Key Takeaways

  • The Omnibus I directive (adopted February 2026) narrows the scope to companies with 1,000 or more employees and net turnover above €450M, cutting approximately 80% of previously in-scope entities.
  • Wave 1 companies (former NFRD reporters) filed their first CSRD-compliant reports in 2025 covering financial year 2024.
  • The Stop-the-Clock directive (April 2025) postponed Wave 2 and Wave 3 application by two years.
  • Sustainability information must receive at least limited assurance from an independent auditor or accredited assurance provider.

What the CSRD requires

Planning meeting, Q4 2024. The partner asks who on the audit team will sign off on the sustainability statement. Silence. A year later, that same question has landed on the desk of every mid-tier firm in Europe with a large-entity client. The CSRD made sustainability reporting an audit-adjacent obligation overnight, and most teams were not ready for it.

The CSRD replaced the Non-Financial Reporting Directive (NFRD) and expanded both the number of companies required to report and the depth of what they must disclose. Companies in scope prepare a dedicated sustainability statement within the management report, covering environmental, social, governance, and human rights topics as defined by the ESRS. That statement follows a double materiality assessment: the company reports on sustainability matters that are material from either an impact perspective (the company's effects on people and the environment) or a financial perspective (sustainability risks and opportunities that affect the company's cash flows or financial position).

The directive mandates digital tagging of sustainability disclosures in XHTML format for machine-readability. An independent assurance provider must issue an opinion on the sustainability statement. The initial assurance level is limited assurance, with the European Commission evaluating a potential move to reasonable assurance by October 2028. Article 34 of the amended Accounting Directive sets the assurance requirement, and ISSA 5000 (effective for periods beginning on or after 15 December 2026) provides the first international standard for these engagements.

The Omnibus I directive, published in the Official Journal on 26 February 2026, reshaped the CSRD's scope. The revised thresholds (1,000+ employees, €450M+ turnover) apply from financial year 2027. Wave 1 entities that fall below these thresholds received a transition exemption for reporting years 2025 and 2026.

Worked example: Schäfer Elektrotechnik AG

Client: German electronics company, FY2025, revenue €310M, 2,400 employees, IFRS reporter. Schäfer reported under the NFRD and filed its first CSRD-compliant sustainability statement in 2025 covering FY2024.

Step 1: determine continued scope under Omnibus I

Schäfer has 2,400 employees and net turnover of €310M. The revised CSRD threshold requires both 1,000+ employees and €450M+ turnover. Schäfer meets the employee criterion but falls below the turnover threshold.

Documentation note: record the Omnibus I scope assessment. Cite the two thresholds (1,000 employees, €450M turnover) and note that both must be exceeded. Attach the board memorandum confirming Schäfer's FY2025 turnover of €310M and headcount of 2,400.

Step 2: apply the transition exemption

Because Schäfer was a Wave 1 reporter, the Omnibus I transition exemption permits it to discontinue CSRD reporting for FY2025 and FY2026 without penalty. Schäfer's board elects to continue voluntary reporting for FY2025 to maintain investor confidence but will reassess for FY2026.

Documentation note: record the board's decision to continue voluntary reporting. Reference the Omnibus I transition provision for Wave 1 entities falling out of scope. File the minutes of the sustainability committee meeting where the decision was taken.

Step 3: assess assurance requirements for the voluntary report

Schäfer engages its statutory auditor to perform limited assurance on the FY2025 sustainability statement. The engagement follows ISAE 3000 (Revised), as ISSA 5000 is not yet effective (effective date: periods beginning on or after 15 December 2026). The auditor scopes the engagement to cover all material ESRS datapoints identified in Schäfer's double materiality assessment.

Documentation note: record the assurance standard applied (ISAE 3000 Revised) and the scope of the engagement (all material ESRS disclosures). Document the rationale for not early-adopting ISSA 5000 and cross-reference the double materiality assessment WP.

Step 4: evaluate the sustainability statement for FY2025

The auditor verifies that Schäfer's statement covers the ESRS cross-cutting standards (ESRS 1, ESRS 2) and each topical standard identified as material. Schäfer reports Scope 1 and Scope 2 emissions of 14,200 tonnes CO₂e and discloses its climate transition plan targets. The auditor traces reported emissions to underlying energy invoices and production data.

Documentation note: document the procedures performed for each material ESRS datapoint. Record the sources of emissions data (energy supplier invoices and fleet fuel records) and any estimation methods applied. Note the EU Taxonomy alignment disclosures and the basis for Schäfer's eligibility assessment.

What reviewers and practitioners get wrong

  • Teams frequently perform the double materiality assessment as a one-off exercise at the start of CSRD reporting and never revisit it. ESRS 1 paragraph 30 requires the undertaking to reassess the materiality of sustainability matters at each reporting date. A static assessment produced in 2024 that ignores new regulatory requirements or operational changes in 2025 does not meet this standard. In our experience, this is where the tick box exercise mentality causes the most damage: the team copies last year's materiality matrix and changes the date.
  • Assurance providers scope their limited assurance engagement around a subset of ESRS disclosures without documenting why certain datapoints were excluded. ISAE 3000 (Revised) paragraph 47 requires the practitioner to determine the scope of the engagement and to communicate that scope clearly. Nobody enjoys the scoping documentation, but skipping it is how files get flagged. Omitting material datapoints from the scope without justification creates a gap between what stakeholders expect the assurance opinion to cover and what it actually covers.

Related terms

Related tools

Related reading

Frequently asked questions

Does the CSRD still apply after the Omnibus I changes?

Yes. The Omnibus I directive (published 26 February 2026) narrowed the scope to companies with 1,000+ employees and €450M+ turnover, but the CSRD itself remains in force. Companies meeting the revised thresholds must report under ESRS from financial year 2027. Wave 1 companies above the thresholds continue reporting without interruption.

What assurance standard applies to CSRD sustainability reports?

For reporting periods beginning before 15 December 2026, practitioners apply ISAE 3000 (Revised) or a national equivalent. ISSA 5000, approved by the IAASB in September 2024, becomes effective for periods beginning on or after 15 December 2026 and will serve as the primary international standard for sustainability assurance engagements.

How does the CSRD interact with the EU Taxonomy?

The CSRD requires in-scope companies to disclose taxonomy-eligible and taxonomy-aligned activities as part of their sustainability statement. The EU Taxonomy regulation (Regulation 2020/852) defines the environmental criteria, and the CSRD provides the reporting vehicle. The auditor assesses whether the entity correctly classified activities against the taxonomy technical screening criteria and the DNSH requirements.

Get practical audit insights, weekly.

No exam theory. Just what makes audits run faster.

290+ guides published20 free toolsBuilt by practicing auditors

No spam. We’re auditors, not marketers.