For a decade, sustainability reporting was largely an exercise in narrative. Teams assembled a story, supported by selected metrics, and published it in a glossy standalone report that few people scrutinised with the discipline applied to financial statements. That era is ending. The IFRS Sustainability Disclosure Standards issued by the ISSB (IFRS S1 and IFRS S2), together with the European Union's Corporate Sustainability Reporting Directive (CSRD) and its European Sustainability Reporting Standards, are moving sustainability information into the same domain as financial data: prepared to a defined standard, subject to controls, and independently assured.
The immediate consequence is assurance. Under CSRD, sustainability information is subject to limited assurance from the outset, with the European Commission empowered to move the regime to reasonable assurance once a suitable standard is adopted. IFRS S1 and S2 do not themselves mandate assurance, but jurisdictions adopting them are pairing them with assurance requirements, and the direction of travel is unambiguous. The practical question for preparers is no longer whether their ESG data will be audited, but whether it is built to withstand an audit.
Limited then reasonable: why the distinction matters
Limited and reasonable assurance are not points on a single dial; they demand different things of the underlying data. Limited assurance yields a conclusion expressed in the negative, that nothing has come to the practitioner's attention suggesting the information is materially misstated. It is built largely on enquiry and analytical procedures. Reasonable assurance, the level applied to financial statements, requires a positive opinion supported by tests of controls and substantive evidence. Moving from one to the other is not a matter of the assurer working harder; it requires the preparer to have controls that operate reliably over the period and evidence that those controls worked.
Organisations that treat the current limited-assurance phase as the destination will find the subsequent transition painful. The controls, documentation and system architecture that satisfy reasonable assurance take one to two reporting cycles to embed. The sensible course is to build for the higher bar now and let the limited-assurance conclusion fall out of it, rather than retrofitting under time pressure when the threshold rises.
Building auditable controls over ESG data
Auditable ESG data rests on the same control disciplines that underpin financial reporting, applied to information that has historically sat outside the finance function. Three elements are foundational. First, defined ownership: every disclosed metric needs a named owner accountable for its accuracy, not a diffuse sustainability team. Second, a documented methodology: the definition of each metric, its boundary, the calculation approach, emission factors and estimation techniques, all recorded and version-controlled so that a number can be reproduced from source. Third, controls over the data flow itself, covering completeness of source data, accuracy of transformation, and review before publication.
Estimation deserves particular attention. A large proportion of ESG data, and almost all of Scope 3, is estimated rather than measured. Assurers do not object to estimates; they object to estimates that cannot be explained. Where a figure rests on a proxy, an emission factor or an extrapolation, the judgement must be documented: what was assumed, why it is reasonable, and how sensitive the result is to that assumption. An estimate with a clear, evidenced rationale is auditable. An estimate that emerged from an undocumented spreadsheet is not.
Assurers do not object to estimates. They object to estimates that cannot be explained.
The greenhouse-gas inventory: Scope 1, 2 and 3
The greenhouse-gas inventory is the most scrutinised part of any ESG dataset, and the GHG Protocol remains the reference framework that IFRS S2 and the ESRS build upon. Scope 1, direct emissions from owned or controlled sources, and Scope 2, indirect emissions from purchased energy, are comparatively tractable: the challenge is completeness of the source data, the correct organisational boundary, and consistent treatment of the location-based and market-based methods for Scope 2. IFRS S2 requires the location-based figure to be disclosed, together with information about the contractual instruments relevant to any market-based measure, dual location- and market-based reporting itself follows the GHG Protocol Scope 2 Guidance, and under CSRD the ESRS.
Scope 3, value-chain emissions across the fifteen defined categories, is where most assurance difficulty concentrates. It typically dominates the total footprint, depends heavily on third-party and estimated data, and is the hardest to control. A defensible Scope 3 inventory begins with a documented screening of which categories are material, a clear rationale for those excluded, and a consistent data hierarchy that prefers supplier-specific data over spend-based or average-data proxies. The point is not to eliminate estimation, which is impossible, but to make the basis of every category transparent and repeatable.
Documentation, traceability and connectivity
An assurer works from evidence, and evidence means traceability from a published figure back to its source. In practice this requires an audit trail: the disclosed number, the calculation that produced it, the source records that fed the calculation, and a record of the review it passed through. Spreadsheets that are emailed between people, overwritten and undated are the single most common obstacle to assurance. Migrating the ESG close onto a controlled platform, with locked periods and retained versions, is usually the highest-return investment a preparer can make.
Finally, connectivity with the financial statements is becoming a first-order requirement rather than a refinement. IFRS S1 requires sustainability disclosures to be consistent with the accompanying financial statements and reported for the same entity over the same period. Where climate-related risks affect asset useful lives, provisions or impairment, the assumptions used in the sustainability report and those in the financial statements must reconcile. Assurers, and increasingly investors, will test that boundary. The organisations that fare best are those that run the sustainability close on the same calendar, the same reporting boundary and, ideally, the same controls framework as the financial close, so that the two sets of numbers tell one coherent story that both can withstand examination.
Key takeaways
- Assurance is now a given, not a possibility: CSRD mandates limited assurance moving towards reasonable assurance, and IFRS S1/S2 adoption is being paired with assurance requirements in adopting jurisdictions.
- Build for reasonable assurance from the start. The controls, documentation and systems it requires take one to two reporting cycles to embed, and retrofitting under time pressure is costly.
- Auditable ESG data needs the disciplines of financial reporting: named metric ownership, documented and version-controlled methodology, and controls over completeness, accuracy and review of the data flow.
- Estimates are acceptable where the judgement is documented and its sensitivity understood; Scope 3 in particular requires a materiality screening, a clear data hierarchy and a repeatable basis for each category.
- Traceability from published figure to source, on a controlled platform rather than emailed spreadsheets, and consistency with the financial statements over the same boundary and period, are what ultimately withstand assurance.