Summary
What does ESG assurance require in 2026? Under the EU’s Corporate Sustainability Reporting Directive (CSRD), limited assurance is now the only assurance duty: Omnibus I, Directive (EU) 2026/470, in force since March 18, 2026, removed the planned move to reasonable assurance. The CSRD now covers companies with more than 1,000 employees and EUR 450 million in turnover, with Member State transposition due by March 19, 2027. First action: pick the metrics most likely to be tested, trace each one from source document to disclosed figure, and fix the gaps before the auditor arrives.
Not legal advice. This article is general information for businesses, based on official sources checked in October 2026. Laws, thresholds and deadlines change, and how they apply depends on your company’s facts. Check the current text of each law or ask a qualified lawyer before you act.
An auditor asks for the invoice behind a single emissions figure. The sustainability manager opens a spreadsheet, scrolls, and goes quiet. The number is right. The trail is gone.
That moment, repeated across thousands of metrics, is what ESG assurance is about. This guide explains what limited assurance means, what changed under Omnibus I, how to prepare, and how the rules differ in Germany, the UK, the US and Canada.
What Is ESG Assurance?
ESG assurance is an independent check that sustainability information is accurate, complete and prepared under the stated framework. Providers usually work under ISAE 3000 (Revised) and, for greenhouse gas statements, ISAE 3410. A newer standard, ISSA 5000, is being adopted for sustainability assurance, so ask your provider which one it will apply. Assurance follows international assurance standards adapted for non-financial data, not the International Standards on Auditing used for financial statements.
What Changed for CSRD Assurance Under Omnibus I?
Limited assurance remains the only assurance obligation under the CSRD, and the plan to move to reasonable assurance has been removed (see AKD’s summary of the Omnibus I changes). Omnibus I also narrowed scope to companies above 1,000 employees and EUR 450 million in net turnover. Second-wave reports fall to 2028, on financial year 2027 data. Member States must transpose the directive by March 19, 2027, so national details can still differ.
| Level | Confidence | Typical wording | Status under CSRD |
|---|---|---|---|
| Limited assurance | Moderate | “Nothing has come to our attention that indicates material misstatement” | Required |
| Reasonable assurance | High | “Prepared, in all material respects, in accordance with the framework” | Removed as a planned requirement |
What Do Auditors Test Under Limited Assurance?
Auditors test compliance with the European Sustainability Reporting Standards (ESRS), the process you used to identify reported information, the digital tagging, and the placement of the statement in the management report. They rely on inquiry, analytical procedures and limited testing, not the full evidence gathering of a financial audit. The opinion sits with the sustainability statement.
How Do You Prepare for an Assurance Engagement?
Start with evidence, then controls, then method notes. Auditors trace each number from the disclosure back through calculations to source records, so every link in that chain needs a document.
- Source records: Invoices, meter readings, payroll extracts and supplier data stored by metric
- Calculation files: Visible formulas, version history and named reviewers
- Emission factors: Source, year and version recorded for every factor
- Controls: Validation checks, prior-year variance analysis, segregation of duties and access limits
- Methodology notes: Definition, formula, data source, frequency, assumptions and limits for each metric
- Materiality file: Documented double materiality assessment, since many disclosures depend on it
What Does the Assurance Process Look Like?
- Planning: The provider agrees scope, timing and materiality
- Risk assessment: High-risk disclosures get deeper testing
- Testing: Inquiry, analytical review, document checks and recalculation
- Findings: Management discusses and corrects misstatements
- Opinion: The provider issues the limited assurance report
What Are the Most Common Assurance Problems?
Incomplete documentation causes most delays. Missing source data, undocumented methods and absent approvals all leave evidence gaps. Scope 3 is usually the weakest area because it leans on estimates and secondary data, and different methods across business units make comparison impossible. Our carbon reporting requirements guide explains how to document emissions data.
How Does Assurance Differ in Germany, the UK, the US and Canada?
Only the EU makes assurance a broad legal duty today. The other three markets are narrower or still moving.
| Market | Assurance position | Key date |
|---|---|---|
| Germany (EU) | Limited assurance under the CSRD once transposed into national law | Transposition by March 19, 2027; second-wave reports in 2028 |
| UK | UK Sustainability Reporting Standards are voluntary; no general assurance duty | FCA proposes January 1, 2027 for listed companies |
| US | California SB 253 requires no assurance for the first report; check CARB rules for later years | First Scope 1 and 2 reports due November 10, 2026 |
| Canada | No mandatory climate assurance; CSA paused its climate project on April 23, 2025 | S-211 report due May 31 each year |
Our post on California SB 253 filing covers the US deadline in detail.
How Do You Choose an Assurance Provider?
Choose a statutory auditor or an independent assurance services provider that meets your Member State’s rules. Compare ESRS knowledge, the standard they will apply, independence from any advisory work they already do for you, coverage of your countries, and experience with digital tagging.
ESG Assurance Readiness Checklist (2026)
- [ ] CSRD scope tested against 1,000 employees and EUR 450 million turnover
- [ ] National transposition status checked for each Member State
- [ ] Source-to-disclosure trace tested for the ten largest metrics
- [ ] Methodology note written for every metric
- [ ] Controls and sign-offs documented
- [ ] Provider selected and assurance standard confirmed
Frequently Asked Questions
Is reasonable assurance still planned under the CSRD?
No. After Omnibus I, limited assurance is the only assurance obligation in the CSRD.
Which companies need CSRD assurance now?
Companies in scope, now those above 1,000 employees and EUR 450 million in net turnover. Check how your Member State transposes the change by March 19, 2027.
What is the difference between limited and reasonable assurance?
Limited assurance gives moderate confidence through inquiry and analytical work. Reasonable assurance gives high confidence through extensive testing, similar to a financial audit.
Does California SB 253 require assurance?
Not for the first report due November 10, 2026. Check CARB’s current rules for later years.
When should we start preparing?
Twelve months before the engagement is a sensible minimum for companies without established ESG data systems, because controls and documentation take time to build.