Third-party sustainability assurance readiness checklist (starting from limited assurance)

Structure (6 sections)

1. 1. Assurance drivers and scope definition

   Start with why: a listing venue rule, a customer contract, an investor requirement, or a voluntary credibility move. The driver sets the scope — a customer requirement usually needs only the metrics they care about (typically Scope 1 and 2 emissions and a few security metrics), while a listing rule fixes the scope for you. Define scope on four dimensions: which metrics or disclosures, which entities and sites, which period, and the level (limited or reasonable assurance). A first engagement usually starts with limited assurance over a small set of core metrics, both for cost and to let the internal process run once end to end. EU assurance requirements have moved recently, and two points can go straight into your plan: the Omnibus I Directive (EU) 2026/470 postponed the Commission’s deadline for adopting the limited assurance standards from 1 October 2026 to 1 July 2027, and removed the requirement in Article 26a(3) of Directive 2006/43/EC to adopt reasonable assurance standards by 1 October 2028. For the foreseeable future the statutory EU level is therefore limited assurance, so there is no need to over-build now against an expected step up to reasonable assurance. If the EU basis is your target, still confirm the dates applicable to you from the current consolidated text.

   Evidence to attach

   • · Note on the assurance driver and the scope decision record
   • · List of metrics to be assured (metric, definition, entity, site, period)
   • · Rationale for the assurance level chosen and the cost estimate
   • · Management and audit committee approval

   Common pitfalls

   • · Scoping too broadly and covering every Scope 3 category on the first engagement, with cost and timetable out of control
   • · Assuring metrics that differ from those the customer asked for, so the report is obtained but not accepted
   • · Budgeting to an earlier EU assurance timetable without checking the latest amendments

2. 2. Determining and disclosing the applicable criteria

   An assurance engagement needs applicable criteria — the rules against which your sustainability information is prepared. Common choices: the ISSB standards IFRS S1 and S2, the GHG Protocol, exchange rules, or entity-developed criteria (which must be publicly available where used). The criteria must be stated in the report and must match how the information was actually prepared. The most common first-engagement problem is not wrong data but unclear criteria: claiming preparation under the ISSB while the emissions boundary and method were not applied consistently with the GHG Protocol leaves the practitioner unable to determine which rule governs. Produce a criteria note during preparation, stating for each metric the rule relied on, its version and any interpretations applied.

   Evidence to attach

   • · Criteria note (per metric: rule relied on, version, interpretations and judgements)
   • · Definitions for entity-developed metrics and a note on their public availability
   • · Self-check record on consistent application of the criteria
   • · Explanation of differences from the criteria used in the prior period

   Common pitfalls

   • · Different metrics in one report prepared under incompatible criteria with no explanation
   • · Entity-developed metric definitions that exist only in internal spreadsheets and are not publicly available
   • · Continuing to apply an old interpretation after the criteria version changed, breaking peer comparability

3. 3. Closing internal control and evidence gaps

   The cost of an assurance engagement is driven mainly by the quality of the evidence trail. Close three kinds of gap before fieldwork: (1) process controls — segregation of duties and sign-off records across data collection, review and approval; (2) system evidence — a traceable link from source documents (utility bills, colocation statements, travel system exports) to the calculation workpapers; and (3) change records — approval and impact notes for any adjustment to basis, factors or boundary. The four-part record requirement in the "inventory quality management and calculation trail" section of tmpl-ghg-inventory-workpaper applies here. One practical move is an internal dry run: pick metrics at random and trace from the published figure back to source documents — wherever the trace breaks is exactly where a finding will be raised in fieldwork.

   Evidence to attach

   • · Data process map and segregation of duties (collection, review, approval)
   • · Index linking calculation workpapers to source documents
   • · Approvals and impact notes for changes to basis, factors and boundary
   • · Internal dry-run records and the remediation log for what it found

   Common pitfalls

   • · One person collecting, calculating and reviewing the data, so segregation of duties fails
   • · Source documents held by the supplier and unobtainable within the fieldwork deadline
   • · Skipping the dry run, so problems surface all at once during fieldwork and extend the timetable

4. 4. Selecting the practitioner and agreeing the engagement

   Sustainability assurance is not limited to accounting firms: the IAASB’s International Standard on Sustainability Assurance 5000 is explicitly positioned as a comprehensive, stand-alone and profession-agnostic standard that both professional accountant and non-accountant practitioners may use, applying to information on any sustainability topic prepared under multiple frameworks. When selecting, confirm: which assurance standard will be applied, the practitioner’s credentials and independence, their competence in your sector and metrics (capability in GHG accounting and in IT infrastructure differ widely), and whether your listing venue or customer requires a particular type of practitioner. The engagement letter should set out scope, applicable criteria, assurance level, timetable, report form and issuance deadline, and how findings will be communicated.

   Evidence to attach

   • · Practitioner credentials, independence statement and sector experience
   • · Check record on any listing venue or customer requirement as to the type of practitioner
   • · Engagement letter (scope, criteria, level, timetable, report form, communication protocol)
   • · Fee budget and the internal support resourcing plan

   Common pitfalls

   • · Choosing a practitioner the listing venue or customer does not accept, so the report cannot be used
   • · No issuance deadline in the engagement letter, so the assurance report is unavailable before the annual report is published
   • · The practitioner also performing the implementation consulting, putting independence in doubt

5. 5. Fieldwork support, findings and remediation

   Before fieldwork: have the prepared-by-client list complete by the agreed deadline, designate one coordinator plus an owner per metric, prepare system access and a demonstration environment, and arrange any site visits. During fieldwork the rule is: do not adjust numbers ad hoc. Errors found should be corrected through the formal process and recorded rather than quietly edited in a spreadsheet — an unrecorded adjustment is treated as a control deficiency. Findings fall into two groups: misstatements that affect the conclusion (to be corrected or reflected in the conclusion) and improvement observations that do not (to go into next year’s improvement plan). Keep a log and close the loop on both. A first engagement normally produces a number of findings; what matters is completing the find-correct-improve-the-control chain.

   Evidence to attach

   • · Prepared-by-client list and submission records
   • · Coordination plan (single coordinator, metric owners, site visit schedule)
   • · Findings log (facts, category, impact, correction or improvement, owner, deadline)
   • · Formal records and approvals for data corrections
   • · Control improvement plan

   Common pitfalls

   • · Late submissions pushing the timetable so the assurance report misses the annual report
   • · Editing figures directly in spreadsheets during fieldwork without a record, assessed as a control deficiency
   • · Correcting the current-period number without fixing the control, so the same finding recurs next year

6. 6. Stating the assurance conclusion and communicating it

   After the assurance report is issued, the commonest failures are in how it is described externally. Three lines not to cross: (1) never describe limited assurance as an audit or as "audited"; (2) never describe assurance over a subset of metrics as "the report has been assured" — state which metrics and which period are covered; and (3) never omit the assurance level. Put a fixed panel in the sustainability report listing the assured metrics, the assurance level, the practitioner’s name, the assurance standard and applicable criteria used, and where the full assurance report can be found. Prepare one agreed external line for investor relations and sales so that different channels do not say different things. Mark unassured metrics explicitly as well, or readers will assume the whole report is covered.

   Evidence to attach

   • · Text of the assurance coverage panel (metrics, level, practitioner, standards, where to find the report)
   • · Agreed external messaging document for investor relations and sales
   • · Approach to labelling unassured metrics
   • · Compliance review record for marketing and website statements

   Common pitfalls

   • · A website claiming the ESG report was "audited by a third party" when it was limited assurance over two metrics
   • · Assured and unassured metrics presented together with no distinction
   • · Sales material stating the position more strongly than the report, creating a misrepresentation risk