EU Taxonomy Alignment: What Auditors Need to Verify

What the auditor’s role actually covers

Your client reports 46% of their capex as Taxonomy-eligible but only 12% as Taxonomy-aligned. The gap is mostly in the DNSH assessment: the client couldn’t prove that their building renovation activity (NACE code F41/F43) does no significant harm to water and marine resources, because the environmental impact assessment required under the Climate Delegated Act Annex I, Section 7.2 was never completed. The EY EU Taxonomy Barometer 2025 found this pattern across Europe: average eligibility rates are 36% for turnover and 46% for capex, but alignment drops to 10% and 16% respectively. For the assurance practitioner, the question isn’t whether the gap exists. It’s whether the client’s eligibility and alignment classifications are defensible, and whether the documentation supports the conclusions.

Starting from FY2024 CSRD reports (published in 2025), EU Taxonomy disclosures must be assured as part of the sustainability statement. The assurance is limited assurance under ISAE 3000 (Revised), performed by the statutory auditor or an independent assurance service provider. The Taxonomy disclosures aren’t a standalone engagement; they form part of the overall CSRD sustainability statement assurance.

The auditor verifies that the Taxonomy disclosures are prepared in accordance with Article 8 of the Taxonomy Regulation and the Taxonomy Disclosures Delegated Act (Commission Delegated Regulation EU 2021/4987). This means checking eligibility classifications, alignment assessments, KPI calculations, and the mandatory disclosure tables. It does not mean the auditor independently assesses whether the client’s activities are sustainable. The auditor assesses whether the client’s classifications and calculations comply with the regulation.

This distinction matters for managing expectations, both with the client and with investors who read the assurance report. The auditor isn’t certifying that the client is green. They’re confirming that the reported percentages are calculated correctly and that the underlying classifications have adequate documentation.

The EY EU Taxonomy Barometer 2025 reported that 86% of companies received limited or reasonable assurance on their Taxonomy disclosures in FY2024. But the same report noted significant gaps in audit trails and data traceability, with many organisations unprepared for the level of evidence that auditors required. The pattern is clear: clients underestimate the documentation needed to support Taxonomy alignment claims. Your engagement planning should account for this gap by requesting the client’s Taxonomy workfile early (at least eight weeks before fieldwork) and identifying documentation shortfalls before you start testing.

Verifying eligibility: NACE codes and activity mapping

Eligibility is the threshold question: is the client’s economic activity listed in one of the Taxonomy Delegated Acts? An activity is Taxonomy-eligible if it appears in the Climate Delegated Act (Annex I or Annex II of Commission Delegated Regulation EU 2021/2139), the Environmental Delegated Act (covering water, circular economy, pollution, and biodiversity objectives), or the Complementary Climate Delegated Act (covering certain gas and nuclear activities).

The client’s first step is mapping their economic activities to NACE codes (the EU’s statistical classification of economic activities). Your verification step is confirming that the mapping is correct. This sounds mechanical. It isn’t. Mid-market companies often have activities that span multiple NACE codes or sit at the boundary between eligible and non-eligible activities.

Take a company that manufactures industrial equipment and also provides installation and maintenance services for that equipment. The manufacturing activity may map to a NACE code listed in the Climate Delegated Act. The installation services may map to a different NACE code that’s also listed. But the maintenance services may not be listed at all. If the client has classified all revenue from the combined equipment-plus-installation-plus-maintenance contracts as eligible, they’ve overstated eligibility. Your working paper should test a sample of the client’s revenue streams against the NACE code mapping and verify that each classified activity genuinely appears in the relevant Delegated Act.

The EU Taxonomy Compass (maintained by the European Commission) is the reference tool for checking whether a NACE code and activity description appear in the Taxonomy. Your working paper should reference the Compass for each activity classification. If the client’s internal mapping differs from the Compass classification, the client needs a documented rationale.

One eligibility issue specific to mid-market firms: the client may have activities that are clearly eligible but the client hasn’t identified them. A logistics company that invested in solar panels on its warehouse roof may not have classified that capex as Taxonomy-eligible (energy generation from solar PV, NACE code D35.11). Under Article 8, the client must report all eligible activities, not just the ones they choose to highlight. Under-reporting eligibility is itself a misstatement.

The CSRD double materiality glossary entry covers the broader assessment framework, but Taxonomy eligibility is a separate question from ESRS materiality. An activity can be Taxonomy-eligible without the corresponding ESRS topic being material, and vice versa.

Verifying alignment: the four conditions

An eligible activity is Taxonomy-aligned only if it meets all four conditions simultaneously. Missing one condition means the activity is eligible but not aligned. Your verification work covers each condition separately.

Condition 1: Substantial contribution to an environmental objective

The activity must substantially contribute to at least one of the six environmental objectives: climate change mitigation, climate change adaptation, sustainable use and protection of water and marine resources, transition to a circular economy, pollution prevention and control, or protection and restoration of biodiversity.

Substantial contribution is assessed against the activity-specific Technical Screening Criteria in the relevant Delegated Act. These criteria are sometimes quantitative thresholds (e.g., a building renovation must achieve at least 30% reduction in primary energy demand) and sometimes qualitative requirements (e.g., the activity must implement physical and non-physical solutions to reduce climate risks). Your verification involves inspecting the client’s evidence against each criterion. For quantitative thresholds, you need the underlying calculation. For qualitative criteria, you need the documented assessment.

Condition 2: Do no significant harm (DNSH) to the other five objectives

This is the condition that generates the largest gap between eligibility and alignment across European companies. The DNSH criteria are defined per activity in the Delegated Acts and require the client to demonstrate that the activity doesn’t cause significant harm to any of the five environmental objectives it isn’t substantially contributing to.

DNSH criteria vary enormously in complexity. Some are straightforward: confirming that equipment meets EU Ecodesign requirements. Others require detailed technical assessments. For construction activities, DNSH to water and marine resources may require an environmental impact assessment under the Water Framework Directive. For manufacturing activities, DNSH to pollution may require demonstrating that the activity doesn’t involve the use of substances of very high concern (SVHCs) listed under REACH.

Your verification approach should be proportionate to the complexity of the DNSH criteria. For criteria that reference existing EU regulatory compliance (e.g., the activity must comply with Directive 2011/92/EU on environmental impact assessment), you can verify by inspecting the relevant permits and compliance records. For criteria that require specific technical assessments (e.g., a physical climate risk assessment at the “smallest appropriate scale”), you need to evaluate whether the client has conducted the assessment and whether it’s fit for purpose.

A 2022 analysis found that only 6% of all DNSH criteria in the Climate Delegated Act are quantitative (Type A). 38% are process-based criteria (Type B) that are open to interpretation. Your working paper should document how the client interpreted each DNSH criterion and whether that interpretation is reasonable. If the client couldn’t complete a DNSH assessment due to data gaps, the activity should be classified as eligible but not aligned. Classifying it as aligned without completing the DNSH assessment is a misstatement.

For Dutch mid-market firms, the DNSH criteria that generate the most work are typically water and marine resources (which often require proof of compliance with the Water Framework Directive), biodiversity (which may require an environmental impact assessment under Directive 2011/92/EU), and pollution (which requires demonstrating REACH compliance for substances of concern). A practical approach is to build a DNSH matrix per eligible activity, listing each of the five remaining objectives, the specific DNSH criterion from the Delegated Act, the evidence required, and the evidence obtained. This matrix becomes the core of your working paper and gives the EQCR reviewer a clear view of where the assessment is complete and where gaps remain.

Where the client has obtained environmental permits from Dutch authorities (omgevingsvergunning under the Omgevingswet), those permits often provide evidence for several DNSH criteria simultaneously. A permit that required an environmental impact assessment, confirmed compliance with water quality standards, and assessed biodiversity impacts may satisfy DNSH for three objectives in one document. Your working paper should map the permit conditions to the specific DNSH criteria they address, rather than testing each criterion independently.

Condition 3: Minimum social safeguards

Article 18 of the Taxonomy Regulation requires the activity to comply with minimum safeguards related to human rights (including labour rights and consumer protection), bribery, corruption, taxation, and fair competition. The benchmarks are the OECD Guidelines for Multinational Enterprises, the UN Guiding Principles on Business and Human Rights, the ILO Core Conventions, and the International Bill of Human Rights.

Unlike substantial contribution and DNSH (which are assessed per activity), minimum safeguards are assessed at the entity level. The client must demonstrate that they have human rights due diligence processes in place. For Dutch mid-market firms, this often means referencing the company’s code of conduct, supplier due diligence procedures, and anti-corruption policies. Your verification involves inspecting these documents and assessing whether they genuinely address the four safeguard areas. A generic code of conduct that mentions human rights but doesn’t describe a due diligence process is unlikely to satisfy the requirement.

The connection between minimum safeguards and ESRS S1 (own workforce) and S2 (value chain workers) is direct. If the client’s CSRD sustainability statement includes S1 disclosures on workforce policies and grievance mechanisms, those same policies may serve as evidence for the minimum safeguards condition. Your working paper can cross-reference the S1 evidence rather than duplicating the assessment.

Condition 4: Compliance with Technical Screening Criteria

The TSC are the combined requirements for conditions 1 and 2. The Delegated Acts define both the substantial contribution criteria and the DNSH criteria for each listed activity. Meeting all TSC for substantial contribution to one objective, plus all DNSH criteria for the remaining five objectives, is what makes an activity aligned. Your verification work on conditions 1 and 2 effectively covers this condition.

Testing the KPI calculations

The client must report three KPIs for their Taxonomy disclosures: the proportion of turnover derived from Taxonomy-aligned activities, the proportion of capex related to Taxonomy-aligned activities, and the proportion of opex related to Taxonomy-aligned activities.

Turnover KPI

The numerator is revenue from Taxonomy-aligned activities. The denominator is total revenue as reported in the financial statements (net turnover per the Accounting Directive). Your verification involves tracing the denominator to the financial statements and testing the numerator allocation.

The allocation is where issues arise. If the client has a contract that bundles eligible and non-eligible services (a construction contract that includes both building renovation and landscaping), they need to allocate revenue between the two. Your working paper should test the allocation methodology and verify that it’s applied consistently. If the client uses percentage-of-completion revenue recognition, confirm that the Taxonomy turnover allocation follows the same methodology.

Capex KPI

The numerator is additions to tangible and intangible assets during the reporting period (per IAS 16, IAS 38, IFRS 16, or equivalent national GAAP) that relate to Taxonomy-aligned activities. The denominator is total additions. The capex KPI often shows higher eligibility and alignment than turnover, because even companies with predominantly non-eligible revenue may invest in eligible activities (solar panels, energy-efficient building upgrades, electric vehicles).

Capex has a specific feature: the Delegated Act defines two types of capex that count toward the numerator. Type (a) is capex directly related to Taxonomy-aligned activities. Type (b) is capex that forms part of a plan to expand or achieve Taxonomy alignment within a defined timeframe (the “capex plan”). If the client includes Type (b) capex, you need to inspect the plan itself: is it time-bound, does it have specific targets, and is the capex genuinely part of it?

Opex KPI

The numerator is direct, non-capitalised costs related to Taxonomy-aligned activities. The denominator is a more restricted concept than total operating costs: it covers research and development, building renovation, short-term leases, maintenance, and repair costs. This restricted denominator catches many clients off guard. A company with €50M in total operating costs but only €4M in the Taxonomy-defined opex categories will report a Taxonomy opex KPI with a €4M denominator, not a €50M denominator.

For all three KPIs, double-counting is a risk. Article 8 of the Taxonomy Regulation and the Disclosures Delegated Act require the client to explain how they avoid double-counting. If a single activity substantially contributes to both climate mitigation and circular economy, the revenue from that activity must be counted once, not twice. The EY EU Taxonomy Barometer 2025 found that 66% of companies now describe how they avoid double counting (up from 60% the prior year). Your working paper should verify the double-counting controls, particularly for activities that could contribute to multiple objectives.

The reconciliation between Taxonomy KPIs and financial statement line items is your strongest analytical procedure. If the turnover denominator doesn’t match net revenue in the income statement, there’s either a misclassification or a scope difference that needs documentation. Similarly, if the capex numerator (additions related to aligned activities) exceeds the total capex additions in the fixed asset schedule for the corresponding asset classes, that’s an overstatement. Run these reconciliations before detailed testing. They catch the largest errors fastest.

One issue specific to the opex KPI: many mid-market firms don’t track the restricted opex categories separately in their accounting system. R&D costs may sit in multiple cost centres. Short-term lease costs may be embedded in operating expenses without a separate ledger account. If the client extracted the opex denominator manually, your working paper should test the extraction methodology and verify a sample of the underlying transactions back to source documents.

The Financial Ratio Calculator can support your analytical procedures on the KPIs by benchmarking the client’s alignment percentages against sector averages.

Worked example: Dekker Bouw B.V.

Client profile: Dekker Bouw B.V. is a mid-market construction company based in Utrecht, Netherlands. Revenue: €73M. Primary activities: residential building construction and commercial building renovation. 224 employees. First CSRD reporting year: FY2025.

1. Eligibility mapping

Dekker’s total turnover: €73M. Eligible turnover: €61M (new construction: €38M, renovation: €23M). Non-eligible turnover: €12M (maintenance services).

2. Alignment assessment: new residential construction (7.1)

Substantial contribution to climate mitigation: the TSC for 7.1 requires that the primary energy demand of the new building is at least 10% below the threshold set for nearly zero-energy building requirements in national regulation. Dekker’s two largest projects (representing €28M of the €38M construction revenue) have energy performance certificates showing primary energy demand 18% and 22% below the BENG threshold (Dutch nearly zero-energy standard). Substantial contribution: met for these two projects.

DNSH assessment for the two qualifying projects:

Minimum safeguards: Dekker has a code of conduct referencing the ILO Core Conventions, an anti-corruption policy, and supplier due diligence procedures documented under their ESRS S1-1 workforce policy disclosure.

Result: €28M of the €38M new construction revenue qualifies as Taxonomy-aligned. The remaining €10M (from smaller projects) wasn’t assessed for alignment because Dekker lacked energy performance certificates at the reporting date.

3. KPI calculations

Practical checklist

1. Request the client’s Taxonomy workfile at least eight weeks before fieldwork. The workfile should contain the NACE code mapping, the substantial contribution assessment per activity, the DNSH assessment per activity, the minimum safeguards assessment, and the KPI calculations with source data references.
2. Verify every eligible NACE code against the EU Taxonomy Compass. Don’t rely on the client’s internal mapping alone. The Compass is updated as new Delegated Acts are published, and the client’s mapping may reference an outdated version.
3. For each aligned activity: inspect the substantial contribution evidence (energy performance certificates, emission calculations, technical specifications) and the DNSH evidence (environmental impact assessments, permits, waste diversion records, REACH compliance documentation). If any DNSH criterion lacks supporting evidence, the activity should be eligible but not aligned.
4. Test the three KPI denominators. Turnover denominator: trace to the financial statements. Capex denominator: reconcile to the fixed asset additions schedule. Opex denominator: verify that it uses the restricted Taxonomy definition, not total operating expenses.
5. Check for double-counting. If an activity contributes to more than one environmental objective, confirm it’s counted once in the KPI numerator. Review the client’s double-counting methodology disclosure and test whether it’s applied correctly.
6. Confirm the client has completed the mandatory disclosure tables per the Disclosures Delegated Act. Missing tables (particularly the activity-by-activity breakdown showing eligibility and alignment per environmental objective) are a common omission that prevents the auditor from completing the assurance procedures.

Common mistakes

• Classifying an activity as Taxonomy-aligned when the DNSH assessment is incomplete. If the client can demonstrate substantial contribution but hasn’t completed the DNSH assessment for all five remaining objectives, the activity is eligible but not aligned. The EY EU Taxonomy Barometer 2025 found that DNSH remains the largest barrier to alignment across European companies, with many organisations unprepared for the evidence required.
• Using total operating expenses as the denominator for the opex KPI. The Taxonomy opex KPI uses a restricted denominator covering only R&D, building renovation, short-term leases, maintenance, and repair costs. Using total operating expenses understates the Taxonomy opex percentage and misstates the KPI.
• Omitting Type (b) capex from the capex KPI when the client has a documented capex plan. If the client has a plan to achieve Taxonomy alignment for currently non-aligned activities (for instance, a plan to upgrade their vehicle fleet to electric within five years), the related capex may qualify under Type (b). Failing to identify and include this capex understates the alignment percentage.

Related Ciferi content

Related guides:

Put audit concepts into practice with these free tools:

Frequently asked questions

Further reading and source references

• EU Taxonomy Regulation (Regulation EU 2020/852): the source regulation establishing the framework for sustainable economic activities.
• Climate Delegated Act (Commission Delegated Regulation EU 2021/2139): defines the Technical Screening Criteria for climate change mitigation and adaptation.
• Taxonomy Disclosures Delegated Act (Commission Delegated Regulation EU 2021/4987): governs the Article 8 disclosure requirements including KPI calculations and mandatory tables.
• ISAE 3000 (Revised): the assurance standard under which limited assurance on Taxonomy disclosures is performed as part of CSRD sustainability statement assurance.