Advanced Audit and Assurance (International) · Professional and ethical developments

Sustainability, Fraud and Going Concern Developments in Assurance

Updated 11 October 2026 · Fact-checked

These developments cover three areas: assurance on sustainability information (ISSA 5000 and ISAE 3000), tougher auditor work on fraud (ISA 240) and a stronger approach to going concern (ISA 570). You answer by naming the standard, applying its requirement to the scenario, and giving a clear conclusion and action.

Understand Sustainability, Fraud and Going Concern Developments in Assurance

Assurance is no longer only about the financial statements. Investors, lenders and regulators now ask for confidence in sustainability and ESG information too. A sustainability assurance engagement is not a financial audit. The subject matter is different (emissions, energy use, diversity, targets), the criteria are different (frameworks such as ISSB or ESRS standards, or the entity's own stated criteria) and the evidence is often non-financial, estimated or from outside the entity.

ISSA 5000 is the IAASB's general standard for sustainability assurance. It can be used by professional accountants and other assurance providers. It builds on the ideas of ISAE 3000 (Revised): the practitioner must have suitable criteria, an appropriate scope, and must plan and perform the work with professional scepticism. You can give limited assurance (a negative-form conclusion, less work) or reasonable assurance (a positive conclusion, more work, like an audit). Check the scenario for which one the client wants and whether the entity can support it.

The key differences from a financial audit are these. The criteria may be less established. Boundaries matter, such as which entities and value-chain data are included. Data often comes from outside sources and is hard to test. Forward-looking statements and targets are common. The practitioner may need experts, for example for emissions or climate modelling. Ethics and quality management rules still apply, so independence, competence and ISQM 1 matter just as much.

The revised ISA 240 and ISA 570 reflect a public-interest push to make audits more responsive to fraud and going concern. Treat the exact paragraph wording with care and learn the themes. On fraud: management and those charged with governance hold primary responsibility for preventing and detecting fraud, but the auditor must be alert, stay sceptical, brainstorm within the team, assess fraud risks, respond to them and communicate properly. Revenue recognition fraud risk and management override of controls remain central. Expect more emphasis on stronger scepticism, use of technology and clearer reporting on fraud-related work.

On going concern: the auditor looks at management's assessment, the period covered, the evidence supporting the plans, and whether events or conditions cast significant doubt. The revised thinking pushes the auditor to challenge management more, evaluate the reliability of the information, and be clear in reporting. If a material uncertainty exists and is adequately disclosed, the opinion is unmodified with a separate going concern section. If disclosure is inadequate, the opinion is qualified or adverse. If the going concern basis is inappropriate, the opinion is adverse.

Key rules to remember

Assurance levels: Reasonable assurance = positive conclusion; Limited assurance = negative-form conclusion; Reasonable needs more evidence and procedures. Limited gives less assurance. State which applies.
Core engagement elements: Three-party relationship + subject matter + suitable criteria + sufficient appropriate evidence + written report; Use as a checklist for any sustainability assurance scenario, along with ISAE 3000 and ISSA 5000 ideas.
Fraud responsibility split: Management and TCWG: prevent and detect. Auditor: obtain reasonable assurance that the financial statements are free from material misstatement, whether from fraud or error.; Do not say the auditor must detect all fraud.
Presumed fraud risks: Revenue recognition (presumed risk) + management override of controls (always a risk); Both are significant risks for the audit. Auditors must respond with specific procedures.
Going concern opinion outcomes: Material uncertainty adequately disclosed → unmodified opinion + going concern section. Inadequate disclosure → qualified or adverse. Basis inappropriate → adverse.; Link the opinion to disclosure quality and appropriateness of the basis.

How to solve Sustainability, Fraud and Going Concern Developments in Assurance questions

Use this method for any question on sustainability assurance, fraud or going concern. It works for both written requirements and professional skills marks.

1Read the requirement and note the verb: explain, evaluate, recommend, advise or discuss. This sets the depth of your answer.
2Identify the area: sustainability assurance, fraud (ISA 240) or going concern (ISA 570). Name the standard early.
3Pick out scenario facts that matter: client size, data sources, targets, unusual transactions, finances, management attitude.
4Apply the relevant rules to each fact. For example, link an unreliable data source to evidence risk, or a cash shortfall to going concern doubt.
5State the risk or issue and the effect on the audit or assurance work, such as extra procedures, expert use or reporting changes.
6Give a clear recommendation or conclusion: the type of opinion, the level of assurance, or the communication needed.
7Add one ethical or quality point if relevant, such as competence, independence, scepticism or confidentiality.
8Check you have answered every requirement and used professional language suited to the reader.

Quickest way: Fact – Standard – Effect – Action

When to use it: Use it when time is short and the question has several scenario points to cover.

Underline each issue in the scenario (one line each).
Write the fact, then the standard or principle it triggers.
State the effect on risk, evidence or opinion in one sentence.
Finish each point with a specific action or recommendation.
Spend the last minutes on an overall conclusion and any professional skills points.

Common mistakes in Sustainability, Fraud and Going Concern Developments in Assurance

Treating sustainability assurance as identical to a financial audit.
Students reuse audit language and ignore the different subject matter and criteria.
Fix: State the subject matter, criteria, assurance level and evidence challenges first, then compare briefly with an audit.
Saying the auditor is responsible for preventing fraud.
Students blur the roles of management and the auditor.
Fix: Write that management and those charged with governance prevent and detect fraud; the auditor assesses risk, responds and reports.
Ignoring management override and revenue as standard fraud risks.
Students focus on the scenario's unusual items only.
Fix: Always mention these two as default significant risks, then add scenario-specific risks.
Confusing a material uncertainty with an inappropriate going concern basis.
Both involve doubt about the entity's future.
Fix: Ask two questions: is the basis still appropriate, and is the uncertainty adequately disclosed? Then choose the opinion.
Giving generic answers with no link to the scenario.
Students recall notes rather than apply them.
Fix: Quote or refer to a specific fact in every point and say why it matters.
Forgetting limited versus reasonable assurance.
Students assume all engagements give the same level of comfort.
Fix: State the assurance level, what it means for procedures and how the conclusion is worded.

Worked examples

Example 1

Your firm has been asked to provide limited assurance on the greenhouse gas emissions data in the sustainability report of Kora Co, a manufacturer. Much of the data comes from suppliers and has not been checked. Discuss the key issues for your firm and the assurance it can give. (8 marks)

Show the solution

Issue 1, assurance level: limited assurance requires less evidence than reasonable assurance, and the conclusion is in negative form. This suits the situation where supplier data is weakly controlled.
Issue 2, criteria: the firm must confirm that the criteria used to measure emissions are suitable and disclosed, for example a recognised reporting framework. Without suitable criteria, the engagement should not be accepted.
Issue 3, evidence: supplier data is unverified. The firm should test how the data is collected, compare it with invoices, usage records and prior periods, and challenge estimates. If the data cannot be supported, there may be a scope limitation.
Issue 4, competence and experts: emissions calculations are technical. The firm needs suitable skills or an expert, and must evaluate that expert's competence and objectivity.
Issue 5, boundary and completeness: confirm which sites and activities are included and that the boundary is clearly stated.
Issue 6, ethics and quality: confirm independence and apply the firm's quality management procedures, including engagement review.
Conclusion: the firm can accept the engagement if criteria are suitable and enough evidence can be obtained. If supplier data cannot be supported, it should modify its conclusion or decline.

Answer: The firm may give limited assurance if the criteria are suitable and it has the competence to perform the work. The unverified supplier data is the main risk and could lead to a modified conclusion or a scope limitation. The firm should use experts where needed, check the boundary, and apply ethical and quality requirements.

Example 2

During the audit of Delta Co, a retailer, cash flow forecasts show the overdraft limit will be breached in eight months. The bank has not yet agreed to extend it. Management says the going concern basis is appropriate. The financial statements include a note describing the uncertainty. Explain the audit procedures and the likely audit opinion. (7 marks)

Show the solution

Procedure 1: evaluate management's assessment, including its period and whether it covers at least twelve months from the date of the financial statements.
Procedure 2: test the cash flow forecast. Check arithmetic, compare assumptions with past results and external evidence, and carry out sensitivity analysis.
Procedure 3: obtain evidence on the bank facility, such as correspondence, covenant details and any signed renewal. Verbal assurance alone is not sufficient.
Procedure 4: review events after the reporting date and board minutes for further evidence of financial difficulty.
Procedure 5: obtain written representations about management's plans and their feasibility, noting these do not replace other evidence.
Opinion: if the extension cannot be confirmed, there is a material uncertainty. The going concern basis is still appropriate, and the note is adequate, so the opinion is unmodified.
Reporting: include a separate section headed Material Uncertainty Related to Going Concern that refers to the note.
If the note were inadequate, a qualified or adverse opinion would be needed.

Answer: The auditor should challenge the forecast, obtain independent evidence on the overdraft, review post-year-end events and obtain representations. If a material uncertainty remains and the note is adequate, the opinion is unmodified, with a separate Material Uncertainty Related to Going Concern section. If disclosure is inadequate, the opinion would be qualified or adverse.

Exam tips

Name the standard (ISSA 5000, ISAE 3000, ISA 240, ISA 570) in your first line. It shows the marker you know the framework.
For fraud questions, split your answer into risk assessment, response and communication. This gives structure and picks up marks easily.
In going concern answers, always state the opinion and the reporting wording, not just the procedures.
Use professional skills marks: show scepticism by questioning management's claims, and give a short, clear recommendation at the end.
Do not quote exact paragraph numbers or new wording unless you are sure. Explain the principle and apply it.

Practice questions from Professional and ethical developments

Sustainability, Fraud and Going Concern Developments in Assurance in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Sustainability, Fraud and Going Concern Developments in Assurance: frequently asked questions

What is the difference between sustainability assurance and a financial audit?

A financial audit gives assurance on financial statements against a financial reporting framework. Sustainability assurance covers non-financial information such as emissions, using different criteria and often less mature data. It may be limited or reasonable assurance, and experts are often needed.

What is ISSA 5000?

ISSA 5000 is the IAASB's standard for assurance on sustainability information. It can be used by accountants and other assurance providers. It covers acceptance, planning, evidence, and reporting, and it builds on ISAE 3000 principles.

Does the auditor have to detect all fraud under ISA 240?

No. Management and those charged with governance are responsible for preventing and detecting fraud. The auditor must obtain reasonable assurance that the financial statements are free from material misstatement, whether from fraud or error, and must stay sceptical.

When does a going concern issue lead to a modified opinion?

A modified opinion arises if disclosure of a material uncertainty is inadequate (qualified or adverse) or if the going concern basis is inappropriate (adverse). If the uncertainty is adequately disclosed, the opinion is unmodified with a separate section.