Key Points
- The practitioner assesses risks at the assertion level and performs inspection, recalculation, confirmation, and control testing.
- The CSRD Omnibus I directive (February 2026) removed the planned transition from limited to reasonable assurance.
- Entities may voluntarily engage a practitioner for reasonable assurance to satisfy investors who demand higher confidence.
- A reasonable assurance conclusion is positive ("free from material misstatement"), not negative.
What is Reasonable Assurance (Sustainability)?
Reasonable assurance sits at the top of the ISSA 5000 assurance spectrum. Where limited assurance requires the practitioner to identify risks at the disclosure level (ISSA 5000.89), reasonable assurance under ISSA 5000.90 requires identification and assessment at the assertion level for each disclosure. That single difference cascades through the entire engagement. The practitioner designs procedures that respond to assertion-level risks: inspecting source data, recalculating reported figures against underlying records, obtaining external confirmations from third-party data providers, and testing the operating effectiveness of controls over sustainability information.
The conclusion also changes form. A limited assurance report uses negative wording ("nothing has come to our attention"). A reasonable assurance report states positively that the sustainability information is, in all material respects, prepared in accordance with the applicable criteria. ISSA 5000.142 sets out the reporting requirements for both levels. The higher evidentiary threshold means more fieldwork and higher fees. That cost-benefit tension explains why the EU initially planned a mandatory transition from limited to reasonable assurance by October 2028 but abandoned that plan under the Omnibus I directive.
Worked example: Rossi Alimentari S.p.A.
Client: Italian food production company, FY2027, revenue EUR 67M, IFRS reporter. Rossi falls within CSRD scope and publishes its sustainability statement under the ESRS. A private equity investor holding 40% of Rossi's shares requires reasonable assurance on the sustainability statement as a condition of the shareholder agreement.
Step 1 — Accept the engagement and establish preconditions
The engagement partner verifies that the applicable criteria are the ESRS, that Rossi's sustainability information is identifiable within the management report, that the firm has competence in food-sector emissions measurement, and that the team includes a subject-matter expert on social metrics for the food production sector. The partner also confirms that Rossi's internal controls over sustainability data are sufficiently mature to support a reasonable assurance engagement.
Step 2 — Identify and assess risks at the assertion level
The team maps Rossi's material ESRS disclosures (E1 Climate, E2 Pollution, S1 Own workforce, S2 Workers in the value chain) against the relevant assertions: completeness, accuracy, occurrence, and classification. For Scope 1 emissions (estimated at 4,800 tonnes CO2e from natural gas consumption at two production facilities and a refrigerated warehouse), the team identifies accuracy as the primary assertion-level risk because emission factor selection for food-grade refrigerants varies across measurement methodologies.
Step 3 — Design and perform assertion-level procedures
For accuracy of Scope 1 emissions, the team inspects natural gas invoices (EUR 1.9M annual cost, 8.4 million cubic metres) and recalculates the CO2e conversion using ISPRA emission factors published by the Italian national environmental agency. For refrigerant leakage, the team obtains external confirmation from Rossi's maintenance contractor on the quantity of HFC-134a recharged during the year (320 kg). For ESRS S1 own workforce disclosures, the team inspects payroll records, tests a sample of 45 employee contracts against reported headcount and turnover data, and evaluates the operating effectiveness of Rossi's HR data controls by re-performing a monthly reconciliation.
Step 4 — Evaluate evidence and form a positive conclusion
The Scope 1 recalculation produces 4,860 tonnes CO2e versus management's reported 4,800 tonnes (difference of 60 tonnes, 1.25%). The team evaluates this against the quantitative materiality threshold established for climate disclosures (250 tonnes) and concludes the difference is not material. Refrigerant emissions confirmed at 720 tonnes CO2e match Rossi's disclosure. The HR sample reveals no exceptions.
Conclusion: the engagement produces an unmodified reasonable assurance conclusion, defensible because each material disclosure was tested at the assertion level with procedures that included inspection of source records, independent recalculation, external confirmation, and control re-performance.
Why it matters in practice
- Teams accustomed to financial statement audits sometimes apply reasonable assurance procedures without adjusting for the nature of sustainability data. Sustainability information frequently originates outside the general ledger (from operational systems and third-party providers), and the evidence mix differs from a financial audit.
- Practitioners occasionally issue a reasonable assurance conclusion without testing the operating effectiveness of controls over sustainability data, relying instead on substantive procedures alone. For quantitative disclosures that depend on automated data feeds (energy meters, fleet tracking systems), ISSA 5000.98 expects the practitioner to understand the entity's system of internal control.
Reasonable assurance vs. limited assurance (sustainability)
| Dimension | Reasonable assurance | Limited assurance |
|---|---|---|
| Risk assessment level | Assertion level for each disclosure (ISSA 5000.90) | Disclosure level (ISSA 5000.89) |
| Procedures | Inspection, recalculation, external confirmation, tests of controls | Primarily inquiry, analytical procedures, observation, limited inspection |
| Conclusion wording | Positive: "the information is free from material misstatement" | Negative: "nothing has come to our attention" |
| EU mandate | Not required (Omnibus I removed the transition) | Required under CSRD Article 34 |
| Typical effort premium | 40–60% more engagement hours than limited assurance | Baseline |
The distinction matters on engagements where investors or lenders specify reasonable assurance as a contractual condition. Treating a reasonable assurance engagement as a "bigger limited assurance" (adding more inquiry and analytical procedures without shifting to assertion-level risk assessment) fails to meet ISSA 5000.90 and produces a conclusion the practitioner cannot support.
Related terms
Frequently asked questions
Does the CSRD require reasonable assurance on sustainability reports?
No. The CSRD originally envisaged a transition from limited to reasonable assurance by October 2028. The Omnibus I directive (published 26 February 2026) removed that requirement. Limited assurance remains the EU baseline indefinitely. Entities can still engage a practitioner for reasonable assurance voluntarily, and ISSA 5000 provides the framework for both levels.
How much more does reasonable assurance cost compared to limited assurance?
Fees depend on the entity's size and the number of material disclosures. Reasonable assurance typically requires 40% to 60% more engagement hours than limited assurance on the same scope because the practitioner must test at the assertion level, inspect source data, and evaluate controls. ISSA 5000.90 drives this additional effort by requiring risk assessment at a more granular level than the disclosure-level approach in ISSA 5000.89.
Can a practitioner perform reasonable assurance on some ESRS disclosures and limited assurance on others?
ISSA 5000 permits mixed-level engagements where the practitioner provides reasonable assurance on certain disclosures and limited assurance on others within the same report. ISSA 5000.A17–A18 addresses this scenario. The engagement letter must specify which disclosures receive which level, and the assurance report must clearly distinguish the two conclusions.