CSRD in Italy: Auditor Obligations

What D.Lgs. 125/2024 changed for Italian auditors

D.Lgs. 125/2024 replaces the previous non-financial reporting regime under D.Lgs. 254/2016. The core change: sustainability reporting is no longer a separate statement (dichiarazione non finanziaria, or DNF) but an integrated part of the management report (relazione sulla gestione). This elevates sustainability information to the same legal status as financial information.

The decree requires sustainability reports to comply with the ESRS, the double materiality principle, and the ESEF digital format (XHTML with XBRL tagging). Reports must cover environmental, social, human rights, and governance factors.

For auditors, the most significant change is the shift from the previous regime, where the statutory auditor merely certified the submission and basic presentation of the DNF, to a substantive limited assurance engagement on the sustainability report’s accuracy and ESRS compliance. Under the old D.Lgs. 254/2016, the auditor checked that a non-financial statement existed and was properly presented. Under D.Lgs. 125/2024, the auditor must form a conclusion on whether the sustainability report is free from material misstatement and complies with the applicable ESRS. This is a fundamental increase in scope and responsibility.

Italy did not exercise the CSRD’s member state option to allow independent assurance services providers (IASPs) other than statutory auditors. Only revisori legali and imprese di revisione registered in the Registro dei Revisori Legali and specifically authorised for sustainability assurance can issue the attestation. The decree text (Article 8) is explicit: the attestazione must be performed by a revisore legale or impresa di revisione authorised for sustainability assurance. This can be the same firm that audits the financial statements, or a different one.

The decree introduces the figure of the “revisore della sostenibilità” (sustainability auditor), a term used to describe a revisore legale specifically authorised to perform sustainability assurance work. This is not a separate professional designation (unlike Germany’s Nachhaltigkeitsprüfer); it’s an authorisation linked to the existing revisore legale registration.

Sustainability auditor registration and authorisation

To perform sustainability assurance in Italy, a revisore legale must be registered in the Registro dei Revisori Legali and hold a specific authorisation for sustainability assurance work. The MEF, in consultation with the Ministry of Justice and Consob, is responsible for defining the content and procedures for this authorisation application.

The requirement applies to both individual revisori legali and imprese di revisione. For audit firms, the engagement partner responsible for signing the sustainability assurance opinion must individually hold the authorisation. The firm itself must also be authorised.

Grandfathering provisions exist for revisori legali who qualified before 1 January 2024. These auditors can obtain the sustainability authorisation through a transitional pathway that includes a professional development requirement. The specifics of this CPD requirement were still being finalised in early 2026 through a ministerial decree. Revisori legali qualifying after 1 January 2024 face a broader knowledge requirement covering sustainability reporting standards, legal requirements, and practical training.

EU-based audit firms registered in another member state can apply for registration in Italy’s Registro and for sustainability assurance authorisation, provided the engagement partner meets the Italian requirements. This matters for cross-border groups where the group auditor is based outside Italy but the Italian subsidiary requires standalone sustainability assurance.

There is a practical timing issue. D.Lgs. 125/2024 entered into force in September 2024, and Wave 1 companies (large PIEs with 500+ employees) were required to report for FY2024 with sustainability assurance. But the implementing ministerial decree defining the authorisation process had not yet been fully enacted. To bridge this gap, the decree contains a legal fiction: for the first year of application, the statutory auditor of the financial statements is deemed authorised to perform sustainability assurance unless the shareholders’ meeting specifically appointed a different auditor.

This transitional provision avoided the paradox of requiring sustainability assurance before the authorisation mechanism was fully operational. But it also means that some FY2024 sustainability assurance engagements were performed by auditors whose formal sustainability authorisation had not been independently verified.

For smaller Italian audit firms, the authorisation process is a real operational concern. Unlike the Big Four firms, which invested early in sustainability assurance training and methodology, many mid-tier and small firms delayed action. With Wave 2 reporting now starting from FY2027, firms that haven’t begun the authorisation process face a compressed timeline.

The CNDCEC (Consiglio Nazionale dei Dottori Commercialisti e degli Esperti Contabili) has been active in developing professional guidance for its members. Italian dottori commercialisti who also hold the revisore legale registration can pursue the sustainability authorisation. Those who don’t hold the revisore registration cannot provide sustainability assurance, regardless of their sustainability knowledge.

The assurance framework: limited assurance and interim standards

D.Lgs. 125/2024 provides for limited assurance (livello di sicurezza limitata) on sustainability reports from the first year of application. The original CSRD text contemplated a future transition to reasonable assurance, but the Omnibus I agreement of December 2025 removed this. Limited assurance is now the permanent standard.

The decree specifies that assurance must be performed under attestation principles adopted by the European Commission (expected by 1 July 2027, per the amended Audit Directive). Until those EU standards are adopted, Italy uses national assurance principles developed jointly by professional associations and professional bodies (ordini professionali) in coordination with the MEF and Consob.

If even the national principles prove unavailable, Consob has a fallback power: it can specify by regulation the attestation principles to be used and the modalities for performing the engagement. This is a notable backstop that gives Consob direct regulatory control over how sustainability assurance is conducted in Italy, at least for listed entities.

For practitioners, the interim assurance framework means working with a combination of sources. The IAASB’s ISSA 5000, while not formally adopted by the EU, provides a global reference. Italian professional guidance from the Consiglio Nazionale dei Dottori Commercialisti e degli Esperti Contabili (CNDCEC) and the EFRAG implementation guidance supplement this. Engagement teams should document which standards and guidance they relied on, and be prepared to update their methodology when the EU adopts harmonised limited assurance standards.

The attestation covers the sustainability report’s data accuracy and compliance with ESRS. The auditor issues a separate assurance opinion (relazione di attestazione) alongside the audit opinion on the financial statements. These are two distinct opinions in the same annual report package.

On fees, the EU-wide exemption applies: sustainability assurance fees are not subject to the statutory audit fee cap, from FY2024 onwards. This exemption exists under the amended EU Audit Regulation, Article 4(2), regardless of national transposition timing. Italy benefits from this because D.Lgs. 125/2024 entered into force in 2024, meaning the exemption has been operative since the first year of application. For Italian audit firms, this represents genuine additional revenue (and genuine additional cost in terms of staffing and methodology development).

Consob’s supervisory role and the sanctions regime

Consob is the designated authority for supervising sustainability assurance performed on public interest entities and entities subject to the intermediate regime (regime intermedio). For listed companies, Consob holds the full suite of supervisory, investigative, and sanctioning powers.

Unlisted companies fall outside Consob’s jurisdiction for sustainability reporting purposes. Their compliance is monitored by the corporate control body (organo di controllo), which must report on sustainability reporting compliance to the shareholders’ meeting. The civil code provisions on directors’ liability apply.

The sanctions regime mirrors the penalties already in place for financial reporting violations under the Testo Unico della Finanza (TUF). Sanctions for listed entities range from €5,000 to €10 million, or up to 5% of annual turnover, whichever is higher. But for the first two years after D.Lgs. 125/2024 entered into force (25 September 2024 to 25 September 2026), monetary sanctions are capped. The transitional caps are €125,000 for audit firms and €150,000 for members of the board of statutory auditors, supervisory board, or management control committee. Individual sustainability auditors face a cap of €50,000 during this period, unless the violation constitutes a criminal offence.

After the transitional period, the full sanctions apply. Consob can impose financial penalties, issue public declarations identifying the infringement and the responsible party, and order companies to remedy identified violations.

When determining sanctions, Consob considers the procedures the company’s administrative body adopted for preparing the sustainability report. If violations resulted from incorrect or incomplete information provided by third parties (for example, value chain data supplied by a supplier), this is taken into account as a mitigating factor. This is an important nuance: the sanctions regime acknowledges that sustainability data is harder to verify than financial data, and that errors may originate outside the reporting entity.

The MEF shares supervisory responsibility with Consob. The MEF can impose sanctions for irregularities in the performance of sustainability assurance or statutory audit. Coordination between Consob, the MEF, Banca d’Italia, and IVASS (the insurance supervisor) is required for entities falling under multiple regulatory regimes.

Stop-the-Clock and Omnibus I: what changed for Italian companies

Italy transposed the Stop-the-Clock Directive through Article 10, paragraph 1-bis of Decree Law 95/2025. This delayed Wave 2 and Wave 3 reporting by two years, consistent with the EU-wide timeline.

The revised phasing for Italian companies:

Wave 1 (large PIEs, 500+ employees): FY2024 reporting required. Not delayed. Under the Omnibus I member state option, companies with 501 to 1,000 employees that fall out of the revised scope can be exempted for FY2025 and FY2026.

Wave 2 (other large companies meeting two of the three size criteria): Postponed from FY2025 to FY2027. First reports due in 2028. PwC Italy estimated that approximately 4,000 Italian companies would fall within CSRD scope under the original criteria. The Omnibus I revision will reduce this number substantially.

Wave 3 (listed SMEs, small non-complex credit institutions, captive insurers): Postponed from FY2026 to FY2028. Under Omnibus I, listed SMEs are removed from scope entirely.

Wave 4 (non-EU companies with substantial Italian/EU operations): Unchanged. FY2028.

The Omnibus I directive (Directive (EU) 2026/470) was published in the Official Journal on 26 February 2026. Member states have until 19 March 2027 to transpose the scope amendments. Italy will need to amend D.Lgs. 125/2024 to reflect the revised thresholds and other changes.

How the Omnibus I scope reduction affects Italian engagements

Under the Omnibus I provisional agreement, CSRD reporting applies only to companies with both 1,000+ employees and €450 million+ net turnover. For Italy, this means many companies that invested in ESRS readiness during 2024 and 2025 will fall out of scope.

Italian mid-market companies are particularly affected. An S.r.l. (società a responsabilità limitata) with 500 employees and €150 million turnover would have been in scope under the original two-out-of-three test. Under the revised thresholds, it’s out by a wide margin.

The subsidiary exemption has been broadened. Under Omnibus I, even large listed subsidiaries can use the exemption if included in their parent’s consolidated CSRD report. For Italian groups with listed subsidiaries that report within a consolidated sustainability report, this eliminates the need for standalone subsidiary reporting.

Reasonable assurance has been permanently removed. The original CSRD contemplated a transition from limited to reasonable assurance, and D.Lgs. 125/2024 reflected this expectation. After Omnibus I, that evolution will not happen. Audit firms that were planning for reasonable assurance from approximately 2028 should update their engagement planning and fee assumptions.

EFRAG’s simplified ESRS reduce mandatory data points by roughly 70%. The European Commission will adopt the revised standards by delegated act within six months of the amended CSRD entering into force. For Italian Wave 2 companies reporting from FY2027, the simplified standards will be the operative framework.

One more change relevant to Italian practice: sector-specific ESRS have been abolished, replaced by non-binding guidelines. Italian firms in sectors like fashion, automotive, and food production that anticipated sector-specific disclosure requirements should plan on the general ESRS only.

For Italian groups with cross-border subsidiaries, the transposition timing creates a coordination challenge. Italy has already transposed the CSRD (D.Lgs. 125/2024), but the Omnibus I amendments require a further legislative update by 19 March 2027. If Italy’s amending legislation is delayed, the current D.Lgs. 125/2024 text (which reflects the original CSRD scope thresholds) remains in force. An Italian subsidiary that falls out of scope under Omnibus I but is technically still captured by D.Lgs. 125/2024 until the amendment passes would face an awkward compliance position. Engagement teams should monitor the Italian legislative process and document the applicable scope thresholds at the time of reporting.

Worked example: planning a CSRD sustainability assurance engagement in Italy

Client scenario: Rossi Meccanica S.p.A. is a non-listed Italian manufacturing company based in Brescia. It has 1,400 employees, €580 million net turnover, and €220 million in total assets for FY2027. It is a wholly owned subsidiary of Rossi Group S.p.A., which is listed on Euronext Milan.

Step 1: Determine CSRD wave and applicability

Rossi Meccanica is non-listed with more than 250 employees, placing it originally in Wave 2. Under Stop-the-Clock, its first reporting year is FY2027. Under the Omnibus I thresholds: 1,400 employees (above 1,000) and €580 million turnover (above €450 million). Both thresholds met. Rossi Meccanica remains in scope.

Step 2: Assess the subsidiary exemption

If Rossi Group S.p.A. (the listed parent) prepares a consolidated CSRD sustainability report under ESRS that includes Rossi Meccanica, the subsidiary can claim the exemption. Under Omnibus I, large listed subsidiaries can also use this exemption. Confirm with the group auditor.

Step 3: Verify the auditor’s sustainability assurance authorisation

The engagement partner must be a revisore legale registered in the Registro dei Revisori Legali and specifically authorised for sustainability assurance. Confirm this authorisation is current. If the authorisation ministerial decree has been finalised, the Registro entry should reflect the sustainability authorisation. If not, confirm reliance on the transitional provision (applicable only for the first reporting year).

Step 4: Scope the limited assurance engagement

The engagement covers the sustainability report within the relazione sulla gestione, prepared under ESRS (simplified version, if adopted by the date of reporting). Limited assurance requires understanding Rossi Meccanica’s sustainability data collection processes, the control environment, analytical procedures on disclosed metrics, and enquiries of management.

Step 5: Assess Consob exposure

Rossi Meccanica is non-listed, so it falls outside Consob’s direct supervisory jurisdiction. Compliance is monitored by the organo di controllo (collegio sindacale). However, if Rossi Group S.p.A. (the listed parent) references or relies on Rossi Meccanica’s sustainability data in its consolidated CSRD report, Consob’s supervisory reach extends indirectly. Ensure that data flowing from the subsidiary to the group report is subject to appropriate controls.

Conclusion: Rossi Meccanica S.p.A. is in scope for CSRD reporting from FY2027 unless exempted through the parent’s consolidated report. The engagement partner must hold the sustainability assurance authorisation from the Registro. Limited assurance is permanent. Fees are separate from the statutory audit.

Practical checklist for Italian sustainability assurance engagements

1. Confirm the entity’s CSRD wave and check the Omnibus I thresholds (1,000+ employees and €450 million+ net turnover). If the entity falls below either threshold, document the expected scope exit. If it was already preparing for CSRD, advise on voluntary reporting options.
2. Verify that the engagement partner holds the sustainability assurance authorisation from the Registro dei Revisori Legali. For FY2027 engagements, the first-year transitional provision no longer applies. The formal authorisation must be in place.
3. Determine which assurance standard to apply. Check whether the European Commission has adopted harmonised limited assurance standards (deadline: 1 July 2027). If not, use the national principles developed under D.Lgs. 125/2024. If those are not yet finalised, Consob’s fallback regulation applies for listed entities.
4. Assess the subsidiary exemption. If the client is included in a parent’s consolidated CSRD sustainability report, obtain written confirmation. Under Omnibus I, even large listed subsidiaries can use this exemption.
5. Structure fees correctly. Sustainability assurance fees are exempt from the statutory audit fee cap (Article 4(2), amended EU Audit Regulation). Advisory fees are not. The engagement letter should separate the two components and specify the fee for each.
6. For listed entities, confirm awareness of Consob’s sanctions regime. After 25 September 2026, the transitional caps (€125,000 for audit firms, €50,000 for individual auditors) expire. Full penalties under the TUF apply from that date. Ensure the engagement quality review addresses this elevated risk profile.

Common mistakes on Italian CSRD engagements

• Relying on the first-year transitional provision for FY2027 engagements. D.Lgs. 125/2024’s transitional provision (which deemed the statutory auditor authorised for sustainability assurance in the absence of a specific appointment) applied only to the first year of CSRD application. For Wave 2 companies reporting from FY2027, the engagement partner must hold the formal sustainability authorisation from the Registro. Engagement teams should confirm this well before signing the engagement letter.
• Planning for a future transition to reasonable assurance. The Omnibus I agreement permanently removes reasonable assurance from the CSRD. D.Lgs. 125/2024 referenced this possibility, but it will not materialise. All engagement planning, staffing, and pricing should be based on limited assurance. Firms that included reasonable assurance assumptions in multi-year proposals should update those proposals before the next fee negotiation cycle.

Related Ciferi content

Related guides:

Put audit concepts into practice with these free tools:

Frequently asked questions

Further reading and source references

• D.Lgs. 125/2024 (Decreto Legislativo 6 settembre 2024, n. 125): Italy’s CSRD transposition decree, replacing D.Lgs. 254/2016.
• CSRD (Directive 2022/2464): the Corporate Sustainability Reporting Directive, as amended by the Stop-the-Clock Directive and Omnibus I.
• Omnibus I (Directive (EU) 2026/470, published 26 February 2026): revised CSRD scope thresholds, removal of reasonable assurance, and simplified ESRS.
• Testo Unico della Finanza (TUF): the Italian consolidated law on finance, governing Consob’s sanctions powers for sustainability reporting violations.