What Assurers Actually Ask for on Physical Climate Risk

A physical climate risk figure can be scientifically sound and still fail assurance. CSRD (the EU Corporate Sustainability Reporting Directive) requires limited external assurance on sustainability disclosures from a company's first reporting year. Assurers apply the same traceability test to physical risk figures that they apply to a financial statement line item: does every figure lead back to a named source and a documented method?

What do assurers actually check when they review physical climate risk data?

Assurers check whether every physical climate risk figure in a disclosure can be traced to a named data source, a documented method and a consistent set of assumptions.

That breaks down into four checks:

1. Traceability: Every figure names its data source, model and data vintage.

• A flood depth figure for a distribution centre, for example, names the Environment Agency dataset and release it came from, and a heat figure names the Met Office UKCP18 projections behind it.

2. Consistency: The scenarios, pathways and time horizons match the prior reporting period, or the change is documented and explained.

• If last year's disclosure modelled SSP2-4.5 (a Shared Socioeconomic Pathway for intermediate emissions) to 2050 and this year's uses SSP5-8.5 (very high emissions) to 2100, the switch needs a written reason.

3. Reproducibility: The calculation behind a headline figure such as AAL (average annual loss) or PML (probable maximum loss) can be rerun from documented inputs.

• A factory's AAL, for instance, traces back to the modelled flood depth, the depth-damage curve applied and the site's replacement value.

4. Gap documentation: Where site-level hazard data does not exist, the estimate used and the assumption behind it are on record.

• An overseas supplier site with no local temperature record, filled with a national average, needs that substitution written down.

CSRD requires limited assurance on sustainability disclosures from a company's first reporting year. The Omnibus I amending directive, adopted in February 2026, removed the planned move to reasonable assurance, so limited assurance is the level in-scope companies should plan around. Limited assurance still tests all four checks above with fewer procedures than reasonable assurance, a distinction SmartResilience's guide to audit and assurance for CSRD covers in more depth.

How do assurers verify the hazard and exposure data behind a risk figure?

Assurers verify hazard and exposure data by asking for names: the dataset behind each figure, its data vintage and any proxy used where a site lacks its own data.

What a defensible answer names:

The dataset

Name the actual source behind the figure, such as the Environment Agency's national flood risk data, instead of describing "a climate model."

The data vintage

Give the date the underlying hazard data was last refreshed, since a flood map from 2019 reads differently to an assurer than one updated this year.

The proxy

Where a site lacks local data, name the regional or national figure that stood in for it and explain the choice.

The adjustment

Document any manual correction applied to a modelled figure, including who made it and why.

A named, recognised dataset gives an assurer something to check a figure against. A "proprietary model" with no named inputs leaves them nothing to test, however accurate it is.

What do assurers expect from scenario and time horizon documentation?

Assurers expect the emissions scenarios and time horizons behind a physical risk figure to be named explicitly and to match the prior reporting period, or for any change to be documented and explained.

What should be on record:

• Which pathway was used: Name a specific scenario, such as an SSP or RCP pathway (the Shared Socioeconomic Pathways and Representative Concentration Pathways used by the Intergovernmental Panel on Climate Change, or IPCC). An assurer can check a named pathway, while "a high-emissions scenario" gives them nothing to verify.

• Which time horizons were modelled: State the years used, such as 2030, 2050 or 2100. A single undated figure leaves an assurer guessing which year it applies to.

• Whether the methodology changed: Put what changed between years and why in writing, since an assurer can review a document but not a colleague's memory.

Switching scenario sets between reporting periods without a documented reason tends to draw questions, because an unexplained shift makes this year's figures impossible to compare with last year's. A short note recording the change and the reason for it usually closes the question.

How do assurers assess the financial figures behind a disclosure, such as AAL or PML?

Assurers assess a financial figure by asking whether the calculation that produced it can be reproduced from documented inputs, not by judging whether the number looks reasonable.

Check each headline figure against this list before it goes to the assurer:

✓ The formula or model logic: Document how the figure was derived, for example how probability-weighted losses across modelled event severities combine into a single figure, well enough that a third party could recalculate it.

✓ The return period: For a PML figure specifically, name the return period it represents, such as 1-in-100-year or 1-in-200-year.

✓ Consistent units across the portfolio: Use the same definition everywhere, so a percentage of total insured value means the same thing at every site.

✓ The connection back to hazard and exposure data: Show how the figure links to the inputs covered in the previous section, so the working is visible alongside the number.

Practical tip: Before the next reporting cycle, pick one headline figure from last year's disclosure and try to reproduce it from your documentation alone. If your team cannot, an assurer will hit the same wall.

What happens when physical risk data has gaps or relies on estimates?

Physical risk data gaps do not automatically fail assurance, but undocumented ones are far more likely to. An unexplained gap leaves an assurer unable to tell a genuine data limitation from an omission, so it tends to be treated as a potential misstatement and investigated.

What good documentation covers:

• Site-level data gaps: Record which sites lack local hazard data and name the proxy used in their place, so a portfolio figure does not imply every site is equally well documented.

• The estimate itself: Flag it as an estimate inside the disclosure, as well as in the internal working file.

• Revisiting the estimate: Update it as better data becomes available, instead of carrying the same placeholder figure across several reporting cycles.

Example: A food retailer is a typical case. Modelled river flood data may cover almost every store, while a handful of rural distribution depots have no local record at all. Naming those depots, the regional figure used in their place and the reason for choosing it is what lets an assurer accept the estimate.

Which standards and frameworks do assurers check a physical risk disclosure against?

Assurers check a physical risk disclosure against two kinds of standard: the assurance standard that governs how the engagement is run, and the reporting standard the figures were prepared under.

What to check:

• ISSA 5000: The IAASB's (International Auditing and Assurance Standards Board's) International Standard on Sustainability Assurance 5000 is its dedicated sustainability assurance standard, effective for periods beginning on or after 15 December 2026, so many assurers will run their next engagements under it.

• ISAE 3000 (Revised): This International Standard on Assurance Engagements is the general assurance standard most sustainability engagements have used to date, and it still covers periods before ISSA 5000 takes effect.

• ESRS E1: This climate change standard within the European Sustainability Reporting Standards (ESRS) sets out the physical risk disclosures assurers test against, including E1-9 on the anticipated financial effects of physical risk. Companies that began CSRD reporting for financial year 2024 can defer E1-9 until financial year 2027 under Delegated Regulation (EU) 2025/1416, which makes FY2027 the first cycle in which those figures reach an assurer.

• IFRS S2: This International Financial Reporting Standard, the ISSB's (International Sustainability Standards Board's) climate-specific standard, is the baseline UK SRS is built on, so an IFRS S2 aligned physical risk disclosure largely carries across to UK reporting.

• UK SRS S2: The climate module of the UK Sustainability Reporting Standards (UK SRS) remains voluntary, though the Financial Conduct Authority's (FCA's) consultation paper CP26/5 proposes requiring listed companies to report against it for accounting periods beginning on or after 1 January 2027, with a final policy statement expected in autumn 2026.

Under CSRD, the European Commission is due to adopt its own limited assurance standard by 1 July 2027, and national requirements, which commonly draw on ISAE 3000 or ISSA 5000, apply until then. UK SRS S2's assurance requirements are not yet settled, so organisations should take independent legal and accounting advice on their specific reporting and assurance obligations.

How SmartResilience helps you get physical climate risk disclosures assurance-ready

SmartResilience helps get physical climate risk disclosures assurance-ready by attaching a named methodology and full data lineage to every figure it produces. One client replaced a black-box consultancy report with this transparent approach and cut its climate risk analysis costs by more than 50% compared with its previous provider.

With SmartResilience, your team can:

• Run a site-level physical risk assessment built on named, documented sources including IPCC AR6 (the IPCC's Sixth Assessment Report), JBA UK flood data and CMIP6 (the coordinated set of global climate model simulations behind the IPCC's AR6 projections).

• Export the full methodology and data lineage for any figure and hand it straight to your assurer.

• Pull up the inputs, return period and assumptions for a single site's AAL or PML figure when an assurer asks about it.

• Show exactly what changed between reporting periods, and when, from an audit-ready change log.

• Model the emissions pathways your organisation already uses over time horizons set to your own planning timeline, and keep them consistent from one year to the next.

SmartResilience works alongside your team as a long-term partner, reviewing hazard data twice a year and keeping every site's figures live as the portfolio changes. The assessment becomes part of how your organisation manages its sites day to day, and the methodology an assurer reviewed last cycle is still in place for the next one.

What's next

The next assurance cycle will test the figures a team reports this year, so the working behind them is easier to document now than to rebuild under questioning. A sustainability team that traces one site's headline figure back to a named dataset, a stated scenario and a reproducible calculation has already run the review an assurer will run. For companies that began CSRD reporting for financial year 2024, the E1-9 financial effects figures due in FY2027 make that exercise worth starting in the current cycle.

FAQs

What is the difference between limited and reasonable assurance under CSRD?

Limited assurance results in a negative-form conclusion: the assurer states they found no reason to believe the disclosure is materially misstated, based on fewer procedures. Reasonable assurance requires enough testing to give a positive opinion. Following the 2026 Omnibus I amendments, CSRD assurance stays at the limited level.

What is ISAE 3000, and how does ISSA 5000 relate to it?

ISAE 3000 (Revised) is the IAASB's general standard for assurance engagements other than audits, and most sustainability assurance has been carried out under it to date. ISSA 5000 is a dedicated sustainability assurance standard, effective for periods beginning on or after 15 December 2026, which many assurers are now adopting.

What is ESRS E1-9 and why does it matter for physical risk?

ESRS E1-9 is the disclosure requirement in ESRS E1 on the anticipated financial effects of material physical and transition risks, including the assets exposed to physical risk. Companies that began CSRD reporting for financial year 2024 can defer it until financial year 2027, after which those figures sit inside the assured disclosure.

Does UK SRS require external assurance?

No, not currently. UK SRS is voluntary and its assurance requirements have not been settled. The FCA has proposed requiring listed companies to report against it from 2027, and SmartResilience's guide to what UK SRS requires on physical climate risk covers the detail. Organisations should take independent legal and accounting advice on their specific obligations.

Can an assurer reject a disclosure that uses estimated data?

An assurer is unlikely to reject a documented estimate. They want to see which sites lacked local data, what proxy was used and why, recorded inside the disclosure itself rather than in a working file no one else can see.

How is physical climate risk assurance different from a financial statement audit?

Physical climate risk assurance tests forward-looking, model-based figures such as scenario-based losses, rather than historical transactions. Assurers still expect traceability and reproducibility, but the underlying data carries genuine scientific uncertainty, which is why documented assumptions matter as much as the figures themselves.