The first request in a climate assurance engagement is often a simple one: show us how this number was calculated. For many sustainability teams, the headline figure for physical risk losses sits in a consultant's spreadsheet that nobody in-house can rerun, built on a dataset whose version nobody recorded. The assurer can't confirm a figure they can't retrace, and the team learns this in the middle of fieldwork, when there's little time left to rebuild the working. The deeper problem sits upstream: when an outside provider owns the methodology, the company can’t easily update its assumptions as sites and risks change, and the finance, property and risk teams who rely on the figures end up taking them on trust.
What is sustainability assurance, and how is it different from a financial audit?
Sustainability assurance is an independent practitioner's conclusion on whether a company's reported sustainability information follows the criteria it claims to follow, and it differs from a financial audit because much of what it tests, such as scenario-based climate figures, describes the future rather than transactions that have already happened. That difference changes who does the work, what they examine and how they reach a conclusion.
Who performs it
Accountancy firms and other independent assurance providers carry out sustainability assurance engagements. Some jurisdictions set registration or competence requirements for who can sign the conclusion, and the international standard is written for any competent practitioner rather than for auditors alone.
What an engagement involves
The practitioner and the company first agree the criteria, meaning the reporting standard the disclosures were prepared under, and which disclosures are in scope. The practitioner then gathers evidence on how each figure was produced and issues a written conclusion at an agreed level of assurance.
How it differs from a financial audit
A financial audit mostly tests historical transactions against invoices, contracts and bank records. Climate disclosures include estimates of losses that have not happened yet, so when there is no transaction to vouch for, the practitioner tests the method, the data and the assumptions that produced the figure.
How it differs from verification
Verification checks a specific dataset against a defined standard, such as a greenhouse gas (GHG) inventory or the hazard data behind a site’s flood figure. Assurance reaches a formal conclusion on the whole disclosure, the level of opinion reporting regimes refer to. That means the practitioner also tests the judgements behind the figures, such as the scenarios chosen, the time horizons used and how the materiality assessment decided which risks to report.
What is the difference between limited and reasonable assurance?
Limited assurance gives a negative-form conclusion, stating that nothing has come to the practitioner's attention to suggest the information is materially misstated, while reasonable assurance gives a positive opinion that the information is fairly stated, based on substantially more testing. For a forward-looking climate figure, the practical difference is that a limited engagement mostly asks how the figure was produced and whether it is plausible, while a reasonable engagement can reperform the calculation from the source data.
Limited assurance involves fewer procedures, but practitioners still ask how figures were produced. A limited engagement can still end in a qualified conclusion if a team cannot answer those questions.
Which assurance standards apply to climate disclosures?
The International Standard on Sustainability Assurance 5000 (ISSA 5000) is the main assurance standard for climate disclosures, setting a global baseline that several jurisdictions now adopt under their own name. Which one a practitioner uses depends on where the company reports and when its reporting period starts.
ISSA 5000
The International Auditing and Assurance Standards Board (IAASB) issued ISSA 5000 as a single standard for both limited and reasonable assurance, designed to work across reporting frameworks, including IFRS S2. It applies to periods beginning on or after 15 December 2026, so for calendar-year reporters the first periods assured under it will be 2027.
ISSA (UK) 5000
The UK Financial Reporting Council (FRC) issued ISSA (UK) 5000 in November 2025, aligned with the international text and with the same effective date. Its use is voluntary for UK assurance providers, but a UK-listed company that obtains assurance has to name the standard used, so the choice is visible to investors.
ASSA 5000
The Australian Auditing and Assurance Standards Board (AUASB) adopted ISSA 5000 as ASSA 5000 for periods beginning on or after 1 January 2025, two years ahead of the international effective date. A companion standard, ASSA 5010, sets how Australian assurance phases in from limited to reasonable.
The EU limited assurance standard
The European Commission is due to adopt a European Union (EU) limited assurance standard for CSRD by 1 July 2027. Until it does, each member state’s national requirements apply, and these commonly draw on ISAE 3000 or ISSA 5000.
ISAE 3000 (Revised)
ISAE 3000 (Revised), the International Standard on Assurance Engagements for work other than audits, is the standard most sustainability engagements have used to date. It still covers periods before ISSA 5000 takes effect, so a team’s current engagement may well run under it.
For a group reporting in more than one jurisdiction, the practical point is that the standards now share one architecture. A methodology built to satisfy ISSA 5000 is unlikely to need rebuilding for its local versions.
Which climate disclosure rules require assurance, and when?
Climate disclosure rules differ sharply on assurance: the EU's Corporate Sustainability Reporting Directive (CSRD) mandates it, UK Sustainability Reporting Standards (UK SRS) leave it voluntary but require disclosure about it, and IFRS S2, the climate standard within the International Financial Reporting Standards (IFRS), sets no requirement of its own.
This table sets out where each regime stands:
For CSRD reporters, the Omnibus I directive fixed limited assurance as the level to plan around. In the UK, assurance is voluntary but visible. Under Policy Statement PS26/19, the final UK SRS rules the Financial Conduct Authority (FCA) published on 30 September 2026, every in-scope annual report states whether assurance was obtained, so investors can compare one issuer with another. The FCA has said it will revisit mandatory assurance once UK SRS reporting has bedded in.
What evidence will an assurer ask for?
An assurer asks for the evidence that lets them trace each reported figure back to its source and reproduce it against the stated criteria. In practice, that request falls into four groups:
Criteria and boundary: The team shows which standard each disclosure was prepared under and which entities and sites it covers.
Process and controls: The team shows who prepared each figure, who reviewed it and who signed it off.
Data lineage: The team traces each figure from the source dataset, through any transformation, to the number in the report.
Assumptions and uncertainty: The team documents the scenarios, time horizons and estimates used, states the uncertainty or confidence range around each figure and explains any change from the prior period.
For physical climate risk specifically, assurers go further into dataset versions, proxies and manual adjustments, with specific questions on each and a recognisable kind of answer that satisfies them.
Is a qualitative or three-year-old scenario analysis still acceptable to an assurer?
A qualitative or older scenario analysis can still be acceptable to an assurer, provided the reporting standard permits that approach for the company's circumstances, the company documents why it fits and the inputs still reflect the business as it stands today. The assurer tests that justification as closely as the output itself.
When a qualitative analysis holds up
A qualitative analysis can hold up when the company can show that a quantified one wasn't proportionate to its circumstances. IFRS S2 asks for an approach that is commensurate with those circumstances, using reasonable and supportable information available without undue cost or effort, so limited data, skills or resources can justify it if the company explains the choice.
The line moves once money enters the disclosure. Where a company reports the financial effects of physical risk, as European Sustainability Reporting Standards (ESRS) E1 asks CSRD reporters to do, an assurer will expect a quantified basis behind those figures. A qualitative narrative alone is harder to defend there.
When an older analysis stops holding up
An older analysis stops holding up when the business it describes has moved on, rather than at a fixed age. IFRS S2 allows the scenario analysis itself to follow the company's strategic planning cycle, which at many companies spans several years. The resilience assessment it supports is still disclosed every reporting period, along with when the analysis was carried out.
Take a food retailer that ran its scenario analysis in 2023 and has since opened 40 stores and closed two distribution centres. On paper, the analysis still sits inside its planning cycle. In practice, the portfolio it models no longer exists, and an assurer comparing it with this year's asset register will see the gap straight away. The same challenge tends to follow when the hazard data behind an analysis has been superseded, or when its scenarios no longer match those used elsewhere in the report.
Practical tip: Plan a refresh of the scenario analysis at three points, rather than waiting for the planning cycle to end:
First, after a significant change to strategy or operations: Opening or closing sites, acquiring a business or changing supply chain sourcing all change the portfolio the analysis describes.
Second, when new climate science or scenarios are released: The NGFS published its first short-term scenarios in May 2025, and the Intergovernmental Panel on Climate Change’s (IPCC’s) next assessment cycle, AR7, is expected to start reporting from 2028.
Third, when moving from qualitative to financial: Replacing high, medium and low ratings with figures such as average annual loss changes the method itself, so the analysis needs rerunning rather than updating.
Will an assurer accept outputs from a third-party platform, and what do they need from the vendor?
An assurer can accept outputs from a third-party climate risk platform or modelling provider, but responsibility for the reported figures stays with the company, so the assurer expects the company to understand and evidence what the tool did. Assurance standards treat information produced with the help of a specialist as evidence the practitioner has to evaluate. ISAE 3000 (Revised) directs practitioners to evaluate a management's expert's competence and objectivity and the appropriateness of their work, and ISSA 5000 addresses the same question.
Ask any vendor for these, in writing:
Methodology documentation: The vendor explains how hazard, exposure and vulnerability combine into each figure, in enough detail for a third party to follow.
Named data sources and versions: The vendor names each dataset behind a figure and the release it came from, so a flood figure points to a specific hazard model and date.
Assumptions and parameters: The vendor states the scenarios, time horizons, return periods and damage functions applied to each site.
Reproducibility and change history: The vendor shows that the same inputs produce the same output, and logs what changed between reporting periods and why.
Evidence of review: The company records its own review of the outputs, and the vendor supports it with information on the team and institutions behind the models.
The contrast that matters to an assurer is between a black-box output and a transparent one. A black-box figure arrives as a number with a brand name attached. A transparent figure arrives with the working behind it, and only the second gives the assurer something to test.
Which climate disclosures are hardest to get assurance-ready?
Forward-looking, model-based figures are usually the hardest climate disclosures to get assurance-ready, because no invoice or meter reading sits behind them. The team has to create the evidence itself, by documenting the model, data and assumptions well enough for a practitioner to rerun the figure.
Four areas tend to draw the most questions, and each answers a question about the future that rests on estimates rather than records.
What losses might we expect from each risk, and how do they change over time?
Physical risk losses are figures such as AAL (average annual loss), PML (probable maximum loss) and the share of TIV (total insured value) at risk, modelled for each site under each scenario and time horizon. River flooding at a distribution centre, for example, might show a modest annual loss today that rises sharply by 2050 under a high-emissions scenario. Each figure depends on a hazard model, a damage function and a valuation, and each of those inputs needs a named source.
What might these risks mean for revenue, costs and assets?
Anticipated financial effects show what a risk could do to the business beyond physical damage. Business interruption from flooding at a manufacturing site, for instance, could delay deliveries to customers and push revenue into a later period. ESRS E1-9 asks for the anticipated financial effects of material physical and transition risks, and IFRS S2 asks for current and anticipated financial effects. Companies that began CSRD reporting for financial year 2024 can defer E1-9 until financial year 2027.
Where do our value chain emissions come from?
Scope 3 emissions are the emissions across a company’s value chain, from suppliers to the use of its products, and they rely heavily on supplier data and estimates. A retailer’s figure for purchased goods often rests on spend-based averages rather than data reported by each supplier. That reliance on estimates is why UK SRS gives a one-year relief and several regimes phase their assurance in later.
What are we assuming about the transition, and does it hold together?
Transition plan assumptions are the prices, technology costs and policy changes a company expects when it sets targets and pathways. A plan that assumes a future carbon price or a date for electrifying a vehicle fleet can only be tested for consistency with the rest of the plan and the company’s other disclosures.
For physical risk figures, a defensible number starts with a financial metric that can be traced. How to quantify physical climate risk in financial terms explains how AAL, PML and TIV are built at site level.
How should a team prepare climate disclosures for assurance?
A team prepares climate disclosures for assurance by making the working reproducible before the assurer arrives, through a readiness review, documented methods and controls and a dry run on the hardest figure.
The sequence most teams follow:
Map each disclosure to its criteria: The team lists every climate disclosure, the standard paragraph it answers and whether it falls inside the assurance scope.
Document the method behind each number: For every quantitative figure, the team records the data source, the version, the calculation and the assumptions in a form someone outside the team could follow.
Put controls and owners in place: Each figure has a named preparer, a named reviewer and a sign-off that leaves a dated record.
Run a dry run: The team traces one or two headline figures end to end, from source dataset to published number, exactly as an assurer would.
Agree scope early: The team and the assurance provider agree the disclosures in scope, the level of assurance and the standard before the period gets under way.
Groups reporting under more than one regime gain from using one methodology for the same figure everywhere. Otherwise a physical risk loss reported under CSRD and UK SRS can end up assured twice, built two different ways. Data gaps are the other common blocker, and SmartResilience's guide on climate risk data quality walks you through the six tests to run before CSRD and IFRS S2 assurance.
Practical tip: Run the dry run on the figure most likely to be challenged, usually a forward-looking financial effect, rather than the easiest one. The easy figures rarely hold up an engagement.
How far ahead should a team start, and what does assurance cost?
A team should start preparing before the reporting period being assured begins, because assurance tests the processes and controls that operated during the period, not only the figures at year end. Cost depends mainly on the level of assurance, the scope and how ready the company's data already is.
On cost, these drivers matter most:
Scope, more than level: Most regimes now fix the level of assurance, with CSRD set at limited, so the bigger lever for cost is which disclosures fall inside the engagement. Reasonable assurance costs substantially more where it applies, as it will across Australian climate disclosures from July 2030.
Forward-looking figures: Scenario-based losses and financial effects often lead the practitioner to bring in a specialist to evaluate the model behind them, which adds time that a historical emissions figure usually doesn't need.
Consistency across sites and entities: A large portfolio built on one methodology lets the practitioner test a sample and rely on it. When divisions calculate the same figure in different ways, each approach needs testing separately, and cost rises with the number of approaches rather than the number of sites.
First year versus later years: A first engagement includes the time the practitioner spends understanding the process end to end. Later years tend to cost less, but only if the methodology carries over unchanged.
Where the documentation work happens: Preparation a team does internally costs staff time. The same gap found during fieldwork usually costs more, because the practitioner's hours run while the team rebuilds the working.
Cost came up directly in the FCA’s UK SRS consultation: most respondents preferred disclosure to a mandate, partly to avoid the cost of requiring assurance before the market was ready. For budgeting, a provider can usually give a firm quote once scope, level and standard are agreed, so that discussion is worth having before the reporting period starts.
How SmartResilience helps you build an assurance-ready evidence base for physical climate risk
SmartResilience Climate Assessments attach a named methodology and full data lineage to every physical risk figure, so a team can hand an assurer the working behind each number rather than the number alone.
The evidence lines up with what an assurer expects from any modelling provider:
Documented methodology and named sources: Every site-level figure is built on documented sources, including IPCC AR6 (the Intergovernmental Panel on Climate Change's Sixth Assessment Report), JBA UK flood data and CMIP6 (the coordinated set of global climate model simulations behind AR6).
Exportable lineage for any figure: Your team can export the methodology, inputs and assumptions behind a single site's AAL or PML and hand them straight to the assurer.
An audit-ready change log: The platform records what changed between reporting periods and when, so a prior-period comparison has a written explanation behind it.
A live analysis rather than a dated one: Scenarios (RCP 2.6, 4.5 and 8.5, the Representative Concentration Pathways) and time horizons are set to your own planning timeline and stay current as sites are added or sold.
One assessment for several regimes: The same assessment produces IFRS S2 aligned, CSRD, ASRS and UK SRS disclosure outputs, so one figure is built one way.
SmartResilience
See SmartResilience in action
Book a free demo tailored to your organisation and assets.
Book a free demoA FTSE 100 client cut its climate risk analysis costs by more than 50% after replacing a black-box consultancy report with this transparent approach, and rolled it out across 53 countries in six weeks. SmartResilience works alongside your team as a long-term partner, so the methodology an assurer reviews in one cycle is still in place, and still current, in the next.
What should a team do before its next assurance cycle?
Before its next assurance cycle, a team gains most by picking the single forward-looking figure most likely to be challenged and tracing it, end to end, from source dataset to published number. ISSA 5000 takes effect for periods beginning on or after 15 December 2026, and every regime that adopts it will test climate figures against the same architecture. The working behind this period's figures is far easier to document now than to rebuild under questioning.
FAQs
Is sustainability assurance the same as verification?
No. Verification usually checks a specific dataset, such as a GHG inventory, against a verification standard. Sustainability assurance results in a formal limited or reasonable conclusion on a disclosure as a whole, under an assurance standard such as ISSA 5000 or ISAE 3000 (Revised).
Who can provide sustainability assurance?
Accountancy firms and other independent assurance providers carry out sustainability assurance engagements. ISSA 5000 is designed for use by any competent practitioner, not only auditors. In the UK, a registration regime for sustainability assurance providers is in development.
Does IFRS S2 require assurance?
No. IFRS S2 sets out what to disclose but leaves assurance to the jurisdictions that adopt it. Australia phases in mandatory assurance under ASSA 5010, while the UK, through FCA PS26/19, requires listed companies to disclose whether they obtained assurance without making it mandatory.
What is an assurance readiness assessment?
An assurance readiness assessment is a review, run internally or by an adviser, of a company's disclosures, data, controls and documentation against what an assurer will test. It identifies gaps and produces an action plan before the first formal engagement, so the gaps surface on the company's timetable rather than the assurer's.
Is ISSA (UK) 5000 mandatory?
No. The FRC issued ISSA (UK) 5000 for voluntary use by UK assurance providers. Under FCA PS26/19, a UK-listed company that obtains assurance must disclose which assurance standard was used, so the choice of standard becomes visible to investors.
Can one assurance engagement cover more than one regime?
It can, but only if the scope is agreed carefully. Each engagement is scoped to stated criteria, so a group reporting under CSRD and UK SRS has to agree with its provider which disclosures and which criteria are covered. Take independent advice on how to structure it.
