The assurance of sustainability: formula sheet

Key formulas

Triple bottom line

People (social) + Planet (environmental) + Profit (economic)

Three dimensions of performance. They are not summed into one number.

Six capitals (IIRC)

Financial, manufactured, intellectual, human, social and relationship, natural

Integrated reporting shows how the entity uses and changes these capitals to create value.

IFRS S1 / S2 structure

Governance, strategy, risk management, metrics and targets

The four content areas for both standards. S2 applies them to climate.

Materiality lens

GRI = impact materiality; ISSB = financial (enterprise value) materiality

The key distinction between the two sets of standards.

Integrated reporting vs sustainability reporting

Integrated report = value creation story for capital providers; sustainability report = wider ESG impacts

An integrated report is one concise report linking financial and non-financial information.

Reasonable assurance

Positive conclusion; engagement risk reduced to an acceptably low level

Comparable in form to an audit opinion. Needs more extensive procedures such as tests of controls and detailed testing.

Limited assurance

Negative-form conclusion: nothing has come to our attention that causes us to believe the subject matter is materially misstated

Risk is reduced to an acceptable level, but higher than for reasonable assurance. Procedures are mainly enquiry and analytical procedures.

Elements of an assurance engagement

Three-party relationship + appropriate subject matter + suitable criteria + sufficient appropriate evidence + written report

Use as a checklist for any non-audit assurance scenario.

Suitable criteria

Relevant, complete, reliable, neutral, understandable

Weak criteria are a common reason an engagement cannot be accepted.

Elements of an assurance engagement

Three parties + appropriate subject matter + suitable criteria + sufficient appropriate evidence + written report

Use this as a checklist when a scenario asks whether an engagement is an assurance engagement.

Suitable criteria characteristics

Relevant, complete, reliable, neutral, understandable

Apply each word to the scenario. For example, criteria chosen by management only to flatter results may fail neutrality.

Reasonable assurance conclusion

Positive form: 'In our opinion, the subject matter information is, in all material respects, prepared in accordance with the criteria'

Reached through extensive procedures. Assurance risk is reduced to an acceptably low level.

Limited assurance conclusion

Negative form: 'Nothing has come to our attention that causes us to believe the information is materially misstated'

Reached through fewer procedures. Assurance risk is higher than for reasonable assurance but still meaningful.

Engagement process

Preconditions → acceptance and terms → planning and risk assessment → evidence → evaluation → report

Use as the structure for any written answer.

Suitable criteria

Relevant + Complete + Reliable + Neutral + Understandable

Use as a checklist when asked whether management's measures are suitable. Mention disclosure of the criteria to users.

Reasonable assurance conclusion

"In our opinion, the subject matter information is prepared, in all material respects, in accordance with the criteria."

Positive form. Requires more extensive procedures than limited assurance.

Limited assurance conclusion

"Nothing has come to our attention that causes us to believe the subject matter information is not prepared, in all material respects, in accordance with the criteria."

Negative form. Fewer procedures, so a lower level of assurance.

Expert evaluation

Competence + Capabilities + Objectivity, then evaluate the work

Using an expert does not reduce your responsibility for the conclusion.

Report content

Title, addressee, criteria and subject matter, responsibilities, standard followed, independence and quality management, procedures summary, conclusion

Reports must also state the level of assurance. Limited assurance reports describe procedures more fully.

Quick revision

• Assurance needs suitable criteria; frameworks often provide them.
• Sustainability information can be narrative, estimated and forward-looking, which raises risk.
• Reasonable assurance gives a higher level of comfort than limited assurance.
• Limited assurance uses fewer and less extensive procedures, and the conclusion is worded negatively.
• Reasonable assurance gives a positive conclusion.
• ISAE 3000 covers assurance engagements other than audits or reviews of historical financial information.
• ISSA 5000 is the standard specific to sustainability assurance engagements.
• Check the preconditions before accepting: suitable criteria, access to evidence and an appropriate subject matter.
• Set materiality using both quantity and nature; users' needs for non-financial data differ.
• Use experts where needed, but assess their competence and objectivity.
• Keep scepticism high on management claims, estimates and green messaging.
• Link every point to the scenario and state a clear conclusion or recommendation.

Common mistakes

• Saying integrated reporting and sustainability reporting are the same thing. Fix: State that an integrated report is one concise value-creation report, while sustainability reporting covers wider ESG impacts in more detail.
• Mixing up GRI and ISSB materiality. Fix: Write GRI as impact on the world and ISSB as effect on enterprise value, then use that in your comparison.
• Describing sustainability assurance as an audit under the ISAs. Fix: Say that the engagement is performed under ISAE 3000 (Revised) or ISSA 5000, not as an audit of financial statements.
• Ignoring the difference between limited and reasonable assurance. Fix: State the level, the form of conclusion and the extent of procedures. Say that limited assurance gives less comfort.
• Treating limited assurance as an audit with a smaller sample only. Fix: Say that limited assurance relies mainly on enquiry and analytical procedures, while reasonable assurance requires more extensive testing and a positive conclusion.
• Writing only about the client's willingness to pay when asked about acceptance. Fix: Work through the preconditions: appropriate subject matter, suitable criteria, evidence access, competence, ethics, and a written report.
• Treating the engagement like a financial statement audit and giving a reasonable assurance audit opinion by default. Fix: Check the level of assurance in the scenario. Use ISAE 3000 or ISSA 5000 language and the correct form of conclusion.
• Ignoring whether criteria are suitable. Fix: Start with criteria. Test them against relevant, complete, reliable, neutral and understandable, and say whether users can access them.

Exam tips

• Always name the audience and materiality lens when comparing frameworks. These are the easy marks examiners look for.
• Apply the framework to the scenario. A list of capitals or S1 content areas on its own earns little.
• Link every framework answer to assurance: suitable criteria, data controls and the level of assurance.
• Write short, well-organised points with headings. This helps the professional skills marks for communication.
• Do not state a legal requirement to apply ISSB standards. Say it depends on each jurisdiction's adoption.
• Always name the standard (ISAE 3000 (Revised) or ISSA 5000) and the level of assurance in your answer.
• For differences, use a compare structure: subject matter, criteria, assurance level, evidence, conclusion.
• Link points to the scenario to earn professional skills marks for analysis and commercial acumen.