Advanced Audit and Assurance (International) · The assurance of sustainability

ISAE 3000 and ISSA 5000 Engagement Requirements for ACCA AAA

Updated 11 October 2026 · Fact-checked

ISAE 3000 (Revised) sets requirements for assurance engagements other than audits or reviews of historical financial information. ISSA 5000 applies similar principles specifically to sustainability information. To solve questions, check preconditions, accept the engagement, plan on risk, gather evidence, then conclude as reasonable or limited assurance.

Understand ISAE 3000 and ISSA 5000 Engagement Requirements

An assurance engagement is one where a practitioner gives a conclusion that increases the confidence of intended users in the subject matter information, such as a sustainability report. It is measured against criteria. ISAE 3000 (Revised) is the umbrella standard for assurance work that is not an audit or review of historical financial information. ISSA 5000 is the IAASB's standard for sustainability assurance. It is designed to work for any sustainability topic and for assurance by any suitably qualified practitioner, and it is built on the same ideas as ISAE 3000.

Start with the five elements: a three-party relationship (practitioner, responsible party, intended users), an appropriate subject matter, suitable criteria, sufficient appropriate evidence, and a written assurance report. If one is missing, it may not be a proper assurance engagement.

Before accepting, you check preconditions. The roles and responsibilities of the parties must be suitable. The subject matter must be appropriate: identifiable and capable of consistent measurement or evaluation. The criteria must be suitable, meaning relevant, complete, reliable, neutral and understandable. You need access to evidence, and you must expect a written report. You also need to confirm that you meet ethical and quality management requirements, and that the engagement team has the competence and capabilities, including any specialist skills. If a precondition is not met, discuss it with the engaging party. Do not accept the engagement as an assurance engagement unless the matter is resolved.

Once accepted, you agree the terms in writing, plan the work, and obtain evidence. You identify and assess risks of material misstatement in the information, then design procedures that respond to them. Professional scepticism and professional judgement apply throughout. You evaluate misstatements, obtain written representations, and consider other information before reporting.

Reasonable assurance gives a positive conclusion, such as 'in our opinion the report is prepared in accordance with the criteria'. It needs extensive procedures and a low assurance risk. Limited assurance gives a negative-form conclusion, such as 'nothing has come to our attention'. It needs fewer procedures, mainly enquiry and analytical procedures, and gives a meaningful but lower level of assurance. Limited assurance is not a weak audit. It still needs enough evidence to reach a meaningful level of assurance.

Key rules to remember

Elements of an assurance engagement: Three parties + appropriate subject matter + suitable criteria + sufficient appropriate evidence + written report; Use this as a checklist when a scenario asks whether an engagement is an assurance engagement.
Suitable criteria characteristics: Relevant, complete, reliable, neutral, understandable; Apply each word to the scenario. For example, criteria chosen by management only to flatter results may fail neutrality.
Reasonable assurance conclusion: Positive form: 'In our opinion, the subject matter information is, in all material respects, prepared in accordance with the criteria'; Reached through extensive procedures. Assurance risk is reduced to an acceptably low level.
Limited assurance conclusion: Negative form: 'Nothing has come to our attention that causes us to believe the information is materially misstated'; Reached through fewer procedures. Assurance risk is higher than for reasonable assurance but still meaningful.
Engagement process: Preconditions → acceptance and terms → planning and risk assessment → evidence → evaluation → report; Use as the structure for any written answer.

How to solve ISAE 3000 and ISSA 5000 Engagement Requirements questions

Use this order for any scenario question on assurance of sustainability information. Tie each point to facts in the scenario.

1Read the requirement and identify whether it asks about acceptance, planning, evidence, level of assurance or reporting.
2Identify the parties, the subject matter information and the criteria in the scenario.
3Test the preconditions: roles, appropriate subject matter, suitable criteria, access to evidence, competence, ethics and quality management, and a written report.
4State what you would do about any failure: discuss with the client, ask for changes, or decline or withdraw as an assurance engagement.
5Decide the level of assurance and explain how it changes the nature, timing and extent of procedures.
6Link risks in the scenario to specific procedures, such as testing data systems, recalculating metrics, and enquiry of management.
7Consider specialists and others' work, and your competence for the specialist subject matter.
8Conclude with the type of report or conclusion and any modification needed. Add a professional skills point, such as a clear recommendation.

Quickest way: PACE-R checklist for a short answer

When to use it: Use when you have limited time and the question asks for requirements or issues in a scenario.

P: Preconditions. Check parties, subject matter and criteria.
A: Acceptance. Competence, ethics, quality management and a written engagement letter.
C: Conduct. Plan on risk, apply scepticism and obtain evidence.
E: Evaluate. Misstatements, representations and other information.
R: Report. Reasonable (positive) or limited (negative) conclusion, with modification if needed.

Common mistakes in ISAE 3000 and ISSA 5000 Engagement Requirements

Treating limited assurance as an audit with a smaller sample only.
Students focus on the lower level of work and forget the procedures differ in nature as well as extent.
Fix: Say that limited assurance relies mainly on enquiry and analytical procedures, while reasonable assurance requires more extensive testing and a positive conclusion.
Writing only about the client's willingness to pay when asked about acceptance.
Students copy general client acceptance points from audit.
Fix: Work through the preconditions: appropriate subject matter, suitable criteria, evidence access, competence, ethics, and a written report.
Accepting any framework the client chooses as suitable criteria.
Students assume that a named framework is automatically suitable.
Fix: Test the criteria for relevance, completeness, reliability, neutrality and understandability. Bespoke or vague criteria may need to be disclosed or may be unsuitable.
Ignoring competence for specialist subject matter such as greenhouse gas data.
Students think a financial auditor can handle all information.
Fix: Discuss the team's capability, the use of a practitioner's expert, and how you would evaluate the expert's competence, capabilities and objectivity.
Giving the wrong conclusion wording.
Students mix up positive and negative forms.
Fix: Use positive form for reasonable assurance and negative form for limited assurance, and tie each to the procedures performed.
Listing generic points without using scenario facts.
Students rush to recall the standard and forget professional skills marks.
Fix: Quote or paraphrase scenario facts for each point and finish with a clear recommendation.

Worked examples

Example 1

Greenfield plc asks your firm to give assurance on its sustainability report. Management has chosen its own internal measures for emissions and has refused to give you access to underlying data supplier records. Explain the issues and what you would do on acceptance.

Show the solution

Identify the engagement: assurance over sustainability information, so ISAE 3000 (Revised) or ISSA 5000 principles apply.
Criteria: internally developed measures may not be suitable. Test them for relevance, completeness, reliability, neutrality and understandability. Users may not understand them unless they are clearly disclosed.
Evidence: access to records is a precondition. Without access to supplier data, you may not be able to obtain sufficient appropriate evidence.
Action: discuss both matters with management. Ask them to adopt suitable criteria or disclose the criteria fully, and to grant access to data.
Competence and ethics: confirm the team has emissions-data skills or can use an expert, and confirm independence and quality management requirements are met.
Decision: if the matters remain unresolved, do not accept the engagement as an assurance engagement. Management should be told why. Recommend a different type of service, such as agreed-upon procedures, if suitable.

Answer: The preconditions are not met because the criteria may be unsuitable and access to evidence is restricted. Raise both with management. If unresolved, decline the assurance engagement and consider an alternative service.

Example 2

A client wants a reasonable assurance report on its sustainability report, but the board has asked for a cheaper limited assurance report in year one. Explain the difference in the work and the report.

Show the solution

Define the aim: reasonable assurance reduces assurance risk to an acceptably low level. Limited assurance reduces it to a level acceptable in the circumstances, but higher than reasonable.
Procedures: reasonable assurance requires obtaining an understanding of internal control relevant to the information and performing substantive procedures such as testing, inspection and recalculation. Limited assurance relies mainly on enquiries and analytical procedures, with some further procedures as needed.
Risk assessment: both require risk assessment, but the depth is greater for reasonable assurance.
Conclusion: reasonable gives a positive opinion. Limited gives a negative-form statement that nothing has come to attention.
Report: the report must describe the level of assurance and the work done so users do not mistake limited for reasonable assurance.
Advice: explain that limited assurance costs less because the work is narrower, but users receive less confidence. Check that the engaging party agrees to the level and that the preconditions apply either way.

Answer: Limited assurance uses fewer, mainly enquiry and analytical procedures and gives a negative-form conclusion. Reasonable assurance needs more extensive evidence and gives a positive opinion. The report must make the level clear.

Exam tips

Answer acceptance questions by walking through preconditions, then competence, ethics and a written engagement letter. Use the scenario facts each time.
When asked to compare reasonable and limited assurance, cover the level of assurance risk, the nature of procedures, and the form of conclusion. Cover all three.
Link sustainability data risks to procedures. For example, manual data collection suggests recalculation and tracing to source records.
For ISSA 5000 questions, stress that it applies to sustainability assurance by any suitably qualified practitioner, built on ISAE 3000 ideas. Do not quote paragraph numbers.
Finish with a clear recommendation or conclusion to earn professional skills marks.

Practice questions from The assurance of sustainability

ISAE 3000 and ISSA 5000 Engagement Requirements: frequently asked questions

What is the difference between reasonable and limited assurance?

Reasonable assurance gives a high but not absolute level of assurance and a positive conclusion. Limited assurance gives a lower, but still meaningful, level and a negative-form conclusion. The procedures are more extensive for reasonable assurance.

What are the preconditions for an assurance engagement under ISAE 3000?

The roles of the parties must be suitable, the subject matter appropriate and the criteria suitable. You need access to evidence and a written report must be expected. You must also meet ethical and quality management requirements and have the right competence.

How does ISSA 5000 relate to ISAE 3000?

ISSA 5000 is the IAASB standard for sustainability assurance and follows the same assurance principles as ISAE 3000. It covers sustainability information across topics and can be used by any suitably qualified assurance practitioner. For exam answers, show you understand the shared process.

Can I decline a sustainability assurance engagement?

Yes. If preconditions are not met and management will not resolve the issue, you should not accept the engagement as an assurance engagement. You can explain why and suggest an alternative service if one is suitable.