Key Points
- The Omnibus I Directive (February 2026) removed the planned transition to reasonable assurance, so limited assurance remains the EU baseline indefinitely.
- ISSA 5000 requires the practitioner to identify and assess risks of material misstatement at the disclosure level, not the assertion level.
- The CEAOB issued non-binding guidelines in September 2024 to bridge the gap until the European Commission adopts formal limited assurance standards by July 2027.
- A limited assurance conclusion is expressed in negative form: "nothing has come to our attention" rather than "in our opinion."
What is Limited Assurance (Sustainability)?
In a limited assurance engagement on sustainability information, the practitioner performs procedures that are deliberately narrower in scope than those required for reasonable assurance. ISSA 5000.89 sets the boundary: the practitioner identifies and assesses risks of material misstatement at the disclosure level. That contrasts with reasonable assurance under ISSA 5000.90, where risk assessment drops to the assertion level for each disclosure. The practical consequence is that limited assurance relies primarily on inquiry and analytical procedures rather than inspection of source data, recalculation, external confirmation, and detailed corroboration.
The engagement still follows a recognisable structure. The practitioner accepts and plans the engagement, performs risk assessment procedures, designs further procedures responsive to assessed risks, evaluates evidence, forms a conclusion, and reports. ISSA 5000.105–109 governs the nature and extent of procedures in a limited assurance engagement. The practitioner must obtain sufficient appropriate evidence to support a meaningful conclusion, even though that conclusion is expressed negatively.
Under the CSRD, limited assurance is the only mandated level. The original directive anticipated a European Commission assessment (by October 2028) of whether to require reasonable assurance. The Omnibus I Directive, published 26 February 2026, removed that transition entirely. For FY2025 and FY2026 engagements (before ISSA 5000 takes effect), practitioners apply ISAE 3000 (Revised) or the applicable national standard. The CEAOB guidelines issued in September 2024 provide a non-binding reference for those interim engagements, covering ethics, fraud risk, forward-looking information, and the handling of double materiality assessments.
Worked example: Rossi Alimentari S.p.A.
Client: Italian food production company, FY2027, revenue EUR 67M, IFRS reporter, 780 employees. Rossi falls below the revised Omnibus I CSRD thresholds (1,000 employees and EUR 450M turnover) but its primary lender requires voluntary sustainability assurance as a condition of a EUR 20M revolving credit facility. The engagement partner at a mid-tier Italian firm performs a limited assurance engagement under ISSA 5000.
Step 1 — Accept the engagement and confirm preconditions
The engagement partner verifies that Rossi's sustainability statement is prepared under the ESRS, that the information is identifiable within the management report, and that the firm has access to underlying data. The partner assesses team competence, confirming one team member holds specialist knowledge of food-sector water and waste metrics.
Step 2 — Understand the entity and identify risks at the disclosure level
The team reviews Rossi's double materiality assessment and identifies four material ESRS topics: climate change (E1), water and marine resources (E3), own workforce (S1), and business conduct (G1). Key risks include the completeness of Scope 3 emissions from agricultural supply chains and the accuracy of water withdrawal data from two production facilities in Emilia-Romagna.
Step 3 — Design and perform procedures
For water withdrawal (reported at 482,000 cubic metres), the team performs analytical procedures comparing current-year consumption against prior-year volumes and production output in tonnes. The team inquires of the plant operations manager about metering accuracy and any estimation applied to unmetered secondary sources. For Scope 3 agricultural emissions, the team compares reported figures against procurement volumes and published emission factors for dairy and grain inputs.
Step 4 — Evaluate evidence and form the conclusion
The analytical procedures on water withdrawal show a 4% year-on-year increase, consistent with the 6% rise in production volume. No inconsistencies emerge from Scope 3 inquiries. The team identifies no matters indicating material misstatement across the four reported topics.
Conclusion: the engagement produces an unmodified limited assurance conclusion on Rossi's sustainability statement, defensible because each material ESRS disclosure was subjected to risk-responsive procedures at the disclosure level, and the documentation traces procedures to assessed risks.
Why it matters in practice
- Teams accustomed to financial statement audits often apply assertion-level testing procedures (inspection, recalculation, external confirmation, and reperformance) to every sustainability disclosure even in a limited assurance engagement. ISSA 5000.89 scopes limited assurance at the disclosure level. Over-scoping wastes engagement hours and blurs the distinction between the two assurance levels, which matters when the report must describe the nature and extent of work performed.
- The FRC's 2025 sustainability assurance market study flagged inconsistency in how practitioners determine the boundary between "sufficient" and "insufficient" procedures in a limited assurance engagement. Firms that lack a documented methodology for calibrating procedure extent at the disclosure level risk producing conclusions that regulators view as either under-supported or indistinguishable from reasonable assurance.
Limited assurance vs. reasonable assurance (sustainability)
| Dimension | Limited assurance | Reasonable assurance |
|---|---|---|
| Risk assessment level | Disclosure level (ISSA 5000.89) | Assertion level for each disclosure (ISSA 5000.90) |
| Primary procedures | Inquiry and analytical procedures, supplemented by observation | Inspection, recalculation, external confirmation, and reperformance, plus inquiry and analytics |
| Conclusion form | Negative: "nothing has come to our attention" | Positive: "in our opinion, the sustainability information is free from material misstatement" |
| EU regulatory status | Required under CSRD; Omnibus I removed any planned transition | Not required under CSRD; no scheduled mandate |
| Engagement effort | Lower; procedures calibrated at the disclosure level | Higher; procedures calibrated at the assertion level for each disclosure |
The distinction matters in practice because a practitioner who inadvertently applies reasonable assurance procedures throughout a limited assurance engagement over-scopes the work and produces a report whose described procedures do not match the conclusion form. Conversely, a practitioner who performs too few procedures to support even a negative conclusion risks a quality finding when regulators begin inspecting sustainability assurance engagements.
Related terms
Frequently asked questions
What procedures does a limited assurance engagement on sustainability include?
The practitioner performs inquiry and analytical procedures as the primary evidence-gathering techniques, supplemented by observation where relevant. ISSA 5000.105–109 requires the practitioner to design procedures responsive to assessed risks at the disclosure level. Inspection and recalculation are not prohibited but are not the default. The extent of procedures must be sufficient for the practitioner to form a meaningful negative conclusion.
Does limited assurance on sustainability apply to all ESRS datapoints?
The practitioner scopes the engagement to cover all material disclosures identified in the entity's double materiality assessment. ESRS 2 IRO-1 requires the entity to disclose its materiality assessment process, and the practitioner evaluates whether that process is reasonable. Datapoints assessed as not material by the entity fall outside the assurance scope, but the practitioner must evaluate whether the exclusion itself is appropriate.
Will the EU move to reasonable assurance for sustainability reports?
The original CSRD envisaged a European Commission assessment by October 2028 on transitioning to reasonable assurance. The Omnibus I Directive (published 26 February 2026) removed this transition provision. Limited assurance is now the EU baseline with no scheduled upgrade. The Commission postponed adoption of formal limited assurance standards to July 2027.