Developments in sustainability assurance: formula sheet

Key formulas

Financial materiality

Sustainability matter is material if it could reasonably influence investors' decisions about resources provided to the entity

Outside-in view. Used by ISSB (IFRS S1 and S2).

Impact materiality

Matter is material if the entity significantly affects people or the environment

Inside-out view. The basis of GRI.

Double materiality

Reportable if impact-material OR financially material (or both)

Used by the CSRD and ESRS. It is wider than financial materiality alone.

IFRS S1 core content

Governance, Strategy, Risk management, Metrics and targets

Four pillars. IFRS S2 applies them to climate.

Framework comparison

ISSB = investors, financial; GRI = stakeholders, impact; ESRS = law, double materiality

Use as a quick comparison for any question.

Reasonable assurance conclusion

Positive form: 'in our opinion, the information is prepared, in all material respects, in accordance with the criteria'

Higher level of assurance, more extensive procedures.

Limited assurance conclusion

Negative form: 'nothing has come to our attention that causes us to believe the information is materially misstated'

Lower level of assurance, fewer procedures, mainly enquiry and analytical work.

Preconditions for an assurance engagement

Appropriate subject matter + suitable criteria + sufficient appropriate evidence available + written report

Unsuitable criteria or no access to evidence means the engagement should not be accepted as an assurance engagement.

Greenwashing risk drivers

Pressure + opportunity + weak controls over data + vague criteria

A memory aid for explaining why misleading ESG claims arise.

Reasonable assurance conclusion

Positive form: information is prepared, in all material respects, in accordance with the criteria

High level of assurance. Needs more evidence and more testing, including a fuller risk assessment.

Limited assurance conclusion

Negative form: nothing has come to our attention that causes us to believe the information is materially misstated

Meaningful but lower level of assurance. Procedures are mainly enquiry and analytical procedures, with less detailed testing.

Suitable criteria

Relevant + complete + reliable + neutral + understandable

A practitioner needs suitable criteria before accepting the engagement. Without them, the engagement cannot be an assurance engagement.

Which standard to use

General sustainability: ISSA 5000 | GHG statement: ISAE 3410 | Other non-financial assurance: ISAE 3000

ISSA 5000 is the dedicated sustainability standard. ISAE 3410 remains the specific GHG standard.

Assurance engagement elements

Three-party relationship + subject matter + criteria + evidence + assurance report

The three parties are the practitioner, the responsible party and the intended users.

Reasonable assurance conclusion

Positive form: information is, in all material respects, in accordance with the criteria

Used where risk is reduced to an acceptably low level.

Limited assurance conclusion

Negative form: nothing has come to our attention that causes us to believe the information is materially misstated

Procedures are more limited in nature, timing and extent. The report must make clear that the assurance is limited.

Suitable criteria

Relevance, reliability, neutrality, understandability, completeness

Check these at acceptance. Unsuitable criteria are a reason to decline.

Expert assessment

Competence + capabilities + objectivity, then evaluate the work

Assess these three factors for both the responsible party's expert and your own expert. Then evaluate whether the expert's work is adequate for the purposes of the engagement.

Assurance risk

Assurance risk ≈ risk of material misstatement × detection risk

Assurance engagements use a risk concept similar to audit risk. Assurance risk is the risk of giving an inappropriate conclusion when the information is materially misstated. It is made up of the risk of material misstatement and detection risk. The multiplication is an analogy to the audit risk model, not a required formula. Limited assurance accepts a higher level of assurance risk than reasonable assurance.

Threat response sequence

Identify threats → Evaluate significance → Address (eliminate, safeguard) → Decline or withdraw if not possible

Use this for every independence scenario, including sustainability assurance.

Five threat categories

Self-interest, self-review, advocacy, familiarity, intimidation

Name the category, then tie it to a fact in the scenario.

Competence test for an expert

Competence + Capabilities + Objectivity (then evaluate work performed)

The practitioner remains responsible for the conclusion and does not pass it to the expert.

ISQM 1 components to link to

Governance and leadership, ethical requirements, acceptance and continuance, resources, engagement performance, information and communication, monitoring and remediation

Pick the components that fit the scenario rather than listing all of them.

Quick revision

• Sustainability assurance is an independent conclusion on sustainability information against suitable criteria.
• Assurance demand comes from investors, lenders, regulators and others who need to trust ESG information.
• Greenwashing is a key risk: claims may be misleading or unsupported.
• Check that the criteria are suitable: relevant, complete, reliable, neutral and understandable.
• Limited assurance gives a lower level of comfort than reasonable assurance, with less extensive procedures.
• ISSA 5000 is the general standard for sustainability assurance engagements.
• Assess risks of material misstatement, including risks in estimates and data from outside the entity.
• Consider whether you need an expert and whether you can rely on their work.
• Apply professional scepticism to management's targets, claims and methods.
• Independence, competence and quality management apply to sustainability work as they do to audit.
• Link every point to the scenario and state the consequence for the engagement.
• Conclude clearly and recommend a practical action.

Common mistakes

• Saying double materiality and financial materiality are the same. Fix: State the direction. Financial is outside-in. Double adds inside-out impact.
• Describing ISSB as a law that applies to all companies. Fix: Say ISSB sets standards. Jurisdictions decide whether to require them. The CSRD is an EU law.
• Writing generic points about 'transparency' with no link to the scenario. Fix: Tie every point to a named stakeholder and a fact in the scenario.
• Treating greenwashing as only a client reputation issue. Fix: Add that association with misleading information harms the practitioner's reputation and may bring liability or regulatory action.
• Saying ISSA 5000 replaces financial statement auditing or ISA standards. Fix: ISSA 5000 deals with sustainability information only. Financial statement audits still follow the ISAs.
• Treating limited assurance as 'no testing' or 'a quick read'. Fix: Limited assurance still needs planning, risk assessment and sufficient appropriate evidence for a meaningful level of assurance. Only the extent differs.
• Treating limited assurance as 'no assurance' or as a lighter ethical standard. Fix: State that limited assurance still gives meaningful assurance, still needs independence and ethics, and still needs sufficient appropriate evidence. Its procedures are more limited in nature, timing and extent, but can still include inspection and recalculation.
• Writing a positive-form conclusion for a limited assurance engagement. Fix: Use negative form for limited assurance: nothing has come to our attention. Use positive form for reasonable assurance.
• Treating sustainability assurance as outside the ethics framework. Fix: State that independence and ethical principles apply to all assurance, and IESBA's sustainability standards extend this to non-accountant practitioners.
• Listing threats without applying them to the scenario. Fix: Choose only the relevant threat and quote the fact that creates it, then give a specific safeguard.

Exam tips

• Always name the materiality lens when you mention a framework. It is the most common mark-earner.
• Use short comparisons by audience, materiality and legal status.
• Apply to the scenario facts. Generic lists earn few marks.
• Add one assurance point to each answer: criteria, data or evidence.
• Show professional skills: scepticism about claims, commercial awareness of stakeholders, and a clear recommendation.
• Always name the stakeholder and the decision they make; this earns scenario marks.
• Use scenario facts such as incentives, supplier data and new systems to spot risks.
• Cover the practitioner's risk as well as the client's.