ESG Assurance Market Growth: Opportunities for Small Firms

The Omnibus reshaped the market, it didn’t kill it

The original CSRD scope was enormous. Approximately 50,000 companies across the EU would have been required to report under ESRS, with mandatory assurance required on those reports. The Omnibus package changed that. The “stop-the-clock” Directive adopted in April 2025 delayed Wave 2 and Wave 3 reporting by two years. Then the substantive Omnibus Directive (Directive 2026/470), finalised in December 2025 and published in February 2026, raised the scope threshold to companies with more than 1,000 employees and net turnover above €450 million. Listed SMEs were removed entirely.

The result: approximately 80% of companies originally in scope fell out. The European Commission estimated administrative cost savings of €4.5 billion. Politicians celebrated the reduction in regulatory burden.

But focus on the companies that remain. These are large enterprises, many of them in energy-intensive sectors, financial services, and manufacturing. They generate the revenues that can support professional assurance fees. They also face investor pressure, supply chain demands, and reputational incentives that go beyond the legal minimum.

KPMG’s 2025 ESG Assurance Maturity Index (surveying 1,320 senior executives globally) found that 74% of Wave 1 companies said their sustainability reporting plans remained unchanged despite regulatory uncertainty. Among those embracing ESG assurance, 60% expected greater market share, 54% anticipated improved profitability, and nearly half expected higher shareholder value. The market isn’t just compliance-driven. It’s investor-driven.

For non-Big 4 firms, the Omnibus is a net positive. The original scope would have required tens of thousands of low-value limited assurance engagements on mid-sized companies with limited sustainability data. That market would have been chaotic, price-sensitive, and difficult to resource. The revised scope concentrates demand on companies that can pay professional fees, have existing sustainability data infrastructure, and understand what assurance involves.

Who still needs assurance and when

The timeline after the Omnibus has four tracks.

Wave 1 companies (large public-interest entities with 500+ employees that were previously subject to the NFRD) are already reporting under CSRD for FY 2024, with reports published in 2025. They need assurance now. If they fall below the new 1,000-employee and €450M-turnover thresholds, member states may exempt them for FY 2025 and FY 2026 under the transition provision.

Wave 2 companies (other large EU companies meeting the new thresholds) will report for FY 2027, with first reports published in 2028. This is the primary addressable market for firms building capability in 2026.

Wave 4 (non-EU parent companies with €450M+ EU turnover) will report for FY 2028, with first reports in 2029.

The assurance requirement starts at limited assurance. The CSRD mandates that sustainability reports be subject to assurance, initially at a limited level with the expectation of moving to reasonable assurance. Limited assurance under ISSA 5000 (or ISAE 3000 (Revised) for firms not yet adopting ISSA 5000) requires the practitioner to obtain sufficient appropriate evidence to conclude whether anything has come to their attention that causes them to believe the sustainability information is materially misstated.

In the Netherlands specifically, the Dutch Authority for the Financial Markets (AFM) will oversee assurance quality for PIE sustainability reports. For non-PIE entities within the revised CSRD scope, the NBA (Royal Netherlands Institute of Chartered Accountants) will set quality standards. Dutch RA-qualified auditors at SRA member firms are eligible to provide this assurance, provided they meet the competency requirements.

ISSA 5000: what the assurance standard actually requires

The IAASB issued International Standard on Sustainability Assurance (ISSA) 5000 in 2024. It becomes effective for assurance engagements on sustainability information for periods beginning on or after 15 December 2026, aligning with Wave 2 CSRD reporting.

ISSA 5000 is standalone. It doesn’t require practitioners to also apply ISAE 3000 (Revised), although it draws on the same conceptual framework. It covers both limited and reasonable assurance engagements on sustainability information, regardless of the reporting framework (ESRS, ISSB, GRI, or entity-specific). The standard requires practitioners to understand the entity’s sustainability reporting process, identify risks of material misstatement, design and perform responsive procedures, obtain sufficient appropriate evidence, and form a conclusion. The structure mirrors a financial statement audit under ISA 200, but with specific adaptations for sustainability data.

Key differences from what most auditors are used to: the subject matter is broader (environmental, social, governance data rather than financial figures alone), the criteria may include qualitative disclosures that don’t reduce to numbers, the evidence sources are often non-financial systems (emissions monitoring platforms, HR databases, supply chain surveys) that lack the double-entry controls financial auditors rely on, and the expertise required may extend beyond accounting into environmental science, human rights, and data analytics.

For a non-Big 4 firm, this means building or buying subject matter expertise. You don’t need to hire a climate scientist. But you do need someone on the engagement who understands how GHG emissions are calculated, how double materiality assessments work, and what ESRS E1 (climate change) and ESRS S1 (own workforce) require in terms of disclosed datapoints.

Why small firms have a structural advantage

The Big Four dominate Wave 1 CSRD assurance because they audit most of the companies that fall into that category. But Wave 2 includes companies audited by mid-tier and smaller firms. Many of these companies have long-standing relationships with their statutory auditor. If that auditor can also provide sustainability assurance, the client saves time, reduces coordination overhead, and works with a team that already understands their business.

Independence rules under the IESBA Code permit the statutory auditor to provide assurance on the sustainability report of the same client, provided the engagement quality requirements are met. This is a significant advantage over the model where a separate firm provides sustainability assurance. Two assurance providers means two teams learning the client’s business, two sets of access requests, and two fee negotiations. One provider with both mandates is more efficient.

The pricing dynamic also favours smaller firms. A Big Four sustainability assurance engagement for a €500M-turnover manufacturing company will typically be priced at €80K to €150K for limited assurance, depending on the complexity of the ESRS disclosures. A mid-tier firm with existing audit access, pre-built understanding of the entity’s systems, and lower overhead can deliver the same scope at 60-70% of that cost while maintaining healthy margins. Your client saves money. Your firm gains a new recurring revenue stream. The average first-year ESG assurance engagement runs 200 to 400 hours for limited assurance, depending on the entity’s data maturity.

There’s also a capacity constraint in the market. The KPMG survey found that 76% of companies remain in early or mid-stages of ESG assurance maturity. Demand for practitioners will exceed supply in 2027 and 2028 as Wave 2 companies prepare their first ESRS reports. Firms that build capability in 2026 will have a window where client demand exceeds available providers. That window closes as the market matures.

The economics of an ESG assurance engagement

A limited assurance engagement on a Wave 2 company’s ESRS sustainability report involves several distinct workstreams. Understanding the entity’s double materiality assessment and the disclosures selected. Evaluating the entity’s sustainability data collection processes. Performing analytical procedures and inquiries on the reported datapoints. Testing a sample of quantitative disclosures (GHG emissions, employee headcount, waste metrics) to source data. Evaluating qualitative disclosures (governance descriptions, strategy narratives, target-setting) against the ESRS requirements. Forming a conclusion.

For a company with €600M turnover, 1,500 employees, and moderate ESRS disclosure complexity (reporting on ESRS 2, E1, S1, and G1), a limited assurance engagement typically requires 250 to 350 hours. At an average blended rate of €120 per hour for a mid-tier Dutch firm, that’s €30K to €42K in fees. This sits comfortably within what companies budget for sustainability assurance after the initial setup year.

The investment to build the capability is front-loaded. You need at least one qualified practitioner who has completed ESRS-specific training (the NBA offers CPE-eligible programmes). You need a methodology document adapted from your existing ISAE 3000 or ISAE 3402 methodology to incorporate ISSA 5000 requirements. And you need a template set for engagement letters, management representation letters, and the assurance report itself. The total investment for a firm with 50 professionals: approximately 200 to 300 hours of internal development time plus external training costs of €5K to €10K.

The payback is fast. Two ESG assurance engagements in the first year cover the development cost. Every engagement thereafter is recurring revenue with improving margins as the team gains experience.

Worked example: Bakker Industrial B.V.

Client profile: Bakker Industrial B.V. is a Dutch industrial equipment manufacturer with €520M revenue, 1,200 employees, and operations in the Netherlands, Belgium, and Poland. Bakker is a current statutory audit client of your firm. They will fall within revised CSRD scope (1,200 employees, €520M turnover) and must report for FY 2027 with the first sustainability report published in 2028.

Step 1: Assess the engagement opportunity

Bakker’s management has received a quote from a Big Four firm for sustainability assurance: €95K for limited assurance on their ESRS report. Your firm already audits Bakker’s financial statements (fee: €180K). You know their systems, their control environment, and their management team. You estimate you can deliver the sustainability assurance at €55K, generating a 40% margin while saving Bakker €40K compared to the alternative.

Step 2: Scope the ESRS disclosures

Bakker conducted a double materiality assessment in 2026 (with support from an external sustainability consultant). Material topics identified: climate change (ESRS E1), pollution (ESRS E2), own workforce (ESRS S1), and governance (ESRS G1). General disclosures under ESRS 2 are mandatory. Total ESRS disclosures: five standards.

Step 3: Identify key risks in the sustainability information

The highest-risk area is ESRS E1 (climate change). Bakker’s Scope 1 emissions of 18,400 tCO2e derive from natural gas consumption across two manufacturing sites. The calculation methodology uses emission factors from the Dutch national emissions register (NIK). Scope 2 emissions are electricity-based, using location-based factors. Scope 3 is disclosed on a best-efforts basis for purchased goods only.

Risk: the Scope 1 figure depends on natural gas meter readings at each site. If the meters are inaccurate or readings are interpolated rather than actual, the emission figure could be materially misstated. Materiality for ESRS E1 quantitative disclosures set at 5% of total Scope 1 + 2 emissions (approximately 920 tCO2e).

Step 4: Form the conclusion

After performing the procedures above plus analytical review of ESRS S1 workforce metrics (headcount, gender pay gap, training hours), inquiry of management on ESRS G1 governance disclosures, and evaluation of the double materiality assessment methodology, you conclude that nothing has come to your attention that causes you to believe the sustainability information is materially misstated.

Practical checklist: building your ESG capability in 2026

1. Identify which current audit clients will fall within the revised CSRD scope (1,000+ employees and €450M+ net turnover). These are your first ESG assurance prospects. Approach them in Q3 2026, before they’ve contracted with another provider.
2. Send at least one senior team member to ESRS-specific training (the NBA and Accountancy Europe both offer programmes). The investment is 40 to 60 CPE hours per person. This person becomes your sustainability assurance engagement leader.
3. Adapt your existing ISAE 3000 or ISAE 3402 methodology to incorporate ISSA 5000 requirements. ISSA 5000 is standalone, so you’re building a new engagement file structure rather than amending an existing one. Budget 80 to 120 hours of internal development time.
4. Build a template set: engagement letter, management representation letter, planning memo, risk assessment matrix for sustainability information, and the limited assurance report. Adapt from the ISSA 5000 illustrative examples.
5. Establish a relationship with a subject matter expert (environmental consultant, ESG data analyst) who can support your first engagements on a subcontract basis for ESRS E1 and E2 technical areas. You don’t need to hire full-time until you have five or more engagements.
6. Price your first engagement competitively to establish a track record. The second engagement and beyond is where margins normalise.

Common mistakes

• Waiting until 2028 to build ESG assurance capability. Wave 2 companies report for FY 2027. Their sustainability reports need assurance in 2028. If you haven’t built your methodology, trained your team, and signed your first engagement by late 2027, the market has moved on without you.
• Assuming the Omnibus killed the ESG assurance market for non-Big 4 firms. The Omnibus concentrated demand on larger companies that can afford professional fees. The number of engagements is smaller, but the fee per engagement is higher and the competition from Big Four firms is limited by their capacity constraints.
• Treating sustainability assurance as a bolt-on to the financial statement audit. ISSA 5000 is a separate engagement with separate planning, risk assessment, evidence, and reporting requirements. It requires specific subject matter expertise that goes beyond financial accounting. Budget the investment and staff it properly.

Related content

Frequently asked questions

Further reading and source references

• Directive 2026/470 (CSRD Omnibus): revised scope thresholds, wave timeline, and transition provisions.
• ISSA 5000, General Requirements for Sustainability Assurance Engagements: the IAASB’s standalone assurance standard effective 15 December 2026.
• ISAE 3000 (Revised), Assurance Engagements Other than Audits or Reviews of Historical Financial Information: the existing framework for non-financial assurance.
• ESRS 2, General Disclosures: mandatory disclosure requirements for all in-scope companies.
• ESRS E1, Climate Change: disclosure requirements for GHG emissions, transition plans, and climate-related targets.
• KPMG 2025 ESG Assurance Maturity Index: survey of 1,320 executives on sustainability reporting readiness and business impact.
• IESBA Code of Ethics: independence provisions permitting combined audit and sustainability assurance mandates.