Sustainability assurance: ISSA 500 is published, European standards under development

New international standard

On 12 November 2024, the International Auditing and Assurance Standards Board (IAASB) published the International Standard on Sustainability Assurance 5000 (ISSA 5000). This Standard aims to establish a framework for practitioners carrying out sustainability assurance engagements. The publication of ISSA 5000 follows a consultation period held from August to December 2023 (for further details on the exposure draft, see our previous blog post).

The Standard is intended for use by third parties appointed by companies to perform assurance engagements on sustainability reports. However, it is up to individual jurisdictions to decide whether the assurance of sustainability information is required and whether compliance with the Standard is necessary. IAASB urges policymakers and practitioners to adopt ISSA 5000. At this stage, however, it is too early for countries to have confirmed their positions. 

ISSA 5000 applies to sustainability information reported across any sustainability topic and prepared under multiple frameworks. It is profession agnostic, supporting its use by both professional accountants and non-accountant assurance practitioners.

The Standard addresses both reasonable and limited assurance engagements. As outlined in the Standard, the level of assurance obtained in a limited assurance engagement is substantially lower than in a reasonable assurance engagement. Consequently, the procedures performed in a limited assurance engagement differ in nature, timing and extent from those in a reasonable assurance engagement.

The Standard acknowledges that some reporting frameworks, such as European Sustainability Reporting Standards (ESRS), require “double materiality” to be considered when preparing the sustainability information. The Standard positions itself as aligning with both traditional materiality and double materiality concepts. 

ISSA 5000 applies to assurance engagements on sustainability information reported for periods beginning on or after 15 December 2026 or specific dates on or after 15 December 2026. Early application of the Standard is permitted – which may be useful for those reporting as part of the first wave under CSRD, including non-EU parents reporting on a voluntary basis for the group.

IAASB Chair Tom Seidenstein noted in his keynote address that during development of ISSA 5000, they were mindful of the practical challenges of implementation. For this reason, they adopted a “no greenfielding” strategy by building on established practices within existing assurance standards, such as ISAE 3000 and ISAE 3410. 

The IAASB plans to publish a range of guidance and application materials by January 2025. 

IOSCO, the international body of securities regulators, has issued a Statement of Support for ISSA 5000. IOSCO believes the Standard can support high-quality assurance over sustainability-related information and may enhance the consistency, comparability and reliability of sustainability-related information provided to the market.

Tom Seidenstein also highlighted that ISSA 5000 addresses many elements within the Corporate Sustainability Reporting Directive (CSRD). However, as a global standard, ISSA 5000 does not incorporate specific European requirements, such as green and digital taxonomies. As a global baseline, IAASB anticipates jurisdictions will add requirements to meet their regulatory mandates.

What about the EU? 

The CSRD mandates that the European Commission adopts limited assurance standards by 1 October 2026. By 1 October 2028, it must also adopt reasonable assurance standards “following an assessment to determine if reasonable assurance is feasible for auditors and for undertakings”. EU Member States may apply national assurance standards, procedures or requirements until the Commission adopts an assurance standard. 

CSRD (recital 69) suggests that the Committee of European Auditing Oversight Bodies (CEAOB), the cooperative framework for national audit oversight bodies at the EU level, should adopt non-binding guidelines on assurance opinions on sustainability reporting, pending the European Commission’s adoption of an assurance standard. In March 2023, the Commission invited CEAOB to develop these non-binding guidelines, which were published on 30 September 2024. These guidelines do not constitute a standard and should be read alongside any national rules applicable to sustainability reporting assurance. 

Member States may recommend or require the use of CEAOB guidelines. In Spain, for example, the Spanish Securities Market Commission (CNMV) and the Spanish Accounting and Audit Institute (ICAC) have issued a statement recommending that pending publication of the technical sustainability assurance standard by ICAC, the CEAOB Guidelines and ISSA 5000 should be taken into account when preparing the assurance of sustainability reporting by an independent third party.

The Commission also requested CEAOB to prepare, by May 2025, technical advice for the development of EU-specific add-ons (and possible carve-outs) to ISSA 5000. This is to assist in the preparation of the Delegated Act adopting limited assurance sustainability standards. According to the Commission's letter to CEAOB, carve-outs will cover items contradictory to EU legal provisions, if any, and those specific to reasonable assurance. Add-ons will address elements not adequately covered by ISSA 5000. Examples include assurance opinions on the compliance of sustainability reporting with markup requirements and reporting requirements in Article 8 of the Taxonomy Regulation, as well as the format and content of the EU audit report.  

As the landscape of sustainability reporting and assurance continues to evolve, it is crucial for companies preparing reports under the CSRD or engaging in sustainability reporting more broadly to continue to monitor these developments. We recommend that in the meantime companies engage proactively with their chosen assurance providers to understand what standards they will be applying, whether this aligns with any requirements under their applicable law and how they will manage any deviations in approach between jurisdictions. 

For more information on the CSRD, see our CSRD Demystified materials.