Limited assurance of the sustainability report: what the verifier reviews and how to prepare

Assurance over the CSRD sustainability report is, and will remain, limited assurance. Directive (EU) 2026/470 removed the planned move to reasonable assurance, and the European limited assurance standard must be adopted before 1 July 2027. In practice that means one specific thing: the assurance provider will not give a positive opinion on your figures, it will conclude that nothing has come to its attention suggesting the information is materially misstated. But it still needs evidence to reach that conclusion, and that is where projects get stuck.

This article walks through what an assurance provider actually reviews, what documents it asks for, in what order to have them ready, and the findings that come back most often.

Limited versus reasonable: the difference that changes the work

The two levels differ in the form of the conclusion and in how much evidence is needed to support it.

The most useful practical consequence: under limited assurance the provider is not required to test your internal controls one by one, but it does have to understand the process and check a sample. If your process cannot be explained in a one-hour meeting, the sample grows and the engagement gets more expensive.

Which standard your assurance provider will use

Until the Commission adopts the European standard, member states may apply national standards. Three references coexist in Spain:

• The technical standard on sustainability assurance published by the ICAC in December 2024, together with its glossary and its standard on the relationship between assurance providers.
• ISSA 5000, the IAASB international standard titled General Requirements for Sustainability Assurance Engagements, published in November 2024. It covers both limited and reasonable assurance engagements, is independent of the reporting framework, and can be applied by accountants and non-accountant practitioners alike. It is effective for periods beginning on or after 15 December 2026.
• The European limited assurance standard, still to be adopted before 1 July 2027.

Spain's securities regulator, the CNMV, and the ICAC expressly recommend taking the ICAC technical standard and ISSA 5000 into account while the framework is completed. If your provider proposes a different standard, ask it to justify the equivalence in writing.

Who can provide assurance in Spain

The definitive regime depends on the transposition law, which is still awaiting approval, and the ICAC itself warns that the information it publishes on verifiers is conditional on that approval. With that caveat, the intended design is:

• Firms: audit firms, or firms accredited by ENAC, the Spanish national accreditation body.
• Individuals: auditors registered in the official auditors' register (ROAC) before 1 January 2024, or individuals accredited by ENAC as independent verification services providers.

In the meantime, assurance over the non-financial statement is still governed by article 49.6 of the Spanish Commercial Code, which requires the information to be verified by an independent verification services provider. Same role, with a supervisory regime that the new law will strengthen.

What evidence gets requested, block by block

The order of requests is almost always the same. Preparing in that order saves weeks.

1. Reporting boundary and consolidation

Before looking at a single figure, the provider wants to know what is in. Have ready: the list of entities and sites included, the consolidation approach chosen for emissions (operational control, financial control or equity share), the reconciliation with the financial reporting boundary, and a documented explanation of any difference. Additions and disposals during the year, with dates.

2. Traceability to the source document

This is the core test. For a sample of consumption figures, the provider will ask for the full chain: the number in the report, the line in the spreadsheet or tool, the invoice or meter reading behind it, and the basis on which it was allocated to the period. The most frequent break points:

• Estimated invoices that were never trued up.
• Billing periods that straddle the year end and get booked entirely to one year.
• Consumption in leased offices passed through in a service charge with no breakdown.
• Fleet refuelling recorded by amount and converted to litres using an undocumented average price.

3. Emission factors

The provider checks three things: that the factor comes from an identifiable source, that it matches the year being calculated, and that the approach has been applied consistently. Document the source, version, year and unit for each category. Mixing years or combining different sources without justification is one of the most common findings, and it is covered in our guide on how to prepare for and pass a carbon footprint audit.

4. Methodology and estimates

Wherever there is an estimate, there has to be a written method: what was estimated, on what assumption, why that assumption is reasonable, and what share of the total it represents. A documented estimate is acceptable. An estimate with no trail is not.

5. Controls and owners

Even though limited assurance does not test controls in depth, the provider will ask about them: who reviews the data before consolidation, what automated validations exist, how an outlier is detected, and who authorises a retrospective change. A change log with user and timestamp is worth more than any verbal explanation.

6. Materiality and content

The provider checks that the process for determining material topics is documented and consistent with what is finally reported. Your double materiality assessment has to explain why what is there is there, and why what is missing is missing, with references to the relevant ESRS.

The most common findings

1. A boundary that does not reconcile. The report includes a subsidiary that is not in the financial consolidation, with no note explaining it.
2. A gap with no bridge. The number in the report differs from the tool because someone applied a manual adjustment that left no record.
3. An orphan factor. An emission factor with no source, no year, or copied from last year's report.
4. Scope 2 without dual reporting. A single figure is reported without distinguishing the location-based from the market-based method.
5. A silent change of approach. The method changes between years without restating the base year or explaining it.
6. Workforce data that does not match payroll. The social indicator comes from a different sheet than the one HR uses.
7. Evidence that exists only in someone's head. The figure is right, but the only support is the recollection of the person who calculated it, who has since left.

How it differs from today's EINF assurance

If you already assure your non-financial statement, much of the work carries over, but three differences are worth anticipating:

• Content framework. The EINF is built on Ley 11/2018 and reference frameworks such as GRI. The sustainability report is built on the revised ESRS, adopted on 3 July 2026, with fewer mandatory datapoints but better defined ones.
• Engagement standard. EINF assurance has been performed under assurance engagement standards other than audit. The future engagement will follow the European standard, with ISSA 5000 as the international reference.
• Supervision of the provider. The Spanish bill places sustainability verifiers under ICAC supervision and in a specific register, which does not apply today to every provider.

The materiality and assurance criteria that apply to the EINF today are covered in the article on EINF verification and materiality analysis, and the full preparation sequence is in the CSRD compliance guide for 2026.

Frequently asked questions

Will assurance ever move to reasonable?

It is not planned. Directive (EU) 2026/470 removed that possibility. The level is and will remain limited assurance.

When will there be a European assurance standard?

It must be adopted before 1 July 2027. Until then national standards apply, with ISSA 5000 as the recommended international reference.

Does ISSA 5000 apply if my provider is not a statutory auditor?

Yes. ISSA 5000 is designed to be applied by both audit professionals and non-accountant practitioners, and it is independent of the reporting framework used.

How long does a limited assurance engagement take?

It depends on the state of your documentation, not the size of your company. If traceability is in place, fieldwork takes weeks. If the support for every figure has to be rebuilt, it multiplies.

What do I do if the provider asks for evidence I do not have?

Document why it does not exist and what alternative method was used, rather than improvising a document. An explained limitation can be managed; fabricated evidence cannot.

Can I start by assuring only scopes 1 and 2?

That is a reasonable way to start and to learn the process, although the full sustainability report demands far more than the emissions inventory.

Most of the cost of an assurance engagement is not in the analysis, it is in reconstructing where each number came from. Our carbon footprint solution keeps the source document next to the figure, which is exactly what the provider asks for first.