Advanced Audit and Assurance (International) · The assurance of sustainability

Assurance on Sustainability and Integrated Reports for ACCA AAA

Updated 11 October 2026 · Fact-checked

Sustainability assurance is an independent conclusion on non-financial information, such as emissions data or an integrated report. Companies seek it to build trust. It follows ISAE 3000 (Revised) or ISSA 5000, often gives limited assurance, and differs from an audit in subject matter, criteria and level of assurance.

Understand Assurance on Sustainability and Integrated Reports

Companies now report far more than profit. They publish sustainability reports and integrated reports covering emissions, safety, supply chains, governance and long-term value. Users such as investors, lenders and regulators rely on these figures. But the figures are produced by management, who have a reason to look good.

Assurance closes that trust gap. An independent practitioner gathers evidence and gives a conclusion on whether the information is reliable. Assurance is not compulsory in every jurisdiction, so many companies choose it voluntarily. Others must obtain it because of law or regulation.

A financial statement audit uses well-known criteria, such as IFRS Accounting Standards, and gives reasonable assurance on a defined set of statements. Sustainability assurance is harder. Criteria vary between frameworks. Data is often non-financial, estimated, or comes from outside the entity's accounting system. Much of it looks forward or is qualitative. So the engagement is usually performed under ISAE 3000 (Revised), the general standard for assurance other than audits or reviews of historical financial information. ISSA 5000 is the IAASB's newer standard written specifically for sustainability assurance.

Assurance can be reasonable or limited. Reasonable assurance gives a positive conclusion and needs more work. Limited assurance gives a negative-form conclusion (nothing has come to our attention) and needs less work, so it gives less comfort. The report must be clear about which level was given.

The benefits are greater credibility, better internal data and controls, easier access to finance, and lower reputational risk. The limitations are real. Criteria may be immature or subjective. Data may be estimated. Limited assurance is only moderate comfort. Assurance does not prove the report is complete, and it does not cover the company's strategy or performance. The practitioner reports on the information, not on whether the company is sustainable.

Key rules to remember

Reasonable assurance: Positive conclusion; engagement risk reduced to an acceptably low level; Comparable in form to an audit opinion. Needs more extensive procedures such as tests of controls and detailed testing.
Limited assurance: Negative-form conclusion: nothing has come to our attention that causes us to believe the subject matter is materially misstated; Risk is reduced to an acceptable level, but higher than for reasonable assurance. Procedures are mainly enquiry and analytical procedures.
Elements of an assurance engagement: Three-party relationship + appropriate subject matter + suitable criteria + sufficient appropriate evidence + written report; Use as a checklist for any non-audit assurance scenario.
Suitable criteria: Relevant, complete, reliable, neutral, understandable; Weak criteria are a common reason an engagement cannot be accepted.

How to solve Assurance on Sustainability and Integrated Reports questions

Use this method for any question on why assurance is sought, what it achieves, or how it differs from an audit.

1Read the requirement and note whether it asks for reasons, benefits, limitations, differences or the practitioner's role.
2Identify the report in the scenario: sustainability, integrated, or another non-financial report. Note who the users are.
3State the engagement basis: ISAE 3000 (Revised) or ISSA 5000, and whether assurance is reasonable or limited.
4Link each point to the scenario. Name the company's facts, such as a bank lender, a planned bond issue or weak data systems.
5For differences, compare subject matter, criteria, level of assurance, evidence and form of conclusion.
6For limitations, consider criteria, estimates, non-financial data, scope and the level of assurance.
7Close with a judgement, such as whether to accept the engagement or what to recommend to the board.

Quickest way: Why, what, how much, limits

When to use it: Use when time is short and the question asks you to discuss or advise on sustainability assurance.

Why: users trust, finance access, regulation, better data.
What: subject matter and criteria used, and whether they are suitable.
How much: reasonable or limited, and what the conclusion wording will be.
Limits: subjective criteria, estimates, no assurance on strategy, limited comfort.
Tie each point to one fact in the scenario.

Common mistakes in Assurance on Sustainability and Integrated Reports

Describing sustainability assurance as an audit under the ISAs.
Students assume all assurance work is an audit.
Fix: Say that the engagement is performed under ISAE 3000 (Revised) or ISSA 5000, not as an audit of financial statements.
Ignoring the difference between limited and reasonable assurance.
Students treat assurance as one level of comfort.
Fix: State the level, the form of conclusion and the extent of procedures. Say that limited assurance gives less comfort.
Listing generic benefits with no scenario link.
Students memorise lists without applying them.
Fix: Tie each benefit to a user or fact in the case, such as a lender relying on emissions data.
Saying assurance proves the company is sustainable or that the report is fully complete.
Students overstate what the practitioner does.
Fix: Say the practitioner reports on the information against criteria. It does not endorse performance or strategy.
Forgetting the criteria issue.
Financial audits have settled frameworks, so students do not think about it.
Fix: Always ask whether the criteria are suitable and available to users. Unsuitable criteria can make the engagement unacceptable.

Worked examples

Example 1

A listed manufacturer plans to publish an integrated report and has asked your firm to provide assurance on it. The finance director says this is the same as the financial statement audit. Explain why companies seek assurance on such reports and how the engagement differs from the audit.

Show the solution

Why seek assurance: users such as investors and lenders rely on non-financial information that management prepares, so independent assurance increases credibility.
It can improve the quality of internal data and controls, support access to finance, and reduce reputational risk if the information is wrong.
It may also be required or encouraged by regulators or investors.
Differences in subject matter: the audit covers historical financial statements. The integrated report includes non-financial, qualitative and forward-looking information.
Differences in criteria: the audit uses IFRS Accounting Standards. The integrated report uses frameworks that may be less precise, so suitability of criteria must be assessed.
Differences in standards and assurance: the engagement follows ISAE 3000 (Revised) or ISSA 5000 and may be limited assurance, giving a negative-form conclusion. The audit gives reasonable assurance and a positive opinion.

Answer: Companies seek assurance to build user trust, improve data and controls, and support finance. The engagement is not the same as an audit. It differs in subject matter, criteria, standards, level of assurance and form of conclusion.

Example 2

Your firm has given limited assurance on a carbon emissions report. A board member asks what limitations the users should understand. Advise the board.

Show the solution

Level of assurance: limited assurance gives only moderate comfort, with mainly enquiry and analytical procedures, so some misstatements may remain undetected.
Criteria: emissions measurement involves estimates and methodology choices, so results depend on how the criteria are applied.
Data: much of the data may come from suppliers or outside the accounting system, so it is harder to verify.
Scope: the conclusion covers only the stated emissions information. It does not cover the company's strategy or overall environmental performance.
Use: users should read the conclusion with the criteria and scope, and should not treat it as a guarantee.

Answer: Users should understand that the assurance is limited, the data includes estimates, some inputs are outside the entity's control, and the conclusion covers only the stated information against the stated criteria.

Exam tips

Always name the standard (ISAE 3000 (Revised) or ISSA 5000) and the level of assurance in your answer.
For differences, use a compare structure: subject matter, criteria, assurance level, evidence, conclusion.
Link points to the scenario to earn professional skills marks for analysis and commercial acumen.
When asked about limitations, do not stop at limited assurance. Add criteria, estimates and scope.
Keep a recommendation at the end, such as accept with conditions, or agree the scope and criteria first.

Practice questions from The assurance of sustainability

Assurance on Sustainability and Integrated Reports in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Assurance on Sustainability and Integrated Reports: frequently asked questions

Why would a company obtain assurance on a sustainability report?

To make the information more credible to investors, lenders and other users. It can also improve internal data and controls and meet regulatory or investor expectations. It helps reduce reputational risk from misleading claims.

How is sustainability assurance different from a financial statement audit?

The subject matter is non-financial and often estimated. The criteria are less settled and must be assessed for suitability. The engagement is under ISAE 3000 (Revised) or ISSA 5000 and is often limited assurance.

What is ISAE 3000 (Revised)?

It is the IAASB standard for assurance engagements other than audits or reviews of historical financial information. It sets requirements on acceptance, planning, evidence and reporting. Practitioners use it for many sustainability engagements.

What are the limitations of assurance on integrated reports?

Criteria may be subjective, data may be estimated or external, and limited assurance gives only moderate comfort. The conclusion also does not cover the company's strategy or performance, only the stated information.