Advanced Audit and Assurance (International) · Specific assignments

Sustainability, Integrated and Other Non-Financial Assurance for ACCA AAA

Updated 11 October 2026 · Fact-checked

Non-financial assurance is an engagement where you give a conclusion on subject matter that is not historical financial statements, such as ESG data, an integrated report or internal controls. You apply ISAE 3000 (Revised): agree the criteria, plan, gather evidence, then report at limited or reasonable assurance.

Understand Sustainability, Integrated and Other Non-Financial Assurance

An assurance engagement is one where a practitioner gives a conclusion that increases the confidence of intended users in the outcome of measuring a subject matter against criteria. In a financial audit the subject matter is the financial statements and the criteria is the financial reporting framework. In non-financial assurance, the subject matter can be greenhouse gas emissions, staff safety data, a sustainability report, an integrated report or the design of internal controls.

The general standard is ISAE 3000 (Revised). It applies to assurance engagements other than audits or reviews of historical financial information. It sets out five elements: a three-party relationship (practitioner, responsible party, intended users), an appropriate subject matter, suitable criteria, sufficient appropriate evidence, and a written assurance report. Sustainability assurance may also be performed under ISSA 5000, the IAASB's standard for sustainability assurance; read the question to see which standard is named, and use the same core ideas.

There are two levels of assurance. Reasonable assurance gives a positive conclusion, for example 'in our opinion, the information is prepared in all material respects in accordance with the criteria'. It needs extensive work, including understanding internal control and detailed testing. Limited assurance gives a negative-form conclusion, for example 'nothing has come to our attention that causes us to believe...'. It needs less work, mainly enquiry and analytical procedures, so the risk of an incorrect conclusion is higher. Work done must still be enough to give a meaningful level of assurance.

Suitable criteria are the key difference from financial audit. Criteria must be relevant, complete, reliable, neutral and understandable. For ESG data, criteria may be a recognised framework such as GRI or ISSB standards, or criteria developed by management. If management's own criteria are used, they must be available to users. Weak or vague criteria can mean the engagement should not be accepted.

Evidence is harder for non-financial data. Data often comes from outside the accounting system, from operational records, meters, suppliers or estimates. There may be no tested control environment, and forward-looking statements, such as climate targets, are uncertain. You may need an expert (for example an environmental scientist) and must assess their competence, capability and objectivity. An integrated report adds further issues: it covers several capitals and the business model, and contains narrative and judgement. Assurance often covers only selected parts.

Key rules to remember

Elements of an assurance engagement: Three parties + subject matter + suitable criteria + sufficient appropriate evidence + written report; Use as a checklist when deciding whether an engagement is an assurance engagement and whether to accept it.
Suitable criteria characteristics: Relevance, completeness, reliability, neutrality, understandability; Apply to any criteria, including management-developed ones. Criteria must be available to intended users.
Reasonable assurance conclusion: Positive form: 'in our opinion, subject matter is prepared, in all material respects, in accordance with criteria'; Needs risk assessment, control understanding where relevant, and further procedures responding to assessed risks.
Limited assurance conclusion: Negative form: 'nothing has come to our attention that causes us to believe the subject matter is materially misstated'; Work is mainly enquiry and analytical procedures. Risk of wrong conclusion is higher than for reasonable assurance.

How to solve Sustainability, Integrated and Other Non-Financial Assurance questions

Use this order for any scenario on ESG, integrated reports or other non-financial assurance. Tie every point to the facts given.

1Identify the requirement verb and the output: advise on acceptance, plan procedures, assess evidence, or draft the conclusion.
2Define the subject matter, the responsible party and the intended users in the scenario.
3Test the criteria: are they relevant, complete, reliable, neutral and understandable, and available to users?
4Decide the level of assurance, limited or reasonable, and state how it changes the nature and extent of procedures.
5Assess risks and match procedures to each risk: data source, estimates, completeness, bias in narrative, use of experts.
6Cover ethics and quality: independence, competence of the team, use of an expert, and professional scepticism.
7Conclude on the report: type of conclusion, any modification, and wording on scope limits or the criteria used.
8Add professional skills: be clear and concise, show scepticism, and give a commercial recommendation.

Quickest way: S-C-L-E-R check

When to use it: Use when time is short and you need a fast structure for a short 4 to 8 mark requirement.

S: subject matter and parties.
C: criteria suitable?
L: level of assurance, limited or reasonable.
E: evidence, including sources, estimates and experts.
R: report, conclusion type and any modification.

Common mistakes in Sustainability, Integrated and Other Non-Financial Assurance

Treating the engagement as a financial audit and quoting ISA procedures only.
ISAs are the most familiar standards and students default to them.
Fix: Name ISAE 3000 (or ISSA 5000 if given) and talk about criteria, level of assurance and the assurance report.
Ignoring whether the criteria are suitable.
In an audit the framework is given, so students skip this step.
Fix: Always test criteria against the five characteristics and say whether the engagement can be accepted.
Confusing limited and reasonable assurance procedures.
Students remember the words but not what changes in the work.
Fix: State that limited assurance relies mainly on enquiry and analytical procedures, while reasonable assurance adds control understanding and detailed testing.
Suggesting generic tests such as 'check to invoices' for ESG data.
Students copy financial audit tests without thinking about the data source.
Fix: Tailor tests to the data: recompute emissions from meter readings and conversion factors, trace to source records, test the system that collects it.
Forgetting ethics and the expert.
Focus is on procedures and the scenario's technical content.
Fix: Add a point on independence, competence of the team and evaluating the expert's competence, capability and objectivity.
Giving a positive opinion wording for a limited assurance engagement.
Students recall audit opinion wording.
Fix: Use negative-form wording for limited assurance and positive-form for reasonable assurance.

Worked examples

Example 1

Greenfield Co asks your firm to provide limited assurance on its published greenhouse gas emissions figure. Management has measured emissions using its own method, which is not published. Explain the issues in accepting the engagement and the procedures you would perform. (8 marks)

Show the solution

Subject matter is the emissions figure. The responsible party is management. The intended users are likely investors and other stakeholders.
Criteria issue: the method is unpublished, so users cannot see the basis. Criteria must be available to users, and also relevant, complete, reliable, neutral and understandable. Ask management to publish the method or use a recognised framework.
Acceptance: confirm the preconditions, including the competence of the engagement team, independence and access to records. If suitable criteria cannot be obtained, you should not accept.
Limited assurance procedures are mainly enquiry and analytical procedures. Enquire how data is collected and which sites and sources are included.
Compare emissions to prior year and to activity levels such as production volume, and investigate unexpected differences.
Test a sample of inputs to source records, for example fuel invoices and meter readings, and check conversion factors are appropriate and consistently applied.
Consider whether an expert is needed to evaluate the method, and assess their competence, capability and objectivity if used.
Report: a limited assurance conclusion in negative form, identifying the criteria used.

Answer: Accept only if the criteria are made available and suitable. Then perform mainly enquiry and analytical procedures with targeted checks to source data and conversion factors, and issue a negative-form limited assurance conclusion that states the criteria.

Example 2

During reasonable assurance work on an integrated report of Brightway Co, you find that the report describes a new product line as 'transforming the business', but board minutes show the line was making losses and is under review. Explain the implications for your work and report. (6 marks)

Show the solution

The statement is narrative and judgemental, so it affects neutrality, one of the characteristics of suitable criteria. Optimistic bias may mean the information is misleading.
Obtain evidence: read board minutes, budgets and management accounts for the line, and compare them with the statement.
Discuss with management and ask for evidence supporting the claim. Apply professional scepticism because the claim conflicts with internal evidence.
Evaluate materiality, quantitatively and qualitatively. A misleading description of a key product may be material even if the amount is small.
If management corrects the statement, no modification is needed. If not, and the effect is material but not pervasive, give a qualified conclusion. If pervasive, give an adverse conclusion.
Communicate the matter to those charged with governance.

Answer: The statement conflicts with internal evidence and is potentially misleading. Ask management to amend it. If it stays uncorrected and is material, modify the conclusion (qualified, or adverse if pervasive) and report to those charged with governance.

Exam tips

Always state the standard and the level of assurance early. It earns easy marks and frames the rest of the answer.
Tailor evidence to the data. Name the source, such as meters, supplier data or system outputs, rather than giving generic tests.
Link every point to the scenario. Generic textbook lists score poorly in AAA.
Show professional skills: a clear structure, scepticism where management claims conflict with evidence, and a practical recommendation.

Practice questions from Specific assignments

Sustainability, Integrated and Other Non-Financial Assurance in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

CS ProfessionalSustainability Audit and ESG Assurance

Sustainability, Integrated and Other Non-Financial Assurance: frequently asked questions

What is ISAE 3000 and when does it apply?

ISAE 3000 (Revised) is the IAASB standard for assurance engagements other than audits or reviews of historical financial information. It applies to subject matter such as ESG data, integrated reports and internal controls. It sets requirements on acceptance, criteria, evidence and reporting.

What is the difference between limited and reasonable assurance?

Reasonable assurance is a high level of assurance and gives a positive conclusion. Limited assurance is lower, uses fewer procedures such as enquiry and analytics, and gives a negative-form conclusion. The risk of an incorrect conclusion is higher with limited assurance.

How do I assess whether criteria are suitable?

Check they are relevant, complete, reliable, neutral and understandable. Also check they are available to intended users. If management has developed its own criteria, they must be disclosed so users can understand the basis.

Do I need an expert for ESG assurance?

Often yes, for technical areas such as emissions modelling. You must evaluate the expert's competence, capability and objectivity, understand their work and decide if it is adequate. The engagement partner stays responsible for the conclusion.