Sustainability assurance is moving toward a common global baseline. The International Auditing and Assurance Standards Board developed ISSA 5000 as a profession-agnostic standard for assurance engagements on sustainability information across frameworks and topics.
Jurisdictions determine adoption and effective dates. The IAASB’s ISSA 5000 implementation page tracks adoption details, including local equivalents and dates. Reporting teams should confirm the requirements that apply to their organization and assurance provider.
Regardless of timing, assurance readiness is an operating discipline. It means a reported disclosure can be traced to appropriate evidence, prepared through a controlled process, and explained by accountable people.
Start with the reporting criteria
Assurance cannot repair an unclear reporting basis. For each disclosure, identify the framework, standard, regulatory requirement, company policy, boundary, unit, method, and materiality conclusion used.
Create a disclosure register that maps each reported statement or metric to:
- Applicable criteria.
- Data owner and preparer.
- Source system or document.
- Calculation and estimation method.
- Review control.
- Evidence location.
- Known limitation or judgement.
This register becomes the backbone of the assurance request list.
Build evidence at the point of preparation
Evidence should support both the input and the process. A utility invoice supports consumption, while a facility list supports completeness. An emission-factor publication supports the factor, while an approval log supports governance over the selection.
Screenshots and email attachments are fragile when they lack context. Retain original exports where possible, along with the query period, filters, preparer, extraction date, and reconciliation to the calculation population.
For estimates, preserve the rationale, inputs, assumptions, sensitivity, reviewer, and approval. “Best available data” is a conclusion that needs evidence.
Test the controls before the assurance period
Run a dry close and select sample disclosures. Ask an independent internal reviewer to trace each result from the report back to evidence and then forward from the source population to the report.
Test controls over:
- Completeness of entities, facilities, and value-chain categories.
- Data extraction and transfer.
- Unit and currency conversion.
- Emission-factor selection and versioning.
- Manual adjustments and estimates.
- Variance review and exception resolution.
- Management review and final approval.
Record who performed the control, when it occurred, what was reviewed, what exceptions were found, and how they were resolved. A policy that says “management reviews the data” is not evidence that a review happened.
Make materiality decisions reviewable
Materiality can involve both quantitative and qualitative considerations, depending on the reporting criteria. Preserve user needs, thresholds, scoring methods, stakeholder evidence, challenge, and governance approval.
The IAASB’s ISSA 5000 materials emphasize that materiality is applied throughout an assurance engagement and can address qualitative and quantitative disclosures. Preparers should expect questions about why information was included, omitted, aggregated, or presented in a particular way.
Clarify responsibility before fieldwork
Assign one coordinator for the request list, but do not centralize all answers in that person. Source owners should understand their data and be available to explain controls and judgements.
Agree on secure evidence exchange, naming conventions, version control, response deadlines, and escalation. Freeze the assured version of each disclosure and require approval for later changes.
Treat findings as system improvements
Classify findings by root cause: unclear ownership, incomplete population, weak evidence, inconsistent definition, calculation error, missing control, or late review. Assign corrective action, owner, and deadline.
The goal is not a perfect evidence room assembled at year-end. It is a reporting process that generates reliable evidence as normal work happens.
This article reflects information available on May 21, 2026 and provides general information, not assurance or legal advice.
Sources
See how Carbon Impact puts this guidance into practice.