Advanced Audit and Assurance (International) · Other current issues

Sustainability, ESG and Climate-Related Assurance for AAA

Updated 11 October 2026 · Fact-checked

ESG assurance is an independent engagement that gives users confidence in sustainability information, such as emissions or workforce data. You solve questions by identifying the subject matter and criteria, assessing risks of misstatement, choosing procedures, and stating the assurance level and conclusion. In a financial audit, you also consider climate risk's effect on the financial statements.

Understand Sustainability, ESG and Climate-Related Assurance

Sustainability information covers environmental, social and governance (ESG) matters. Examples are greenhouse gas emissions, energy use, health and safety records, board diversity and supply chain practices. Investors, lenders and regulators now rely on this information, so they want it to be reliable.

There are two separate ideas you must keep apart. The first is climate risk in a financial statement audit. Here the opinion is still on the financial statements. You ask how climate change could cause material misstatement. Examples are impairment of assets, useful lives and residual values, provisions for onerous contracts or restoration, fair values, going concern, and disclosures. Under ISA 315 (Revised 2019) you consider this when you understand the entity and its environment. Under ISA 720 (Revised) you read other information, such as a sustainability report in the annual report, and consider whether it is materially inconsistent with the financial statements or your audit knowledge.

The second idea is assurance on sustainability reporting. This is a separate engagement on the sustainability information itself. Until now, ISAE 3000 (Revised) and ISAE 3410 (greenhouse gas statements) have been used. The IAASB issued ISSA 5000, General Requirements for Sustainability Assurance Engagements, a standard for any sustainability assurance and for any assurance provider. It is built on the same ideas as ISAE 3000 and works with ISQM 1 and the IESBA's ethics and independence provisions for sustainability assurance. Check the effective date and current status in your study material.

An assurance engagement has set elements: three parties (practitioner, responsible party, intended users), an underlying subject matter, suitable criteria, sufficient appropriate evidence, and a written report. Criteria might be a framework such as the GHG Protocol or an ISSB or local standard. If criteria are not suitable, you cannot accept the engagement.

The level of assurance matters. Limited assurance gives a moderate level, with a negative-form conclusion (nothing has come to our attention that...). Reasonable assurance gives a high but not absolute level, with a positive-form conclusion (in our opinion...). Reasonable assurance needs more work. ISSA 5000 also allows different levels for different parts of the information, if the scope is clear.

Sustainability information raises particular difficulties. Data often comes from outside the ledger, such as suppliers, meters and estimates. Measurement can be uncertain. Controls may be weak because the information is new to the entity. You may need experts, such as engineers or scientists. Greenwashing, where claims overstate performance, is a major risk to the reporting entity and to you.

Key rules to remember

Financial audit vs ESG assurance: Financial audit: opinion on financial statements (ISAs) | ESG assurance: conclusion on sustainability information (ISAE 3000, ISAE 3410 or ISSA 5000); Different subject matter, different criteria, different report. Say which one the question is about.
Assurance levels: Reasonable assurance = positive opinion, high level | Limited assurance = negative-form conclusion, moderate level; Limited assurance still needs enough work to give a meaningful level, but less than reasonable assurance.
Elements of an assurance engagement: Three parties + subject matter + suitable criteria + sufficient appropriate evidence + written report; Use as a checklist for acceptance. Criteria must be relevant, complete, reliable, neutral and understandable.
Climate risk in financial statements: Climate risk → assumptions and estimates → possible misstatement in impairment, useful lives, provisions, fair value, going concern, disclosures; This is the link from climate risk to the financial audit.
Other information: ISA 720 (Revised): read, consider inconsistency with financial statements and audit knowledge, respond, report; Applies when a sustainability report sits in the annual report. It does not give assurance on that report.

How to solve Sustainability, ESG and Climate-Related Assurance questions

Use this method for any question on ESG, sustainability or climate assurance. It keeps your answer structured and tied to the scenario.

1Read the requirement and decide which engagement it is: a financial audit affected by climate risk, or a separate sustainability assurance engagement.
2Identify the facts in the scenario: the entity, its sector, the information reported, who the users are, and any frameworks or regulations mentioned.
3For assurance engagements, test acceptance: are the criteria suitable, is the subject matter identifiable, do you have competence and independence, and is evidence available.
4State the level of assurance (limited or reasonable) and explain how this changes the amount and type of work.
5Assess risks: poor data systems, estimates, reliance on third parties, weak controls, pressure to show good results, and greenwashing.
6Link each risk to a specific procedure, such as testing data back to source, recalculating emissions, inspecting supplier evidence, using an expert, or reviewing management's methodology.
7For a financial audit, link climate risk to the affected assertions and accounts, and to going concern and disclosures.
8Finish with the conclusion or report: type of opinion or conclusion, any modification, and communication with those charged with governance. Show professional scepticism and commercial awareness throughout.

Quickest way: Four-question scan: Which, Criteria, Risk, Procedure

When to use it: Use when you have limited time, or when you must plan a short answer worth 5 to 8 marks.

Which: financial audit or sustainability assurance? Write this in one line.
Criteria: what framework or basis is used, and is it suitable?
Risk: list two or three risks tied to facts in the scenario.
Procedure: give one specific procedure per risk, then state the level of assurance and the likely conclusion.

Common mistakes in Sustainability, ESG and Climate-Related Assurance

Treating ESG assurance as a normal financial audit.
Students apply ISA terms such as materiality to the financial statements and give an audit opinion.
Fix: State that the subject matter is sustainability information, the standard is ISAE 3000, ISAE 3410 or ISSA 5000, and the output is an assurance conclusion.
Confusing limited and reasonable assurance, for example saying limited assurance means no evidence is needed.
The word limited sounds like very little work.
Fix: Explain that limited assurance needs enough procedures for a meaningful moderate level, mainly enquiry and analytical procedures, while reasonable assurance needs more testing and risk assessment.
Ignoring suitability of criteria.
Students jump straight to procedures.
Fix: Always discuss criteria first. Without suitable criteria, there is no basis for evaluating the information, and you should not accept the engagement.
Listing climate risks generally without linking them to the financial statements.
Students write about climate change in broad terms.
Fix: Name the account and assertion affected, such as impairment of property, plant and equipment (valuation) or an unrecorded restoration provision (completeness).
Assuming the auditor gives assurance on a sustainability report in the annual report.
The report is published beside the audited financial statements.
Fix: Say the auditor only reads it under ISA 720 (Revised) unless a separate assurance engagement has been agreed.
Generic answers with no professional skills.
Students recall theory but do not apply it.
Fix: Use scenario facts, challenge management's claims with scepticism, give a clear recommendation, and write in a professional tone.

Worked examples

Example 1

Zephyr Textiles reports in its annual report that it cut greenhouse gas emissions by 20% this year. The board wants limited assurance on the emissions figure. Emissions are calculated by a junior employee from utility bills and supplier estimates, in a spreadsheet. Discuss the risks and the procedures you would perform. (8 marks)

Show the solution

Engagement type: this is a separate sustainability assurance engagement on a greenhouse gas statement. ISAE 3410 or ISSA 5000 applies, and the level is limited assurance.
Criteria: confirm which basis the company uses, such as the GHG Protocol. Check it is suitable, that it is applied consistently with last year, and that the boundary of the figure (which sites and activities) is clear.
Risk 1, data accuracy: figures come from bills and supplier estimates. Utility bills may be incomplete or estimated. Procedure: agree a sample of figures to bills and meter readings, and enquire how gaps are filled.
Risk 2, calculation error: the spreadsheet is built by a junior employee with unclear review. Procedure: re-perform the calculations, test formulas and check the emission factors used against the published source.
Risk 3, completeness and bias: management wants a 20% reduction to be reported, so there is an incentive to omit sources or use favourable estimates. Procedure: compare the boundary to last year and to the list of sites, and perform analytical procedures on emissions against production and energy use.
Risk 4, estimates from suppliers: Procedure: enquire about the supplier method and assess its reasonableness. Consider whether an expert is needed.
Conclusion: because assurance is limited, procedures focus on enquiry, analytics and sample checks. If we find material misstatement we would ask management to correct it, and if it is not corrected we would modify our conclusion.

Answer: Treat it as a limited assurance engagement under ISAE 3410 or ISSA 5000. Confirm suitable criteria, then address data accuracy, spreadsheet calculation, completeness and bias, and supplier estimates, with specific procedures for each. Conclude in negative form, or modify if material misstatement is not corrected.

Example 2

You are the audit senior on Coastal Mining, a financial statement audit client. The company has a public net-zero pledge, and its mines are on coastlines exposed to flooding. Explain how climate-related risks could affect your audit of the financial statements. (6 marks)

Show the solution

Understand the entity: under ISA 315 (Revised 2019) you consider external factors, so physical risk (flooding) and transition risk (net-zero pledge, possible regulation) are relevant.
Impairment: mine assets may suffer lower recoverable amounts if flooding limits operations or the pledge forces closure. Assumptions in the cash flow forecast and discount rate must be challenged. Assertion: valuation.
Useful lives and residual values: shorter operating lives may mean higher depreciation. Assertion: valuation and allocation.
Provisions: restoration and decommissioning costs may rise, and the pledge could create a constructive obligation. Assertion: completeness and valuation of liabilities.
Going concern: if costs rise and revenue falls, review management's forecasts and sensitivity analysis, and consider the disclosures required.
Other information: if the annual report contains climate claims, read them under ISA 720 (Revised) and consider whether they are inconsistent with the financial statements. Show scepticism towards management's assumptions, and consider an expert for estimates.

Answer: Climate-related physical and transition risks affect impairment, useful lives, provisions, going concern and disclosures. Respond by challenging management's assumptions, considering experts, and reading the sustainability statements as other information under ISA 720 (Revised).

Exam tips

Begin by stating which engagement the question is about. Many students lose marks by mixing the financial audit and ESG assurance.
Always mention suitable criteria and the level of assurance in an ESG assurance answer. These are easy marks.
Tie every risk to the scenario and give a specific procedure, not just the word testing.
For climate risk in a financial audit, name the account, the assertion and the estimate affected.
Show professional skills: challenge management's claims, recommend a clear next step, and use a professional, concise style.

Practice questions from Other current issues

Sustainability, ESG and Climate-Related Assurance in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Sustainability, ESG and Climate-Related Assurance: frequently asked questions

What is ISSA 5000?

ISSA 5000 is the IAASB's standard for sustainability assurance engagements. It sets general requirements for practitioners, and it can be used by any assurance provider, not only auditors. Check your study material for its effective date and status.

What is the difference between a financial audit and ESG assurance?

A financial audit gives an opinion on financial statements using ISAs and a financial reporting framework. ESG assurance gives a conclusion on sustainability information using standards such as ISAE 3000, ISAE 3410 or ISSA 5000 and the criteria chosen for that information. The subject matter, criteria and report are all different.

How do you audit climate change risk?

You do not audit climate change itself. You assess how climate risks could cause material misstatement in the financial statements, such as in impairment, provisions, useful lives and going concern. Then you respond with specific procedures and consider disclosures.

What is the difference between limited and reasonable assurance?

Reasonable assurance is a high level of assurance, expressed as a positive opinion. Limited assurance is a lower, moderate level, expressed as a negative-form conclusion. Reasonable assurance needs more extensive evidence-gathering.