CSRD in Belgium: Requirements for Audit Firms

How Belgium transposed the CSRD

Belgium published its CSRD transposition law on 20 December 2024, five months after the EU deadline. The European Commission had already opened infringement proceedings in September 2024 against Belgium and 16 other member states. If you’re a réviseur d’entreprises preparing for your first sustainability assurance engagement, the rules are now in force but the IBR/IRE is still finalising the professional standard. That gap between legal obligation and practical guidance is where most of the risk sits right now.

The Belgian Parliament approved the CSRD transposition on 28 November 2024. The Law of 2 December 2024 was published in the Belgian State Gazette (Moniteur Belge) on 20 December 2024 and entered into force on 30 December 2024.

The Belgian legislator opted for transposition without significant gold-plating. The law amends the Code des sociétés et des associations (CSA), the Law of 7 December 2016 on the organisation of the profession and public supervision of company auditors, and the Law of 2 August 2002 on financial sector supervision.

A few specific Belgian choices matter for practitioners. First, Belgium adopted a progressive approach to who can provide sustainability assurance. During the initial years, only réviseurs d’entreprises can perform the statutory assurance engagement. The market will open to independent assurance service providers no earlier than 20 December 2027, three years after the law’s publication. That opening requires a Royal Decree to establish the framework conditions, and the IBR/IRE has been vocal about ensuring those conditions create a level playing field.

Second, Belgium explicitly addressed the value chain trickle-down problem. The law prohibits in-scope companies from requiring assurance of sustainability information from SMEs in their value chain. Voluntary assurance remains an option for those SMEs, and for voluntary engagements the market is open to any qualified professional. This distinction between statutory and voluntary assurance is critical for firms serving Belgian SME clients who are feeling pressure from their larger customers.

Third, the commissaire (statutory auditor for financial statements) has the option, not the obligation, to issue an integrated report. When the same réviseur d’entreprises is appointed for both the statutory audit and the sustainability assurance engagement, they can either produce a single integrated report or issue a separate sustainability assurance report. Most firms will choose separate reports during these first years, given the different methodological frameworks involved.

Fourth, the law defines sustainability information under a new Article 1:31/2 of the CSA. This matters because the definition determines the boundary of what the assurance engagement covers. Information published voluntarily outside this definition does not trigger the statutory assurance requirement. But information within the definition that is published in the management report does.

The Belgian Council of State (Conseil d’État) reviewed the draft bill and raised a procedural point: the law uses the term “opinion” for the sustainability assurance conclusion, even though the engagement is a limited assurance engagement that technically produces a “conclusion.” The IBR/IRE’s technical notes address this terminological inconsistency and confirm that the engagement methodology follows the limited assurance model under ISAE 3000 (Revised), regardless of the statutory label.

The three-wave Belgian timeline

Belgium’s original CSRD timeline mirrors the EU directive’s phased approach. Each wave is defined by entity size and public-interest status.

Wave 1 (FY 2024, reports published 2025): Large Belgian public-interest entities already subject to the NFRD. This means large companies with securities listed on an EU regulated market, credit institutions, and insurance companies with more than 500 employees. These entities have been reporting since January 2025.

Wave 2 (FY 2025, reports published 2026): Other large Belgian undertakings meeting at least two of the following criteria (on an individual or consolidated basis): 250+ employees, €25M+ balance sheet total, €50M+ annual turnover.

Wave 3 (FY 2026, reports published 2027): Listed Belgian SMEs (excluding micro-companies), with a two-year opt-out option pushing the latest start to FY 2028.

Non-EU companies (FY 2028, reports published 2029): Third-country groups with €150M+ EU-generated revenue and at least one large EU subsidiary or branch.

The IBR/IRE estimated that at least 2,280 Belgian companies exceed the Wave 2 size criteria based on 2021 annual accounts filed with the National Bank of Belgium (Banque Nationale de Belgique). Those companies produced €126B in value added, representing 46% of all value added reported through the BNB’s standard filing format.

The timeline has shifted. The Stop-the-Clock Directive (adopted April 2025) postponed Wave 2 by two years (to FY 2027, reports in 2028) and Wave 3 by two years (to FY 2028, reports in 2029). Belgium introduced legislation to implement Stop-the-Clock, though the formal adoption process overlapped with the Omnibus I negotiations.

For audit firms, the delayed timeline creates a planning paradox. You don’t need to deliver assurance reports for Wave 2 clients until 2028. But if you haven’t started building the engagement methodology and training the team by now, you won’t be ready when the deadline arrives.

What Omnibus I changed for Belgian companies

The Omnibus I Directive (Directive 2026/470, published 26 February 2026) restructures the CSRD scope at EU level. The new mandatory thresholds require exceeding both 1,000 employees and €450M net annual turnover. Listed SMEs are removed from scope entirely. Financial holding companies are exempted.

For Belgium, this means the vast majority of those 2,280 companies that the IBR/IRE identified as in scope under the original thresholds will fall out. A company with 600 employees and €200M turnover is no longer subject to mandatory CSRD reporting.

Member states must transpose Omnibus I by 19 March 2027. Belgium has not yet adopted implementing legislation. Until transposition, the original Belgian CSRD law (30 December 2024) remains the applicable legal framework. Wave 1 entities continue reporting under the existing rules regardless.

The Omnibus I Directive gives member states the option to exempt Wave 1 entities that fall below the new thresholds for FY 2025 and FY 2026. Whether Belgium exercises this option will depend on the transposition legislation. The IBR/IRE and the FSMA (Financial Services and Markets Authority) are monitoring this closely.

For Belgian audit firms, the Omnibus I changes create a bifurcated market. A small number of very large companies (multinationals, listed groups, financial institutions) will remain in scope for mandatory CSRD reporting and statutory assurance. A much larger number of companies that were preparing for Wave 2 will need to decide whether to report voluntarily. Value chain pressure from their larger customers will be the primary driver, and the VSME standard (published by the European Commission in July 2025) provides the reporting framework for voluntary adopters.

The IBR/IRE has positioned the réviseur d’entreprises as the natural choice for voluntary sustainability assurance as well. Its 2024 ESG brochure emphasises that sustainability assurance expertise, combined with existing audit relationships, gives réviseurs d’entreprises a structural advantage. But the voluntary market is unregulated. Accounting firms (ITAA members), ESG consultancies, and specialist assurance providers can all compete for voluntary engagements.

Who can provide sustainability assurance in Belgium

The Belgian transposition follows the directive’s member state option to allow both the commissaire and another réviseur d’entreprises to provide sustainability assurance. During the initial period (until at least 20 December 2027), only réviseurs d’entreprises can perform the statutory assurance engagement.

After the three-year exclusive period, independent assurance service providers may apply for accreditation under a framework to be established by Royal Decree. The IBR/IRE’s position is that these providers must meet identical requirements to réviseurs d’entreprises. That means equivalent stage exams and CPD, equivalent independence and ethical rules, equivalent firm organisation standards. It also means public supervision by the Collège de supervision on the same terms.

The appointment process follows the same governance path as a statutory audit. The entity’s general meeting of shareholders appoints the réviseur d’entreprises for the sustainability assurance engagement. If the commissaire is also appointed for sustainability assurance, they can choose between an integrated report and a separate report.

Professional secrecy rules apply. The law extends professional secrecy to all facts encountered during the sustainability assurance engagement. The law also permits information sharing between the commissaire and the réviseur d’entreprises when they are performing different missions (financial audit and sustainability assurance) for the same entity. This carve-out is necessary because, without it, the strict secrecy provisions would prevent the two professionals from coordinating on inconsistencies between the financial statements and the sustainability report.

The IBR/IRE professional standard and what it requires

The IBR/IRE submitted its draft professional standard for sustainability assurance engagements to the Conseil supérieur des Professions économiques (CSPE) and the Minister of the Economy on 5 July 2024. The approval process has been lengthy. The CSPE held its first hearing on 21 August 2024. After the law was published on 20 December 2024, the IBR/IRE Council adopted the modified draft standard on 14 January 2025. A second CSPE hearing was held on 17 March 2025.

The draft standard requires the application of ISAE 3000 (Revised) as the primary engagement standard. It also references ISAE 3400 for forward-looking sustainability information (targets, transition plans, projected impacts). The standard adds Belgian-specific provisions in four areas: engagement letters, assurance reports, the impact on the commissaire’s statutory audit report, and the réviseur d’entreprises’ role vis-à-vis the works council (conseil d’entreprise).

The European Commission must adopt harmonised limited assurance standards by 1 July 2027 (per Omnibus I). Until then, the IBR/IRE standard governs Belgian engagements. This creates a transitional window where Belgian practitioners need to master both ISAE 3000 (Revised) and the IBR/IRE’s specific provisions simultaneously. Once the EU standard is adopted, another transition will follow.

The IBR/IRE has published supporting materials through its ESG platform. Two technical notes are particularly relevant. The first (published 18 February 2025) covered which entities must publish sustainability information and the scope of the CSRD in Belgian law. The second is dedicated to the assurance engagement itself: the procedures, the report format, the interaction with the commissaire’s statutory audit report, and the réviseur d’entreprises’ role regarding the works council.

For practitioners already experienced with ISAE 3000, the Belgian framework adds procedural layers but does not fundamentally change the engagement methodology. The core tasks remain: understanding the entity’s double materiality assessment and evaluating the process for preparing sustainability information. From that foundation, the practitioner performs analytical procedures and inquiries before expressing a limited assurance conclusion in negative form.

What is new is the scale. A sustainability assurance engagement for a large Belgian industrial group touches environmental data (emissions calculations, energy consumption, waste metrics, water usage), social data (workforce demographics, health and safety indicators, training hours, collective bargaining coverage), and governance data (board composition, anti-corruption policies, supplier due diligence). The réviseur d’entreprises needs subject-matter expertise that goes well beyond the traditional financial audit skill set.

For mid-tier Belgian firms, the competence gap is the most immediate operational risk. Environmental data verification (particularly Scope 1 and Scope 2 emissions under ESRS E1) requires technical knowledge that most financial audit teams do not hold. The IBR/IRE expects practitioners to either develop this expertise internally or engage specialists under ISAE 3000’s provisions for using the work of an expert. Documenting the basis for relying on a specialist, and assessing that specialist’s competence and independence, will be a focus area during early inspections by the Collège de supervision. Firms that have not yet mapped their competence gaps against the full set of ESRS disclosure requirements are behind schedule.

Worked example: assessing a Belgian Wave 2 client

Client: Janssens Bouwgroep NV, Antwerp. Annual revenue: €95M | Balance sheet total: €38M | Employees: 420 | Listed: No | Sector: Construction

Under the original Belgian CSRD law (Wave 2 scope)

Janssens exceeds all three criteria: 420 employees (exceeds 250), €38M balance sheet (exceeds €25M), €95M turnover (exceeds €50M). Only two are required under Article 1:24 of the CSA.

Under the original timeline, Janssens would report for FY 2025 with the sustainability report published in 2026. Stop-the-Clock delayed this to FY 2027 (reports published 2028).

The réviseur d’entreprises would plan a limited assurance engagement under ISAE 3000 (Revised), applying the IBR/IRE’s professional standard once approved. The engagement would cover the ESRS sustainability report and the double materiality assessment, plus the EU Taxonomy disclosures required under Article 8 of the Taxonomy Regulation.

After Omnibus I (revised scope, effective for FY 2027 onwards)

Janssens has 420 employees and €95M turnover. The Omnibus I thresholds require exceeding both 1,000 employees and €450M net turnover. Janssens falls below both by a wide margin.

Under Stop-the-Clock, Wave 2 was delayed to FY 2027. Under Omnibus I, Janssens falls out of scope from FY 2027 onwards. The net result: Janssens will likely never be required to file a mandatory CSRD sustainability report.

Janssens holds a framework contract with a listed Belgian infrastructure group (2,800 employees, €1.4B revenue). That group falls within the CSRD scope under Omnibus I and will request sustainability data from its supply chain. Janssens qualifies as a protected undertaking (fewer than 1,000 employees) and can limit its response to information covered by the VSME standard.

The file tells a clear story: the entity was in scope under the original law. The rules changed twice. The entity fell out of scope, and the engagement shifted from statutory to voluntary. The engagement framework changed accordingly.

Practical checklist for Belgian audit firms

1. Re-assess every Belgian client against the Omnibus I thresholds (1,000+ employees and €450M+ net turnover). For clients that fall out of scope, document the exit and discuss voluntary reporting with management.
2. For Wave 1 clients that remain in scope, confirm the réviseur d’entreprises’ appointment has been formalised at the general meeting. If the commissaire was not appointed for sustainability assurance, verify that a separate réviseur d’entreprises has been designated.
3. Access the IBR/IRE’s ESG platform for the latest technical notes and model documents. The platform also hosts the approved standard (or draft standard if approval is still pending). Do not rely on generic ISAE 3000 templates. Belgian-specific provisions on engagement letters and reporting formats apply.
4. Verify that at least one engagement team member has completed the IBR/IRE’s sustainability assurance CPD modules. The training programme covers ESRS content and double materiality methodology. A separate track addresses ISAE 3000 (Revised) applied to sustainability data.
5. For clients in the value chain of larger CSRD-reporting entities, prepare to advise on VSME-level reporting. These clients are protected undertakings under Omnibus I and cannot be forced to provide information beyond the VSME standard. Position the firm to offer voluntary assurance engagements on this information.
6. Monitor the Belgian transposition of Omnibus I. The deadline is 19 March 2027. The treatment of Wave 1 entities below the new thresholds, and the framework for independent assurance service provider accreditation (due by 20 December 2027), will both affect your engagement pipeline.

Common mistakes in Belgian CSRD engagements

• Assuming all large Belgian companies remain in scope: The Omnibus I scope reduction removes the majority of Wave 2 entities. Firms that have already invested in engagement planning for these clients need to pivot to voluntary assurance offerings or communicate the scope change clearly.
• Conflating the commissaire’s role with sustainability assurance: These are separate mandates under Belgian law, even when performed by the same person. The independence analysis, the engagement letter, and the report are distinct. The IBR/IRE’s technical notes address this explicitly. The Collège de supervision will inspect sustainability assurance files separately from financial audit files.
• Waiting for the IBR/IRE standard to be formally approved: The standard has been in draft since July 2024. Its core methodology (ISAE 3000 Revised) is stable and widely understood. Waiting for formal approval means losing a full engagement cycle of preparation time.

Related Ciferi content

Related guides:

Put audit concepts into practice with these free tools:

Frequently asked questions

Further reading and source references

• Law of 2 December 2024: the Belgian CSRD transposition law, published in the Moniteur Belge on 20 December 2024.
• IBR/IRE ESG platform: technical notes, model documents, and the draft professional standard for sustainability assurance engagements.
• Directive (EU) 2026/470 (Omnibus I): the amending directive narrowing CSRD scope to 1,000+ employees and €450M+ turnover.
• ISAE 3000 (Revised): the primary engagement standard referenced by the IBR/IRE’s professional standard for Belgian CSRD assurance.