditor). Austria follows the CSRD’s default position: the statutory auditor performing the financial statement audit also provides the sustainability assurance. Austrian law does not currently permit an Independent Assurance Service Provider (IASP) to perform CSRD assurance.

The FMA supervises assurance quality for PIE audit firms. The KSW (Kammer der Steuerberater und Wirtschaftsprufer) oversees non-PIE auditors and provides guidance on CSRD implementation. For the Wave 2 engagements expected from FY 2027 onward, auditors outside the Big 4 will increasingly be involved, and KSW oversight will be the relevant quality framework.

Until the EU adopts harmonised limited assurance standards (due 1 July 2027 under Omnibus I), Austrian auditors work with ISSA 5000 and the CEAOB’s September 2024 guidelines. The NaBeG does not reference a specific interim assurance standard, leaving practitioners to apply the best available international framework. The FMA has not issued Austria-specific guidance on limited assurance methodology, though the KSW offers workshops and practical toolkits for member firms.

One area that Austrian auditors frequently underestimate is the documentation requirement. The NaBeG requires the sustainability statement to be part of the management report (Lagebericht). The assurance report accompanies this. Austrian document retention rules require all supporting working papers (WPs) to be kept for at least seven years. For a first-year engagement where the entity is still establishing processes and testing estimation methods, the documentation burden is heavier than for a mature financial audit file. If you are used to ticking and bashing through a SALY file, the first CSRD year will feel different. There is no prior-year file to copy from.

The requirement to move from limited assurance to reasonable assurance by 2028 has been deleted by Omnibus I. Limited assurance remains the ceiling for the foreseeable future. This is relevant for Austrian firms planning their investment in CSRD capability: the methodological demands of limited assurance are lower than reasonable assurance, which makes the investment decision more proportionate.

The Austrian market: Wirtschaftsprufer capacity and the Mittelstand

Austria’s audit market is structured differently from Ireland or the Netherlands. Outside the Big 4 (which dominate PIE audits), the market includes a significant number of mid-tier Wirtschaftsprufer firms serving the Mittelstand (medium-sized industrial companies). Many of these firms have audit clients that exceed the Omnibus I thresholds. The Austrian Mittelstand includes manufacturers, construction firms, logistics companies, and specialised industrial groups with 1,000--5,000 employees and EUR 400--900 million in revenue. Several dozen of these entities will fall under Wave 2.

For mid-tier Austrian firms, CSRD assurance is a new service line but also a resource challenge. These clients are unlikely to switch to Big 4 firms solely for sustainability assurance, particularly if the existing auditor can credibly offer the service. But building the team competence and methodology in a compressed timeline is the hard part. Wave 2 legislation could be enacted by late 2026 or early 2027, leaving firms 12 to 18 months to prepare. That timeline is not comfortable. It is the kind of deadline that forces you to choose between doing it properly and doing it on time, and the firms that wait until the legislation passes will have to do both at once.

The KSW has been proactive in supporting member firms. Workshops on ESRS fundamentals and the double materiality assessment process are available through the chamber, along with assurance methodology training. The Wirtschaftskammer Osterreich (WKO, the Austrian Federal Economic Chamber) offers additional resources targeted at companies preparing for CSRD reporting, which auditors should review to understand what their clients are being told.

One practical consideration specific to Austria: the DACH region (Germany, Austria, Switzerland) has significant cross-border economic integration. Many Austrian companies have suppliers in Germany and the Czech Republic, customers across Central Europe, and group structures that span multiple jurisdictions. The value chain reporting requirements under ESRS (particularly Scope 3 emissions and workers in the value chain under ESRS S2) will require Austrian entities to collect data from cross-border operations. Auditors should plan for the complexity and time this adds to the engagement.

How the NaBeG interacts with existing UGB requirements

The Unternehmensgesetzbuch (UGB, Austrian Commercial Code) already contained the NaDiVeG provisions in Section 243b. The NaBeG replaces these with a more detailed framework. But some existing UGB requirements continue to apply alongside the NaBeG.

Section 267b UGB requires certain groups to prepare a consolidated corporate governance report. The NaBeG does not replace this requirement. Where a group is required to produce both a consolidated sustainability statement under the NaBeG and a corporate governance report under Section 267b, the two documents must be consistent. The auditor must cross-reference the sustainability statement’s governance disclosures (ESRS 2 GOV-1 through GOV-5) against the corporate governance report.

For auditors performing both the financial audit (which includes review of the management report under Section 273 UGB) and the sustainability assurance, this creates an integrated engagement. The auditor must verify consistency between financial data and governance disclosures, as well as between governance disclosures and sustainability metrics, across multiple documents. Planning for this integration at the engagement acceptance stage prevents duplication and gaps.

Worked example: CSRD assurance for an Austrian industrial company

Muller Fertigung GmbH is an Austrian manufacturing company based in Linz with 1,500 employees and EUR 490 million in annual revenue. Not listed. The company produces metal components for construction and infrastructure, with suppliers in Austria, Germany, and the Czech Republic. Products are sold across the DACH region and Central Europe. Your firm is a mid-tier Austrian practice and has been Muller's statutory auditor for four years. Muller will fall under Wave 2 once the relevant legislation is enacted, with first reporting expected for FY 2027.

1. Confirm scope and plan for the legislative gap. Muller exceeds the Omnibus I thresholds (1,500 employees, EUR 490 million). As a non-listed large company, it’s Wave 2. The NaBeG does not yet cover Wave 2. The Austrian government has indicated that separate legislation will follow. Plan the engagement assuming FY 2027 is the first reporting year, but monitor the legislative process. If the Wave 2 law isn’t enacted before Muller’s FY 2027 balance sheet date, the same grey zone issue that affected Wave 1 companies may recur.

Documentation note: Record the scope assessment against Omnibus I thresholds. Note that the domestic legal basis for Wave 2 is pending. File a copy of any FMA or KSW guidance published before the engagement start date. Cite Directive (EU) 2026/470 and the NaBeG transitional provisions.

1. Evaluate the double materiality assessment. Muller’s sustainability coordinator (appointed January 2026) ran a DMA with support from an external consultant. Material topics identified: climate change (ESRS E1, 8 IROs including Scope 1 from natural gas furnaces and Scope 2 from electricity), pollution (ESRS E2, 5 IROs including metal dust emissions and wastewater), own workforce (ESRS S1, 6 IROs including health and safety in production and pay equity), and resource use (ESRS E5, 4 IROs related to metal waste recycling and circular economy practices). Water (ESRS E3) was assessed as not material based on Muller’s low water intensity relative to sector benchmarks.

Documentation note: Obtain the full DMA package (methodology, stakeholder engagement, IRO register with scores, threshold definitions). Check whether the consultant’s methodology follows EFRAG IG 1. Evaluate the “not material” determination for water against ESRS 1 paragraph 38. If the simplified ESRS are in force by the time of reporting, verify whether any disclosure requirements changed for the material topics identified.

1. Assess data readiness. Muller tracks energy consumption through its ERP system (SAP). GHG calculations use the GHG Protocol methodology, with Austrian electricity emission factors from the Umweltbundesamt (Federal Environment Agency). Workforce data comes from SAP HR. No formal sustainability data controls exist beyond the quarterly management review. Scope 3 data is limited to Category 1 (purchased goods, estimated using spend-based emission factors from Ecoinvent).

Documentation note: Map each material ESRS disclosure requirement to its data source. Flag the Scope 3 estimation methodology as a high-uncertainty area. Document the emission factors used and their sources. For workforce metrics, verify the HRIS extraction logic against payroll. The absence of formal controls means the engagement will rely heavily on substantive procedures.

1. Execute assurance procedures and report. For Scope 1: recalculate from gas invoices and production records. For Scope 2: verify against electricity invoices and confirm emission factor selection from Umweltbundesamt data. For workforce: test headcount and injury rates against underlying records. For DMA: review methodology, test a sample of impact and financial materiality scores, evaluate the not-material determination for water.

Documentation note: Prepare a standalone limited assurance report under ISSA 5000 and the CEAOB guidelines. Under Austrian law, the report accompanies the management report. Use negative-form conclusion. Retain all working papers for the seven-year Austrian retention period.

Muller’s engagement is estimated at 250--320 hours, with DMA evaluation taking approximately 50 hours, process and controls assessment 60 hours, substantive procedures 100--140 hours, and review and reporting 40 hours. The range reflects uncertainty about Scope 3 data quality, which may require additional testing.

First-year pricing and resource allocation

For Austrian mid-tier firms, the pricing question is as important as the technical one. A 250--320 hour engagement at typical Austrian Wirtschaftsprufer rates represents EUR 50,000--80,000 in fees. Whether clients will accept this depends on how the market develops as Wave 2 legislation passes and competitors begin offering CSRD assurance.

The Big 4 firms in Austria have already built CSRD teams for their PIE clients. They’ll compete for the larger Mittelstand entities. Mid-tier firms have the advantage of existing client relationships and lower overhead, but need to demonstrate competence. Running a pilot engagement (even on a reduced-fee basis) with a willing client before the legislative deadline arrives is the most effective way to build both capability and credibility.

Resource allocation matters. A first-year CSRD engagement requires at minimum one team member with ESRS knowledge (who has completed KSW training or equivalent) and one team member familiar with the client's industry and operations (typically the existing FS audit manager). You also need a reviewer with sustainability assurance experience. If your firm does not have the reviewer internally, consider partnering with a specialist or engaging KSW-accredited experts for the review function. The FMA expects a quality review structure comparable to that for financial audits, even for non-PIE engagements. Do not understaff this. We have seen first-year engagements where the sustainability file was assigned to a single senior who had never opened the ESRS, and the result was predictable.

Practical checklist for Austrian audit firms

Common mistakes in Austrian CSRD engagements

• The FY 2024 and FY 2025 grey zone caught both entities and auditors unprepared. Some Wave 1 companies prepared NaDiVeG reports without ESRS alignment, only to discover that investors and analysts expected CSRD-quality disclosures. Auditors should proactively clarify with clients which framework applies to each financial year, particularly for non-calendar-year entities where the NaBeG effective date creates a mid-year transition.
• The pending Wave 2 legislation creates planning risk. Auditors advising clients to begin their DMA and data readiness work now are making the right call, but the absence of a domestic legal basis means the specific Austrian requirements (including any member state options Austria exercises) won’t be known until the legislation passes. Build the engagement approach on the directive and Omnibus I, and plan to adjust once the domestic law is enacted.

Related ciferi content

Related guides:

Put audit concepts into practice with these free tools:

Frequently asked questions

Further reading and source references

• NaBeG (Nachhaltigkeitsberichtsgesetz): Austria’s Sustainability Reporting Act transposing the CSRD, entered into force 19 February 2026.
• NaDiVeG (Nachhaltigkeits- und Diversitätsverbesserungsgesetz): the predecessor law implementing the NFRD in Austria since 2017.
• Directive (EU) 2026/470 (Omnibus I): the amending directive narrowing CSRD scope to 1,000+ employees and €450M+ turnover.
• KSW guidance and workshops: available through the Kammer der Steuerberater und Wirtschaftsprüfer for CSRD assurance preparation.