Disclosure focus
GRI 2-5 always requires an organisation to describe its policy and practice for seeking external assurance, including whether and how the highest governance body and senior executives are involved. This applies even when the organisation did not obtain external assurance for the reporting period; a separate written ‘External Assurance Policy’ is not required if the actual policy and practice are explained clearly.
If the sustainability reporting has been externally assured, the organisation must also link or refer to the assurance report, describe what was assured and on what basis, and explain its relationship with the assurance provider. The basis includes the exact assurance standards used, the level of assurance obtained, and any limitations of the assurance process.
External assurance is encouraged by GRI but is not mandatory for reporting in accordance with the GRI Standards. Disclosure 2-5 itself is mandatory for an in-accordance claim. Reasons for omission are not permitted for this disclosure.
Do not describe every external check as assurance. A certification, consultancy review, independent data check, audit-support exercise, or agreed-upon procedures engagement is assurance only when an independent, competent provider issues a formal assurance conclusion or opinion; agreed-upon procedures report findings rather than an assurance conclusion.
The seven datapoints below are LRA’s operational decomposition of one unconditional requirement and three conditional elements. They are not seven separate GRI requirements, and ‘Assurance limits’ sits within the description of assured content and basis under 2-5-b-ii.
This LRA educational guidance supports disclosure preparation. For the exact requirements, always refer to the official GRI source.
Before you start
A quick mental checklist before you prepare this disclosure — tick each as you settle it.
Preparation
Key information to prepare
＋ Show GRI 2-5 sub-elements (LRA working checklist)
GRI 2-5-a — Describe the policy and practice for seeking external assurance, including whether and how the highest governance body and senior executives are involved. This always applies.
GRI 2-5-b-i — If the sustainability reporting has been externally assured, provide a link or reference to the external assurance report or assurance statement.
GRI 2-5-b-ii — If externally assured, describe what was assured and on what basis, including the assurance standards used, the level of assurance obtained, and any limitations of the assurance process.
GRI 2-5-b-iii — If externally assured, describe the relationship between the organisation and the assurance provider.
How to prepare it
1Document the organisation’s actual policy and practice for seeking external assurance. Record whether and how the highest governance body and senior executives are involved, even if no assurance was obtained this period.
2Confirm whether the engagement is genuinely external assurance: look for a formal signed conclusion or opinion from an independent, competent provider. Do not relabel certification, consultancy, independent checks, or agreed-upon procedures as assurance.
3For every assurance engagement, map the exact report version and assured content to the signed statement. Keep separate engagements separate where scopes, standards, levels, or providers differ.
4Capture the exact assurance standards used, the level of assurance obtained, and all stated limitations, exclusions, sampling boundaries, sites, or topic-specific differences. If the linked assurance report contains this fully, a brief referral can be sufficient.
5Describe the relationship with the assurance provider, including appointment, independence, conflicts, and any other services. GRI guidance also encourages accessible information on responsibilities, the work performed, the signed conclusion, and provider competence.
6Before publishing, reconcile the disclosure, content index, public link, and final signed statement. Confirm that the provider was independent and competent, applied quality controls, and issued a public conclusion, then check the official GRI source.
Request the data
Request the assurance pack and sign-off details
Translate the disclosure into an internal business question — then adapt it to your organisation's own language.
What is our policy and practice for seeking external assurance, how are the highest governance body and senior executives involved, and did any provider issue a formal assurance conclusion for this reporting period?
Use the organisation’s operational language when collecting evidence, but do not map a review, certification, consultancy assignment, independent check, audit support, or agreed-upon procedures engagement to ‘external assurance’ unless an independent, competent provider issued a formal assurance conclusion or opinion.
Weak request
Can you send the external assurance info for the sustainability report?
Why it fails: It is too vague to tell the owner which documents, dates, scope, review basis, governance involvement, or relationship details are needed. It also uses framework language without telling the team how to answer in their own operational terms.
Better request
Please confirm our policy and practice for seeking external assurance and how the highest governance body and senior executives are involved. For each current-period assurance engagement, send the final signed statement, exact assured content, standards and criteria, level of assurance obtained, limitations, final report version, and provider independence and other-services records. If no assurance was obtained, describe the review frequency, decision criteria, plans, and governance involvement.
Industry examples
Draft your disclosure
Notes that turn data into a disclosure
LRA training templates — adapt them to your organisation, and check the official source before sign-off.
Method note
Describe the organisation’s policy and practice for seeking external assurance and whether and how the highest governance body and senior executives are involved. If assurance was obtained, refer to each signed assurance report and state the exact assured content, standards used, level of assurance obtained, limitations, and provider relationship.
Context note
Make the boundary of each assurance claim unmistakable. Explain whether the statement covers the full report or selected information, keep separate engagements distinct, and state provider independence and relevant other services consistently with the signed report and engagement records.
Fluctuation statement
Where the assurance approach changed, explain any change in governance involvement, assured content, standards, level, limitations, provider, or report version. Do not imply that assurance is mandatory under the GRI Standards.
Content index entry
GRI 2-5 External assurance — [location / page] / [notes]
Download Centre
Preparation tools & forms
Professional preparation tools for GRI 2-5 — free with an LRA Community membership. Register once (it's free) and every download unlocks, together with the Disclosure Library, templates and the LRA AI Assistant.
Free · Community members
Assurance readiness
For each claim, check the evidence
Evidence pack to prepare
Common reporting gaps
Treating 2-5 as not applicable because no external assurance was obtained, instead of describing the policy, practice, and governance involvement.Calling an independent check, certification, consultancy review, or agreed-upon procedures engagement ‘assurance’ without a formal assurance conclusion or opinion.Saying the whole sustainability report was assured when the statement covers only selected disclosures, indicators, sites, or entities.Using vague terms such as ‘verified’, ‘checked’, ‘reviewed’, ‘level of confidence’, or ‘level of review reached’ instead of the statement’s assurance terminology.Naming a framework generally but not the exact assurance standards used.Omitting the level of assurance obtained or merging limited and reasonable assurance into one description.Leaving out limitations, exclusions, sampling boundaries, or mixed assurance levels that appear in the signed statement.Linking to a draft, prior-period, or different report version from the one covered by the assurance statement.Failing to describe the relationship with the provider, including independence and relevant other services.Merging separate engagements with different providers, scopes, standards, or levels into one assurance claim.
Common gaps
Mistakes to avoid when collecting the data
Starting only when assurance exists
The team treats 2-5-a as conditional and prepares nothing when no external assurance was obtained, even though policy, practice, and governance involvement must still be described.
Misclassifying the engagement
A certification, consultancy review, independent check, internal audit, or agreed-upon procedures report is labelled assurance without a formal independent assurance conclusion.
Using a generic governance label
The draft refers to ‘directors’ or ‘management’ but does not say whether and how the highest governance body and senior executives are involved.
Overstating the scope
The public page says the report was externally assured when the signed statement covers selected indicators, entities, sites, or topics only.
Merging engagements
Different providers, standards, scopes, or assurance levels are collapsed into one description, making it impossible to trace each claim to its signed conclusion.
Paraphrasing technical terms
The team substitutes ‘confidence’, ‘verification’, or ‘review level’ for the exact assurance standard and level stated by the provider.
Dropping limitations
Sampling, exclusions, unavailable sites, mixed levels, or other limits in the signed report are omitted from the public description.
Missing provider relationship
Appointment, independence, conflicts, or relevant non-assurance services are not checked against procurement and independence records.
Where judgement is often needed
Exact scope differs from the report headline
State precisely which disclosures, metrics, entities, sites, or report sections were assured; do not let ‘externally assured report’ imply broader coverage than the statement.
Statement covers a different period or version
Confirm that the signed conclusion covers the final published report and reporting period. Explain any genuine version link rather than silently reusing an earlier statement.
Limited and reasonable assurance both apply
Identify which information received limited assurance and which received reasonable assurance. Never combine them into one overall level.
Different standards apply to different information
Map each exact assurance standard and criterion to the relevant engagement and assured information, including topic-specific standards such as ISAE 3410.
Limitations include sampling or selected sites
Describe the limitations stated by the provider, including sampling, site selection, exclusions, and work not performed, without suggesting assurance requires testing every record.
Provider also supplies non-assurance services
Describe services relevant to understanding the relationship and confirm how independence was assessed. Do not use an invented ‘material connection’ threshold.
Examples
Illustrative examples
Synthetic, written by LRA — not from a company report, not text from any standard.
Illustrative (synthetic) example — assurance obtained
Our policy is to assess annually whether external assurance would strengthen the credibility of our sustainability reporting. The Audit Committee approves the assurance plan, and senior executives confirm readiness, scope, and responses to findings. For 2025, selected greenhouse gas, water, and workforce disclosures were externally assured; the signed statement is linked in the report annex. The provider performed the engagement under ISAE 3000 (Revised), and ISAE 3410 for greenhouse gas information, and issued a limited assurance conclusion. The statement identifies the selected disclosures, sampling approach, sites not visited, and exclusion of forward-looking information. The provider was appointed through procurement, did not prepare the assured information, confirmed its independence from the organisation, and its other services are described in the assurance statement.
Synthetic example for practitioner learning only. It uses the exact standards and ‘limited assurance conclusion’, keeps scope and limitations visible, and describes the provider relationship and independence.
Illustrative (synthetic) example — no assurance obtained
Our policy is to review annually whether to seek external assurance. The Audit Committee considers the recommendation, and senior executives assess reporting readiness, regulatory requirements, and stakeholder expectations. We did not obtain external assurance for the 2025 sustainability reporting. We will reassess the decision for the next reporting cycle using the same criteria and our planned improvements to reporting controls.
Synthetic example for practitioner learning only. GRI 2-5-a still applies when no external assurance was obtained; the disclosure describes the decision approach, review frequency, criteria, plans, and governance involvement without presenting an internal decision record as a GRI requirement.
How companies report GRI 2-5 in practice
Examples of full and partial reporting practice. These are evidence-led reviews, not exact disclosure templates to copy.
Zydus Lifesciences Limited
Pharmaceuticals / Biotech / Life Sciences · India · 2025
Zydus publishes two separate Intertek limited assurance statements: selected ESG disclosures on pages 142–143 under ISAE 3000 (Revised), and selected Scope 3 categories on pages 144–146 under ISAE 3000 (Revised) and ISAE 3410. They state scope, criteria, methodology, limitations, conclusions, competence, and independence. The remaining GRI 2-5 gap is a clear description of the organisation’s policy and practice for seeking assurance and whether and how the highest governance body and senior executives are involved.
Interconexión Eléctrica S.A. E.S.P.
Electric Utilities / IPP / Energy Traders · Colombia · 2024
ISA’s report profile on page 9 identifies KPMG, the assurance basis, and the annexed independent report; the GRI index on page 131 supports navigation. The signed memo on pages 150–153 provides limited assurance, covered disclosures, ISAE 3000 and ISAE 3410 basis, limitations, independence, and responsibilities. Board certification of material topics is governance context, not a complete description of the policy and practice for seeking assurance or of highest-governance-body and senior-executive involvement under GRI 2-5-a.
Chang Hwa Commercial Bank, Ltd.
Banks / Diverse Financials / Insurance · Taiwan · 2024
CHB’s external assurance overview on page 189 separates BSI’s AA1000AS v3 work from EY’s ISAE 3000 engagement and states the respective scopes and assurance levels. The signed BSI statement on page 190 provides scope, methodology, sampling, moderate assurance opinion, responsibilities, competence, and independence; the EY statement follows on page 191. The policy and practice for seeking assurance and whether and how the highest governance body and senior executives are involved still require separate confirmation.
✓ LRA AI Assistant · Human-in-the-loop
Ask the Study Studio AI Assistant about this disclosure
Get practical answers for your reporting context. Your first two answers are free — join LRA Community for free to continue without a limit.
TryHow do I prepare GRI 2-5?What data do I need to collect?Where can I see a real-report example?What mistakes should I avoid?
2 free answers
Check your understanding
Scenarios to work through
An organisation did not obtain external assurance this year. Its policy is reviewed annually; the Audit Committee considers the recommendation, and senior executives assess readiness, regulatory requirements, and stakeholder expectations.
QCan the organisation omit GRI 2-5 or use a reason for omission?
Reveal model answer →Hide answer ↑No. External assurance is encouraged but not mandatory, while Disclosure 2-5 is mandatory for an in-accordance claim and reasons for omission are not permitted. Describe the policy and practice, annual review, criteria, plans, and whether and how the highest governance body and senior executives are involved.
Why this matters · GRI 2-5-a always applies, even when no external assurance was obtained.
A provider performed agreed-upon procedures under ISRS 4400 and reported factual findings, but issued no assurance conclusion or opinion.
QMay the organisation call the sustainability information externally assured?
Reveal model answer →Hide answer ↑No. Agreed-upon procedures provide findings rather than assurance. Describe the engagement accurately elsewhere if useful, but do not present it as external assurance under GRI 2-5-b.
Why this matters · The engagement label and an exact standard name do not replace the need for a formal assurance conclusion or opinion.
One signed statement provides limited assurance under ISAE 3000 (Revised) for selected ESG disclosures, while a second provides reasonable assurance under a different standard for a narrower regulatory dataset.
QHow should the organisation describe the assurance basis and level?
Reveal model answer →Hide answer ↑Keep the engagements separate. For each one, link the signed statement and identify the exact assured content, standard, level of assurance obtained, and limitations. Do not describe the report as having one blended assurance level.
Why this matters · Mixed scopes, standards, and levels must remain traceable to their own conclusions.
The assurance provider was appointed through procurement, did not prepare the assured information, confirmed independence from the organisation, and also supplied a separate controls advisory service.
QWhat relationship information belongs in the disclosure?
Reveal model answer →Hide answer ↑Describe the appointment, the provider’s lack of involvement in preparing the assured information, its independence confirmation, and the other service relevant to assessing that independence. Do not apply an invented ‘material connection’ threshold.
Why this matters · Relationship and service information should allow readers to understand provider independence.
Framework references
Relevant GRI requirements and related disclosures
Available framework references and nearby disclosures relevant to preparing this requirement.
Primary
Related & explore
FAQ
Questions this page answers
For GRI 2-5 General Disclosures, what data do I need to gather before I start drafting the assurance disclosure?+−
Use the page’s datapoint list as your starting checklist: assurance policy and practice, governance involvement, assurance report link, assured content and basis, assurance level obtained, assurance limits, and assurer relationship. The page also gives a step-by-step preparation flow, so you can turn that list into a practical data request and draft plan.
How do I use the step-by-step ‘how to prepare’ section for GRI 2-5 in practice?+−
Treat it as a working sequence for collecting the right inputs, checking what needs to be evidenced, and then shaping the disclosure draft. It is designed to help you move from raw information to a report-ready narrative rather than leaving you with a theory-only summary.
What should I ask the assurance owner or audit contact for when preparing GRI 2-5?+−
Ask Sustainability Reporting and the external assurance contact for the current policy and practice, signed statement, exact scope, standards, level, limitations, and final report version. Finance, Internal Audit, Company Secretariat or Governance, Legal, Procurement, and the Audit Committee may need to confirm controls, governance involvement, appointment, independence, and other services.
How do I decide who owns the GRI 2-5 assurance disclosure data in my organisation?+−
Sustainability Reporting normally coordinates the disclosure with the external assurance contact. Finance and Internal Audit can support reporting controls; Company Secretariat or Governance and the Audit Committee can confirm governance involvement; Legal and Procurement can evidence appointment, conflicts, independence, and other services.
What evidence pack do I need to make a GRI 2-5 assurance disclosure assurance-ready?+−
Use the page’s evidence pack: documented practice, governance papers, engagement letter, signed report, scope schedule, standards and criteria, management representations where used, independence and conflict declarations, other-services record, final publication version, and approvals.
How do the assurance claims to verify help me check my GRI 2-5 draft?+−
They test the policy and practice, governance involvement, whether the engagement is genuine assurance, whether scope and terminology match the signed statement, and whether the provider relationship is transparent. Use them before sign-off to prevent overstatement.
What are the common reporting gaps or mistakes to avoid in a GRI 2-5 assurance disclosure?+−
The page lists common gaps and mistakes so you can check for missing evidence, unclear scope, or weak links between the narrative and the assurance information. It is useful as a final quality-control pass before the disclosure goes into the report.
How can I turn the GRI 2-5 page into a first draft for the annual report?+−
Start with the policy and practice and explain governance involvement. If assurance was obtained, add a clear referral to each signed statement and a concise description of scope, standards, level, limitations, and provider relationship, then complete the GRI content-index line.
What should I include in the GRI 2-5 narrative if I want it to be assurance-ready?+−
Focus on the page’s assurance datapoints and make sure the narrative clearly states what was assured, the basis, the level obtained, any limits, and the assurer relationship. The evidence pack and claim checks are there to help you keep the wording aligned with the underlying support.
How do I use the Prep & Assurance workbook for GRI 2-5?+−
The Download Centre includes a Prep & Assurance workbook in .xlsx format, which is intended to support preparation and assurance readiness. Use it alongside the page’s step-by-step guidance, evidence pack, and common mistakes list to organise inputs and track what still needs to be confirmed.
What is the printable Library Card for GRI 2-5 and when should I use it?+−
The Download Centre also provides a printable Library Card in .pdf format. It is a practical companion for keeping the disclosure’s key datapoints, evidence needs, and draft prompts in one place while you work through preparation.
More questions this page can help with
GRI 2-5 General Disclosures: what are the key datapoints to collect for an assurance disclosure draft?GRI 2-5: how do I build an evidence pack for assurance readiness?GRI 2-5 assurance disclosure: what should I ask Governance, Finance, Internal Audit, or the assurance provider for?GRI 2-5: how do I use the claim/risk/evidence checks before sign-off?GRI 2-5 General Disclosures: what are the common mistakes in the assurance section?GRI 2-5: how do I turn the page’s narrative starters into a report draft?GRI 2-5: what should go into the assurance report link and basis of assurance field?GRI 2-5: how do I use the downloadable workbook to track missing evidence?GRI 2-5 General Disclosures: what does the synthetic example show me about drafting the disclosure?GRI 2-5: how do I check whether my disclosure covers assurance limits clearly?GRI 2-5: how do I use the content-index line in the draft-output section?GRI 2-5 General Disclosures: where can I find real published report examples on the page?
How this library is built
312 published reports indexed
63171 pages with page-level citations
272 practitioner guides
Free · LRA Community
Get your GRI 2-5 tools — free
Your preparation tools are free for LRA Community members and students. Register once (it's free) and your download starts right away — plus the Disclosure Library, templates and the LRA AI Assistant.
✓
You're in — your download is starting
Your file is downloading now. Your Community Cabinet — with the Disclosure Library, templates and the LRA AI Assistant — is ready too.
Open your Cabinet →