What is Limited Assurance?
ISAE 3000.12(a)(ii) defines limited assurance as a level of assurance that is meaningful but less than reasonable assurance. The practitioner reduces engagement risk to a level that is acceptable in the circumstances but higher than for a reasonable assurance engagement. The conclusion is expressed in negative form: “nothing has come to our attention that causes us to believe…”
For financial statement reviews, ISRE 2400.37 limits primary procedures to inquiry and analytical procedures. For non-financial assurance engagements under ISAE 3000, the practitioner has more flexibility in selecting procedures, but the nature, timing, and extent will be less than for reasonable assurance. ISAE 3000.A109 explains that the difference lies primarily in the nature and extent of procedures, not in their quality.
ISAE 3000.50 still requires sufficient appropriate evidence regardless of the assurance level. “Limited” describes the level of assurance conveyed to the user, not the amount of care the practitioner applies. The CSRD initially requires limited assurance on sustainability statements, with a planned transition to reasonable assurance — making this distinction practically important for every firm building sustainability assurance capabilities.
Key Points
- Limited assurance is meaningful assurance — ISAE 3000.12(a)(ii) defines it as less than reasonable but still significant.
- Negative-form conclusion reflects the scope of procedures, not a lower standard of care.
- ISAE 3000.50 still requires sufficient appropriate evidence regardless of the assurance level.
- CSRD starts with limited assurance on sustainability statements, making this the entry point for most sustainability assurance engagements.
Why it matters in practice
The most common failure is performing insufficient procedures on the assumption that the “limited” label covers the gap. Practitioners hear “limited assurance” and interpret it as “limited work.” ISAE 3000 does not support that interpretation. The evidence must still be sufficient and appropriate — what changes is the level of assurance the procedures are designed to provide, not the practitioner’s obligation to do the work properly.
A second common error is issuing limited assurance reports using positive-form language. Writing “in our opinion, the sustainability statement is prepared in accordance with ESRS” in a limited assurance report overstates the assurance provided and misleads the reader. The conclusion must use negative form: “nothing has come to our attention.”
With CSRD sustainability reporting now requiring limited assurance, the distinction between limited and reasonable assurance has moved from a theoretical concept to a daily practical question. Firms that have only performed audits must understand that limited assurance is not an audit with fewer hours — it is a different engagement type with its own logic.
Key standard references
- ISAE 3000.12(a)(ii): Defines limited assurance as meaningful assurance that is less than reasonable assurance.
- ISAE 3000.50: Requires sufficient appropriate evidence regardless of the assurance level.
- ISRE 2400.37: Limits primary procedures in financial statement reviews to inquiry and analytical procedures.
- ISAE 3000.A109: Explains the differences in nature and extent of procedures between limited and reasonable assurance.
Related terms
Related reading
Frequently asked questions
Does 'limited' mean less work is acceptable?
No. ISAE 3000.50 still requires sufficient appropriate evidence regardless of the assurance level. 'Limited' describes the level of assurance conveyed, not the rigour of the work. A sloppy limited assurance engagement does not become acceptable because the assurance level is lower.
Is limited assurance the same as a review?
A review engagement is one type of limited assurance engagement. Limited assurance is the broader concept under ISAE 3000 that also covers non-financial engagements like CSRD sustainability assurance.