Advanced Audit and Assurance (International) · Developments in sustainability assurance

Performing Sustainability Assurance Engagements: Planning, Evidence and Reporting

Updated 11 October 2026 · Fact-checked

A sustainability assurance engagement gives users confidence in ESG information. You accept the work, plan around the criteria and risks, gather evidence, use experts where needed, and report a conclusion. Reasonable assurance gives a positive opinion with higher work. Limited assurance gives a negative-form conclusion with less work.

Understand Performing Sustainability Assurance Engagements

Sustainability assurance is an assurance engagement where the subject matter is not financial statements. It could be greenhouse gas emissions, energy use, workforce data or a full sustainability report. The logic is the same as an audit: you form a conclusion on whether the information is properly prepared against stated criteria.

Start with suitable criteria. Without them you cannot assess anything. Criteria might be a reporting framework such as ISSB standards, or a company's own defined methods. They must be relevant, reliable, neutral, understandable and complete. If the criteria are weak, you may have to refuse the work or modify your report.

Next comes the level of assurance. In reasonable assurance, you reduce risk to an acceptably low level and give a positive conclusion, such as 'in our opinion the information is prepared, in all material respects, in accordance with the criteria'. In limited assurance, risk is reduced to a level acceptable in the circumstances, but higher than reasonable assurance. The conclusion is in negative form: 'nothing has come to our attention that causes us to believe the information is materially misstated'. Limited assurance involves procedures that are more limited in nature, timing and extent, usually with more emphasis on enquiry and analytical procedures. It may still include inspection, recalculation and other testing. Reasonable assurance requires more extensive procedures, including obtaining evidence on the operating effectiveness of controls where relevant.

Planning and risk assessment follow the usual pattern. You understand the entity, its processes for collecting ESG data, and its controls over that data. You set materiality, which may be quantitative or qualitative, because users of ESG data care about things such as safety incidents or legal breaches. You identify where misstatement is likely: estimates, data from third parties, manual spreadsheets, and new metrics.

Evidence must be sufficient and appropriate. Typical procedures include inspecting source records, recalculating, tracing data to meters or invoices, testing controls over data collection, analytical review against prior periods, enquiry, and site visits. You may need experts, such as an environmental scientist for emissions factors. You must assess their competence, capability and objectivity, and evaluate their work. You remain responsible for the conclusion. Finally, you consider management representations, evaluate misstatements, and issue a report that states the criteria, level of assurance, procedures summary, and conclusion. The exam asks you to apply all of this to a scenario.

Key rules to remember

Reasonable assurance conclusion: Positive form: information is, in all material respects, in accordance with the criteria; Used where risk is reduced to an acceptably low level.
Limited assurance conclusion: Negative form: nothing has come to our attention that causes us to believe the information is materially misstated; Procedures are more limited in nature, timing and extent. The report must make clear that the assurance is limited.
Suitable criteria: Relevance, reliability, neutrality, understandability, completeness; Check these at acceptance. Unsuitable criteria are a reason to decline.
Expert assessment: Competence + capabilities + objectivity, then evaluate the work; Assess these three factors for both the responsible party's expert and your own expert. Then evaluate whether the expert's work is adequate for the purposes of the engagement.
Assurance risk: Assurance risk ≈ risk of material misstatement × detection risk; Assurance engagements use a risk concept similar to audit risk. Assurance risk is the risk of giving an inappropriate conclusion when the information is materially misstated. It is made up of the risk of material misstatement and detection risk. The multiplication is an analogy to the audit risk model, not a required formula. Limited assurance accepts a higher level of assurance risk than reasonable assurance.

How to solve Performing Sustainability Assurance Engagements questions

Use this order for any scenario on performing a sustainability engagement. Link each point to the facts given.

1Identify the requirement: planning, evidence, experts, level of assurance, or report. Note the marks.
2Confirm acceptance points: suitable criteria, appropriate subject matter, access to evidence, competence of the team, ethics and independence.
3State the level of assurance and what it means for the nature and extent of procedures and the form of conclusion.
4Assess risks in the scenario: estimates, manual data, third-party data, new metrics, weak controls, and pressure from management.
5Link each risk to a specific procedure and say what evidence it gives.
6Address experts: need, competence, objectivity, scope of work, and evaluation of findings.
7Conclude on the report: unmodified or modified, and the wording of the conclusion.
8Add a professional skills point: scepticism, commercial awareness, and clear communication to the client.

Quickest way: Risk, procedure, evidence in three columns

When to use it: Use when time is short and the question asks for procedures or planning matters on ESG data.

List the scenario facts that create risk, in one line each.
Beside each, write the procedure: recalculate, trace, inspect, analyse, confirm, or enquire.
State the level of assurance and adjust the depth: more testing for reasonable, more enquiry for limited.
Add the expert point if any specialist knowledge appears.
Finish with one line on the conclusion wording.

Common mistakes in Performing Sustainability Assurance Engagements

Treating limited assurance as 'no assurance' or as a lighter ethical standard.
Students focus on fewer procedures and assume lower standards.
Fix: State that limited assurance still gives meaningful assurance, still needs independence and ethics, and still needs sufficient appropriate evidence. Its procedures are more limited in nature, timing and extent, but can still include inspection and recalculation.
Writing a positive-form conclusion for a limited assurance engagement.
Students copy the audit opinion wording.
Fix: Use negative form for limited assurance: nothing has come to our attention. Use positive form for reasonable assurance.
Ignoring whether the criteria are suitable.
Students jump straight to procedures.
Fix: Open with criteria. If they are vague or biased, say it affects acceptance and the report.
Listing generic audit procedures with no link to the ESG data.
Students recall a standard audit list.
Fix: Name the data, such as meter readings or fuel invoices, and the specific test on it.
Saying the expert's work removes the practitioner's responsibility.
Students confuse reliance with transfer of responsibility.
Fix: State that you remain responsible for the conclusion and must evaluate the expert's work and findings.

Worked examples

Example 1

A manufacturer asks you to provide limited assurance on its reported Scope 1 greenhouse gas emissions. Data comes from fuel purchase records at 12 sites, and emissions are calculated in a spreadsheet using conversion factors. Explain the procedures you would perform.

Show the solution

Criteria: confirm the company applies a recognised measurement method and that conversion factors come from an identified source.
Risk: manual spreadsheet, many sites, and use of conversion factors create risk of calculation error and wrong factors.
Understand the process: enquire how fuel data is collected, reviewed and consolidated at each site.
Analytical procedures: compare emissions by site with prior year and with production levels and investigate unusual differences.
Inspection: trace a sample of fuel quantities to purchase invoices and delivery records.
Recalculation: re-perform the spreadsheet calculations and check formulas and totals.
Factors: agree conversion factors to the published source and check they are the latest version.
Because assurance is limited, rely mainly on enquiry and analytics, with targeted testing where risk is higher.

Answer: Perform enquiry, analytical review, trace to invoices, recalculate the spreadsheet and verify the conversion factors against a published source, concentrating on higher-risk sites. This gives sufficient appropriate evidence for a limited assurance conclusion.

Example 2

You are the practitioner on a reasonable assurance engagement on a company's sustainability report. Certain water usage data was provided by a specialist consultancy hired by management. Explain how you would treat this and what form your conclusion would take.

Show the solution

Identify that the consultancy is management's expert. You still need sufficient appropriate evidence over the data.
Evaluate competence, capability and objectivity: qualifications, experience, professional membership, and any relationship with management.
Understand the expert's work: the scope, methods, assumptions and source data used.
Evaluate the work: consider whether findings are consistent with other evidence, the assumptions are reasonable, and the work is adequate for the purposes of the engagement.
If the work is inadequate, perform further procedures, use your own expert, or consider a modified report. If you use your own expert, assess that expert's competence, capabilities and objectivity and evaluate their work in the same way.
Because the engagement is reasonable assurance, perform more extensive procedures than enquiry, including evidence on the operating effectiveness of controls over water data where relevant, and detailed testing.
Conclusion form: positive, stating that the information is prepared in all material respects in accordance with the criteria, unless evidence leads to modification.

Answer: Treat the consultancy as management's expert, assess its competence, capabilities and objectivity, evaluate its work, and add your own testing. If you bring in your own expert, assess and evaluate that expert too. Report a positive-form conclusion if evidence is satisfactory. Responsibility for the conclusion stays with you.

Exam tips

Always state the level of assurance first. It sets the depth of procedures and the wording of the conclusion.
Tie each procedure to a fact in the scenario. Generic lists score poorly.
Use the professional skills marks: show scepticism about management data and communicate clearly to the client or board.
If an expert appears, cover competence, capability, objectivity and evaluation of the work, and confirm you keep responsibility.
If criteria look weak, raise it at acceptance and in the report.

Practice questions from Developments in sustainability assurance

Performing Sustainability Assurance Engagements in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Performing Sustainability Assurance Engagements: frequently asked questions

What is the difference between limited and reasonable assurance?

Reasonable assurance reduces risk to an acceptably low level and gives a positive conclusion. Limited assurance accepts a higher risk, uses procedures that are more limited in nature, timing and extent, and gives a negative-form conclusion. Both need independence and sufficient appropriate evidence.

What evidence do you gather for ESG data?

You use source documents, recalculation, analytical procedures, enquiry, site visits and tests of controls over data collection. The mix depends on the level of assurance and the risks identified.

Can I rely on an expert in a sustainability engagement?

Yes, where the expert is competent, capable and objective, and you evaluate the work. You still hold responsibility for the conclusion and cannot refer to the expert as a way to reduce it.

What should a sustainability assurance report contain?

It should identify the subject matter and criteria, state the level of assurance, describe responsibilities of management and the practitioner, summarise the work performed, and give the conclusion. It should also state any modification and the basis for it.