ISSA 5000 is very relevant in the European context of the CSRD, yet the aim of ISSA 5000 is that it can be applied to a broad scope of sustainability information, not only covering broader sustainability reports, but also information on environmental matters (such as greenhouse gas emissions), information on social matters (such as labor practices and diversity) and information on governance (such as on risk management and on oversight of sustainability matters). ISSA 5000 also acknowledges the diversity in how sustainability information can be presented and is applicable to the wide range of reports, such as sustainability information in sustainability reports, annual reports, or integrated reports. The scope of the assurance engagement may extend to all the sustainability information to be reported or only part of that information. In all cases, the practitioner must ensure that the scope of the assurance engagement is clearly defined to ensure that stakeholders understand the extent to which the sustainability information has been subject to assurance. ISSA 5000 also acknowledges that sustainability information can be compiled using different types of criteria such as local regulations, international frameworks, or voluntary standards. In addition to flexibility, also scalability is an important feature. The principles and procedures outlined in ISSA 5000 remain applicable whether the engagement involves a small business or a large multinational corporation. In various parts of ISSA 5000 this scalability is further explained. Due to the flexibility and scalability, the standard can accommodate the variety in the growing demand for sustainability assurance.

The standard covers the entire assurance process, from the principles for accepting an assurance engagement to communication via the assurance report. The standard includes requirements and application material. Application material provides more details about how to apply or interpret the particular requirement. The standard covers 53 pages of requirements (212 requirements) and around 130 pages of application material (602 statements), plus some appendices and four illustrations for the content of assurance reports. Figure 1 shows that, in my view, the standard can be divided in three parts:

Figure 1.

Content ISSA 5000.

1. Scope, definitions, quality- and ethics-management and the preconditions for the assurance engagement;
2. the process of performing the evidence-gathering procedures and evaluating the evidence and come to the conclusion;
3. the assurance report, content, form of conclusion and subsequent events.

Figure 1 shows that about half of the requirements in the standard actually address the assurance process itself, so from planning to forming the conclusion. All consecutive steps are covered (see also Table 1). The examples are limited, because these are included in the 219 pages additional implementation guidance document (IAASB 2025a).

The other half of the standard deals with the acceptance of the assurance engagement, the quality of the assurance engagement and the communication on the assurance engagement, including via the assurance report. There are relatively many requirements with respect to the assurance report. This is in my view good, because, in practice, worldwide there were many differences in the content of assurance reports and, in the end, this is what the intended user will see from the assurance engagement.

There is also a separate appendix, which clearly explains the distinction between the sustainability matter (topic or aspect of the topic) and the information about the sustainability matter. Understanding this distinction is important to prevent a possible expectation gap (Kamp-Roe­lands 2002). Especially with respect to sustainability information users may expect that an unqualified conclusion also implies that the entity’s sustainability performance is good. However, the assurance engagement covers the information about sustainability matters and does not provide a conclusion about how ambitious targets are set or how good the sustainability performance was.

Paragraph 2.2 describes the key concepts in ISSA 5000 and describes how in the requirements the challenges in sustainability assurance as earlier identified by the IAASB (IAASB-IRWG 2016) are addressed. For this discussion the structure of Figure 1 is used. The box on quality and ethics in this figure is discussed in paragraph 2.3.

The standard provides much more clarity between the differences in nature, timing and extent of the work effort in a reasonable and a limited assurance engagement. Where applicable, this is shown in separate boxes. Reasonable assurance is defined in article 18 as: In a reasonable assurance engagement, the practitioner reduces the engagement risk to an acceptable low level in the circumstances of the engagement as the basis for the practitioner’s conclusion. Limited assurance has an elaborated description: In a limited assurance engagement the practitioner reduces engagement risk to a level that is acceptable under the circumstances of the engagement but where that risk is greater than for a reasonable assurance engagement…The nature, timing and extent of procedures performed in a limited assurance engagement is limited compared with that necessary in a reasonable assurance engagement but is planned to obtain a level of assurance that is, in the practitioner’s professional judgment, meaningful. To be meaningful, the level of assurance obtained by the practitioner is likely to enhance the intended users’ confidence about the sustainability information to a degree that is clearly more than inconsequential.

The description of a limited assurance engagement conveys that limited assurance enhances a continuum. What is meaningful in the practitioner’s professional judgement may vary between more than inconsequential up to almost reasonable assurance. It is explicitly mentioned that the procedures in a limited assurance engagement will vary in nature and timing from, and are less in extent than for, a reasonable assurance engagement. ISSA 5000 shows the different procedures to be performed for reasonable and limited assurance engagements in separate boxes (see also Table 2). For practitioners this is very helpful. However, the descriptions in the requirements remain at a pretty high level. Because sustainability assurance engagements differ in nature it is difficult to exactly describe what needs to be done. Also, in a limited assurance engagement additional procedures need to be performed to obtain evidence if there still remains a risk of material misstatement. This is necessary until it is clear whether there is a misstatement or whether this is not (likely). Because each assurance engagement has different circumstances the nature, timing and extent of procedures may therefore vary. Especially in limited assurance engagements differences in interpretations between practitioners may occur. Therefore, it is good that for example, in the Netherlands, the Dutch professional body NBA has a working group where matters and their interpretations are coordinated.

The practitioner must ensure that the criteria used by the entity to report sustainability information are suitable for the assurance engagement. Suitable criteria are key to assess the sustainability information because they embody the requirements for the sustainability information, both in relation to content and quality. ISSA 5000 clearly notes that if criteria are unsuitable for a reasonable assurance engagement, they are also unsuitable for a limited assurance engagement. If the criteria are unclear or insufficient, the practitioner needs to request the entity to establish more robust criteria or, in extreme cases, exclude the information on the sustainability matter from the assurance engagement, if this is permitted within laws and regulations or otherwise consider the impact on the assurance conclusion. ISSA 5000 therefore dedicates especially in the application material many explanations to suitable criteria, as can be seen under the sections about preconditions for the assurance engagement, the engagement acceptance and continuance and under the risk assessment procedures.

ISSA 5000 provides detailed guidance on the two concepts that are key during the whole assurance engagement: (assurance) materiality and the assessment of a risk of a material misstatement (ROMM). Materiality is not defined in article 18, except for performance materiality. To prevent confusion with materiality used by the entity to select the most material topics, ISSA 5000 refers to this as the entity’s process to identify sustainability information to be reported. In a separate appendix the relation between the entity’s materiality process and that of the practitioner is explained (appendix 2). ISSA 5000 provides detailed guidance on the assessment of this process as part of the evidence-gathering procedures on the internal control system. ISSA 5000 emphasizes the importance that the entity has a suitable process for identifying the sustainability information to be reported, including the topics, aspects of topics and the reporting boundary. Otherwise, the sustainability information may be incomplete, not relevant, or obscure material sustainability information. Therefore, the more precise suitable criteria on the company’s process for identifying material sustainability information are, the less opportunity for management bias there will be.

The materiality-assessment of the practitioner for identifying and evaluating material misstatements at the disclosure level includes much guidance in the section on the planning procedures and distinguishes between two types of materiality:

• Materiality for qualitative disclosures; and
• Materiality for quantitative disclosures.

There is no difference between limited or reasonable assurance engagements, because materiality is based on the relevance to the information needs and decisions of the intended users.

Also the CSRD has been taken into account. Article 99 explicitly addresses: If the applicable criteria require the entity to apply both financial materiality and impact materiality in preparing the sustainability information, the practitioner shall take into account both perspectives when considering or determining materiality.

In considering or determining materiality, the practitioner considers disclosures that may be important to intended users. For sustainability information there may be many different types of users. However, in ISSA 5000 the practitioner may assume the common information needs of the intended users as a group. In addition, the application material shows that the practitioner may assume that intended users are informed users, for example by having reasonable knowledge of sustainability matters, understanding materiality concepts and understanding inherent uncertainties involved in measuring or evaluating the sustainability matters.

ISSA 5000 provides especially in the application material much guidance on qualitative factors that may be of relevance when considering materiality for qualitative disclosures and even for quantitative disclosures. Sustainability information covers various types of matters and as a result ordinarily, materiality is considered or determined for different types of disclosures. ISSA 5000 includes much guidance on performance materiality for quantitative disclosures. Quantitative disclosures may include financial information that is also reported in the financial statements, such as training expenses. The materiality for such disclosures can be different than for the audit of financial statements. The context in which the information is presented is different and often it is much more highlighted and thus may require a lower level of materiality. Materiality can be revised as a result of a change in the circumstances during the assurance engagement.

Assurance engagements are designed using a risk-based approach that is iterative and dynamic and can therefore be refined or revised during the course of the assurance engagement. ISSA 5000 requires the risk assessment procedures to be designed and performed to identify and assess risks of material misstatement (ROMM), for the limited assurance engagement at the disclosure level and for the reasonable assurance engagement at the assertion level for the disclosures. For a limited assurance engagement, the ROMM is less specific than for a reasonable assurance engagement because it is based on more limited information. A material misstatement occurs when the sustainability information reported by the entity deviates from the criteria to such an extent that it could result in different decisions by the intended users. This may arise from error or fraud, or unintended misstatements and it includes omissions, incorrect and biased information. ROMM may occur due to for example the complexity of the data, management bias, or weaknesses in the entity’s internal controls. In addition to considering individual types of misstatements, ISSA 5000 also includes considering the aggregation risk that arises when sustainability information is disaggregated (over components) and consider what types of errors or omissions would potentially constitute a material misstatement when aggregated with other misstatements, including the aggregate of uncorrected and undetected misstatements.

Table 1 includes an overview of the different risk assessment procedures as part of the assurance process. It shows that they are quite an important part of the sustainability assurance process. The practitioner needs to obtain a thorough understanding of the entity, its environment, its reporting policies and the system of internal control relevant to the sustainability matters and the preparation of the sustainability information before being able to identify ROMMs. For limited assurance engagements the depth of understanding is less than for a reasonable assurance engagement.

In principle, it is management of the entity that is responsible for designing, implementing and maintaining such internal controls that management determines is necessary to enable the preparation of sustainability information in accordance with the applicable criteria that is free from material misstatement, whether due to fraud or error. This is confirmed in the engagement letter and in the letter of representation. ISSA 5000 provides quite detailed information on the various components of an internal control system. It follows largely the components as identified earlier by COSO on internal control systems in the context of sustainability information (COSO 2023). The elements in ISSA 5000 relate to:

1. the control environment
2. the entity’s risk assessment process
3. the entity’s process for monitoring the system of internal control
4. the information system and communication, including:
5. understanding the entity’s process to identify sustainability information to be reported
6. understanding how information from external sources is recorded, processed, corrected and incorporated
7. evaluating the information system to support the preparation of the sustainability information and
8. control activities.

The descriptions in ISSA 5000 relate to a mature internal control system, while entities are still developing their sustainability information systems and related internal controls. On the immaturity itself there is limited guidance in ISSA 5000 other than that this increases the risks of a material misstatement and would require obtaining more persuasive evidence as noted in A427. Also, it is noted that robust criteria are helpful: The greater the degree to which the reporting framework or law or regulation specifies in detail the sustainability information to be reported, the lower the risk of material misstatement may be as there is less opportunity for management bias (A383). However, including only the areas where the processes are more mature is not always permitted by law. Because scalability is an important feature of ISSA 5000, the application material of ISSA 5000 does include some guidance on less complex entities where information systems are likely to be less sophisticated (A381).

After the risk assessment procedures, the practitioner needs to design further procedures to respond to those risks and gather further evidence that supports the conclusion. The procedures to be performed will vary depending on whether the engagement is aimed at obtaining reasonable or limited assurance. In a reasonable assurance engagement, the practitioner performs a wide range of procedures. Substantive procedures may include tests of details, such as verifying the accuracy of sustainability metrics, reconciling recorded data, reperforming calculations, and analytical procedures. Control testing involves evaluating the effectiveness of the entity’s internal controls over sustainability reporting, ensuring that the systems in place can produce reliable information. For limited assurance engagements, the nature, timing and extent of procedures are more limited in scope. Table 2 contains a summary of the differences in procedures in a reasonable and a limited assurance engagement as included in ISSA 5000.

One of the challenges in sustainability assurance is the qualitative nature of various information. Some qualitative disclosures may be factual and directly observable or easy to obtain evidence on. Other qualitative disclosures may be inherently judgmental and susceptible to management bias. Although ISSA 5000 includes much guidance on the potential ROMMs, on the procedures to obtain further evidence there is limited guidance other than how this is governed by reviewing the entity’s information system or the source of information (A241).

ISSA 5000 provides more guidance on forward-looking information, both under the section on evidence (art.89) and the section estimates and forward-looking information (art. 146), especially in the application material. Reporting criteria may require disclosure of the entity’s intended future strategy, targets, future plans or other intentions. For such forward-looking information, the practitioner is not required to obtain evidence about whether the strategy, target or intention will be achieved, or to come to a conclusion to that effect (A452). The practitioner does have to consider, based on the practitioner’s knowledge and experience, whether there are reasons to believe that the forward-looking information is clearly unrealistic. In addition, evidence can be obtained from minutes of meetings or reports on the business’s operations to evaluate whether management or those charged with governance have an intention and ability to follow the strategy, the target or intention actually exists or whether here is a reasonable basis for the intended strategy or target. Sometimes the reporting criteria themselves include how to develop estimates and forward-looking information and the related disclosures, including selecting and using appropriate methods, assumptions and data. Then the practitioner needs to evaluate whether the method has been appropriately selected and applied, whether the assumptions are appropriate and whether the data that have been used are appropriate. For a reasonable assurance engagement, a more detailed point estimate needs to be developed (see Table 2).

Proper documentation is the cornerstone of a high-quality sustainability assurance engagement. ISSA 5000 has separate requirements for documentation in each section. These requirements are shown in one appendix in the implementation guide (IAASB 2025a). Practitioners need to document all aspects of the engagement process, including the procedures performed, the evidence obtained, and the conclusions reached. This documentation serves several purposes: it provides a clear record of the work performed, supports the practitioner’s conclusions, and facilitates internal or external quality reviews.

The sufficiency and appropriateness of evidence are critical considerations in sustainability assurance. Therefore, what constitutes sufficient and appropriate is explained in ISSA 5000. The practitioner must ensure that the evidence gathered is reliable, relevant, and adequate to support the assurance conclusion. Due to the difference in nature, timing and depth of the assurance procedures, the type of evidence in a reasonable assurance engagement is different from that in a limited assurance engagement. Especially for limited assurance engagements it may be difficult to conclude when sufficient and appropriate evidence has been gathered.

Reading ISSA 5000 one may notice that the practitioner quite often will need to apply professional judgement during the course of the sustainability assurance engagement. Such decisions include the type of action that is most appropriate in the circumstances. Therefore, the engagement circumstances and the conclusion reached need to be properly documented. Examples of professional judgement include considering materiality, the risks of material misstatement, the nature, timing and extent of procedures to be performed, evaluating whether sufficient and appropriate evidence has been obtained, the type of conclusion to draw based on the evidence obtained, but also the appropriateness of qualitative disclosures or forward-looking information.

The more robust the reporting criteria are, the less professional judgment will be needed. Sustainability is however a matter on which views on what it enhances will continuously change in time, and as a result reporting criteria for sustainability information will always change in time. Therefore, it is important to document under which engagement circumstances the professional judgement was made.

The assurance report is the key deliverable to users of the sustainability information. ISSA 5000 provides detailed guidance on the structure and content of the assurance report, ensuring that it is clear, transparent and informative. In a reasonable assurance engagement, the practitioner’s conclusion is expressed in positive terms, indicating that the sustainability information is free from material misstatement. In contrast, a limited assurance engagement uses negative terms, stating that based on the procedures performed nothing has come to the practitioner’s attention to suggest that the sustainability information is materially misstated. Therefore, for limited assurance engagements the assurance report must include a summary of the work performed.

ISSA 5000 requires for the assurance report that certain elements are included in the assurance report as a minimum. Although this is referred as a short form assurance report, the number of elements to be included is quite a lot, and various wording is prescribed. In this way there is much similarity to the financial auditor’s report. What is new as a basic element, if applicable, is “Inherent Limitations in Preparing the Sustainability Information” (art. 190g). If such inherent limitations are fundamental for the intended user’s understanding this section can be included to draw the attention to the inherent limitations management encountered when preparing the sustainability information, such as for certain estimates, forward-looking information, or information from the upstream or downstream valuechain. The application material also notes that the practitioner can describe the effects on the practitioner’s procedures. Including such a paragraph does not imply that the practitioner needs to obtain less sufficient and appropriate evidence. The IAASB notes that such a specifically headed section is seen as more appropriate than including inherent limitations in an “Emphasis of Matter” paragraph. It is the intention that practitioners tailor such a paragraph to the facts and circumstances of the assurance engagement. ISSA 5000 itself has no examples to prevent boilerplate wording by practitioners, but the implementation guidance contains three examples: estimates, forward-looking information and value chain information.

In addition to the short form style of reporting, containing only the basic elements (art. 190) ISSA 5000 allows also for the option of a long form style of assurance report (A567). Long-form reports include other information and explanations. ISSA 5000 requires that if additional information is included that it should be clearly separated and noted that this is not intended to affect the practitioner’s conclusion (art.189).

Additional information may include:

• Emphasis of Matter paragraph: to draw the intended users’ attention to a matter presented or disclosed in the sustainability information that, in the practitioner’s judgment, is of such importance that it is fundamental to intended users’ understanding of that information. An Emphasis of Matter paragraph can only draw attention to a matter which is presented or disclosed by management in the sustainability information;
• Other Matter paragraphs: to communicate a matter other than those that are presented or disclosed in the sustainability information that, in the practitioner’s judgment, is relevant to intended users’ understanding of the engagement, the practitioner’s responsibilities or the assurance report. For example, the scope of the engagement has changed significantly from the prior period;
• Findings related to particular aspects of the engagement;
• Recommendations: if relevant to the intended user and clearly worded to prevent that it will be understood as a qualification to the practitioner’s conclusion; or
• Additional information: such as details on the competencies of the multidisciplinary team or details on the considerations of materiality.

Although ISSA 5000 notes that the widespread use of emphasis of matter paragraphs and other matter paragraphs may diminish the effectiveness of the conclusion, in this current stage of sustainability assurance the long form of reporting, in my view, maybe insightful to the intended users.

The IAASB has not included key assurance matters (KAM) in ISSA 5000 because respondents to the draft ISSA 5000 noted that communicating KAM in a limited assurance engagement could be confusing to the intended users given that already a Summary of Work Section was required. The IAASB may consider KAM in the future in a post-implementation review of ISSA 5000 (IAASB 2024c).

Overall, in my view, it is very good that ISSA 5000 provides much more guidance on the content of the assurance report, since they are very different worldwide. In contrast to the NBA in the Netherlands, in many countries there are no templates made available by professional bodies on the content of the sustainability assurance report.

ISSA 5000 dedicates much attention to the competence of the team. It is a prerequisite to perform the engagement. Sustainability assurance engagements often require specialized knowledge of environmental, social, and governance issues, in addition to traditional assurance skills. It is the engagement leader’s responsibility that all involved in the engagement collectively have the appropriate competence in sustainability, competence and capabilities in assurance skills and techniques, and sufficient time, to perform the engagement. This involves members of the engagement team, and any practitioner’s external experts and internal auditors who provide direct assistance. Within larger audit firms engagement leaders can often compose an in-house multidisciplinary team. Still there may be a need for work by experts in particular areas. Smaller firms will often have to engage with external experts. ISSA 5000 defines a practitioner’s expert as: An individual or organization possessing expertise in a field other than assurance, whose work in that field is used by the practitioner to assist in obtaining sufficient appropriate evidence. A practitioner’s expert may be either a practitioner’s internal expert (who is a partner or staff, including temporary staff, of the practitioner’s firm or a network firm), or a practitioner’s external expert. When using the work of an internal or external expert, the practitioner must assess the expert’s competence and objectivity and determine whether the expert’s work can be relied upon as assurance evidence. To take the responsibility for the conclusions reached this assessment includes reviewing the methods used by the expert, their conclusions, and any potential biases that could affect their conclusions. ISSA 5000 allows to refer in the assurance report to the practitioner’s expert, if it remains clear that the practitioner has sole responsibility for the assurance conclusion expressed (art.192 and A574). The practitioner can also consider using the work of internal auditors when performing certain assurance procedures. If there is an internal audit department, they are often involved in operational audits that increasingly include sustainability matters. Internal auditors, while not independent of the organization, therefore may be able to provide valuable insights into the organization’s sustainability controls and reporting processes. ISSA 5000 also includes the requirements and steps to be taken for using the work of another practitioner who has already performed an assurance engagement on some information that is part of the sustainability assurance engagement.

Professional skepticism, being an attitude that includes a questioning mind, being alert to conditions which may indicate possible misstatement due to error or fraud, and a critical assessment of evidence, is an essential attitude that practitioners must have when performing the assurance procedures. ISSA 5000 explains this concept, what behavior or skills may support the exercise of professional skepticism, what might impede professional skepticism and what actions can be taken to mitigate those impediments. ISSA 5000 discusses how practitioners should exercise professional skepticism when reviewing sustainability disclosures, ensuring that they are not influenced by management’s representations. Sustainability information is often subject to high levels of uncertainty, particularly when it involves forward-looking disclosures or qualitative judgments. Maintaining professional skepticism involves critically evaluating the evidence obtained during the engagement. Practitioners must be alert to inconsistencies or contradictions in the data, as well as any potential biases in the way the sustainability information has been reported. Sustainability disclosures may be subject to “greenwashing” where entities overstate their environmental achievements to improve their public image. Since good sustainability performance becomes more relevant to investors and access to finance, also the risk of fraud increases. ISSA 5000 provides guidance on potential fraud risks in relation to sustainability information, such as potential manipulation of sustainability data.