Five Steps to Assurance-Ready ESG Disclosures

Key Takeaways

• Mandatory assurance of sustainability disclosures is approaching under both CSRD (limited assurance from 2024/25) and UK frameworks (UK SRS from 2027)
• The five pillars of assurance readiness are: evidence architecture, estimation transparency, internal controls, mock audit walk-throughs, and designing for reasonable assurance
• Assurance providers test five assertions: completeness, accuracy, existence, cut-off, and classification
• Companies that build for assurance from the outset avoid costs 3–5x higher from retrofitting controls later
• Excel without documented controls, version management, and audit trails is not assurance-ready

Why Assurance Readiness Matters Now

The era of voluntary, unaudited sustainability disclosures is ending. Under the EU Corporate Sustainability Reporting Directive (CSRD), companies in the first wave are already subject to limited assurance of their ESRS disclosures. The European Commission has signalled a transition to reasonable assurance by 2028. In the UK, the Financial Reporting Council is developing sustainability assurance standards to support UK SRS reporting from January 2027.

For companies accustomed to producing sustainability reports with minimal external scrutiny, the shift to assurance fundamentally changes what is expected. Every number, every claim, and every qualitative statement must be traceable to documented evidence and prepared under governance processes comparable to financial reporting.

Companies that design their ESG data systems for assurance from the outset will find the process manageable. Companies that build their disclosures first and attempt to retrofit assurance controls later face costs estimated at 3-5 times higher, based on comparable financial reporting transitions.

What Assurance Providers Actually Test

Before examining the five steps, it helps to understand what an assurance provider is looking for. Sustainability assurance engagements, whether conducted under ISAE 3000 (Revised) or ISAE 3410 (for GHG statements), test five fundamental assertions:

1. Completeness — have all material items been included? Are there emissions sources, data points, or entities that should be in scope but have been omitted?
2. Accuracy — are the numbers mathematically correct? Have the right emission factors been applied? Do calculations trace from source data to reported figures without error?
3. Existence — do the reported items actually exist? Can the company produce evidence that the claimed energy consumption, activities, or initiatives are real?
4. Cut-off — have items been recorded in the correct reporting period? Has data been included from the full 12-month period without gaps or overlaps?
5. Classification — have items been categorised correctly? Are Scope 1 emissions genuinely direct? Are Scope 3 categories correctly assigned?

Every step below is designed to ensure your disclosures can withstand testing against these five assertions.

Step 1: Establish Your Evidence Architecture First

Before writing a single disclosure, map the evidence trail. Every claim in your sustainability report should be traceable to four elements:

• A source document (utility bill, meter reading, invoice, contract, survey response)
• A calculation methodology (which formula was applied and why)
• An emission factor with version and source (DEFRA 2025 v1.0, Table 1c, Row 15)
• An approval sign-off (who reviewed and approved the data point, and when)

If an assurance provider asks “show me the working for this number,” you should be able to produce it in minutes, not weeks. This means establishing a structured evidence repository — whether a dedicated ESG data platform, a controlled folder structure, or a well-governed spreadsheet system — with clear naming conventions, version control, and access logging.

The evidence architecture should be documented in a data management plan that specifies: where source data is stored, who is responsible for each data stream, how calculations are performed and recorded, and how the final reported figures link back to the source. This document itself becomes evidence of governance maturity.

Step 2: Separate Estimation from Measurement

Assurance providers will test whether you know the difference between measured and estimated data — and whether you have disclosed the distinction honestly.

Measured data comes from meters, invoices, direct monitoring instruments, or verified third-party measurements. Where you have metered electricity consumption or invoiced gas volumes, say so. This data carries the highest confidence level.

Estimated data uses proxies, extrapolations, or spend-based calculations. Spend-based Scope 3 estimates, prorated energy for shared buildings, or industry-average emission factors for upstream suppliers all fall into this category. For estimated data, you must document:

• The estimation methodology (spend-based, extrapolation from partial data, industry average)
• The emission factor source and its uncertainty range
• Why measurement was not feasible
• Any plans to improve data quality in subsequent periods

Transparency about data quality is itself a sign of maturity. An assurance provider will be far more comfortable with a company that clearly labels 30% of its Scope 3 as estimated (with methodology disclosed) than one that presents all figures as if they are equally precise.

Step 3: Implement Internal Controls Analogous to Financial Reporting

The ISSB framework explicitly expects sustainability data to be subject to governance processes comparable to financial data. Under UK SRS S1, companies must disclose the governance processes, controls, and procedures used to monitor, manage, and oversee sustainability-related risks and opportunities.

In practice, this means establishing:

• Defined data owners — every data stream has an identified individual responsible for its accuracy, with a RACI matrix (Responsible, Accountable, Consulted, Informed) documented and communicated
• Approval workflows — data moves from collection to calculation to reporting through defined stages, with sign-off required at each transition
• Segregation of duties — the person who collects and enters data should not be the same person who reviews and approves the final figures
• Documented review procedures — analytical review (comparison to prior period, to budget, to industry benchmarks) and substantive testing (recalculation of a sample of data points)
• Version control — every version of every calculation spreadsheet or data file is retained, with change logs showing what was modified, by whom, and why

Excel-based processes can be assurance-ready, but only with documented controls. A spreadsheet without cell protection, without a change log, without restricted access, and without a review trail is not fit for assurance purposes.

Step 4: Conduct a Mock Audit Walk-Through

Before your external assurance engagement, run an internal walk-through. This simulates the procedures an assurance provider will perform and identifies gaps before they become findings.

The process:

1. Select 10-15 data points from across your disclosure — a mix of Scope 1, Scope 2, Scope 3 (if reported), intensity ratio inputs, and qualitative claims
2. For each data point, trace from the published number back through the calculation to the source evidence
3. Test each against the five assertions: is it complete, accurate, real, in the right period, and correctly classified?
4. Document any point where the trail breaks — these are your gaps
5. Fix the gaps and re-test before the external engagement

Common findings from mock walk-throughs include: emission factors that cannot be traced to a specific DEFRA table row, energy data for December that is estimated because invoices had not arrived at the time of calculation, fleet fuel data that excludes grey fleet, and qualitative claims about energy efficiency initiatives without documented evidence of implementation.

Step 5: Design for Reasonable Assurance Today

There are two levels of assurance in sustainability reporting:

Limited assurance (the current standard for most CSRD first-reporters) requires the practitioner to conclude that “nothing has come to our attention” suggesting the disclosures are materially misstated. The procedures are primarily enquiry and analytical review — less extensive than a full audit.

Reasonable assurance (the trajectory for both EU and UK frameworks) requires the practitioner to provide positive confirmation that the disclosures are “fairly stated in all material respects.” This requires substantive testing, detailed walk-throughs, and evidence inspection comparable to a financial audit.

The cost difference between building controls for limited assurance and upgrading to reasonable assurance later is significant. Companies that design their systems for the higher bar from the outset avoid the expensive retrofit. In practice, this means:

• Treating every data point as if it will be tested, not just a sample
• Maintaining source evidence for every figure, not just the material ones
• Building reconciliation processes between sustainability data and financial data (e.g., energy costs in the P&L should reconcile to energy consumption in the SECR/UK SRS disclosure)
• Establishing a sustainability data governance committee with terms of reference, meeting cadence, and documented minutes

Governance Structures for Assurance Readiness

Assurance-ready reporting requires governance structures beyond the operational data processes. Key elements include:

• Board or Audit Committee oversight — explicit responsibility for reviewing and approving sustainability disclosures, ideally through the existing Audit Committee with expanded terms of reference
• Sustainability Committee — a management-level committee responsible for data quality, methodology decisions, and disclosure review. This committee should meet quarterly at minimum and maintain documented minutes.
• Clear escalation procedures — defined processes for flagging data quality issues, methodology questions, or material uncertainties to the appropriate governance level
• Disclosure sign-off protocol — a formal process whereby the sustainability disclosure is reviewed and approved by a named individual with appropriate authority before publication

These structures should be documented in a sustainability reporting policy that is approved by the board and reviewed annually.

RSustain advisory: Run an ESG readiness diagnostic to benchmark your current state, or schedule a discussion to design your evidence architecture and governance structures.