GRI 2: General Disclosures·Disclosure GRI 2-5
External assurance
Practical guidance for preparing this disclosure. Use this card to identify the information to prepare, verify claims and organise supporting evidence. For exact requirements, always refer to the official GRI source.
Published passport
Last reviewed 2026-07-18
Reviewed by
Dr Ross KurinkoLinkedIn
Strategic ESG Advisor · IFRS S1 & S2 / GRI / ESRS expert
GRI Certified Global Trainer · PhD, University of Cambridge · ESG-AI expert
15+ years on FTSE 100 & Fortune Global 500 disclosures
Canary Wharf, London
LRA educational guidance · Not issued or endorsed by GRI
Standard
GRI 2: General Disclosures
Disclosure GRI 2-5
Last reviewed
2026-07-18
LRA educational guidance · Not issued or endorsed by GRI
Disclosure focus
GRI 2-5 always requires an organisation to describe its policy and practice for seeking external assurance, including whether and how the highest governance body and senior executives are involved. This applies even when the organisation did not obtain external assurance for the reporting period; a separate written ‘External Assurance Policy’ is not required if the actual policy and practice are explained clearly.
If the sustainability reporting has been externally assured, the organisation must also link or refer to the assurance report, describe what was assured and on what basis, and explain its relationship with the assurance provider. The basis includes the exact assurance standards used, the level of assurance obtained, and any limitations of the assurance process.
External assurance is encouraged by GRI but is not mandatory for reporting in accordance with the GRI Standards. Disclosure 2-5 itself is mandatory for an in-accordance claim. Reasons for omission are not permitted for this disclosure.
Do not describe every external check as assurance. A certification, consultancy review, independent data check, audit-support exercise, or agreed-upon procedures engagement is assurance only when an independent, competent provider issues a formal assurance conclusion or opinion; agreed-upon procedures report findings rather than an assurance conclusion.
The seven datapoints below are LRA’s operational decomposition of one unconditional requirement and three conditional elements. They are not seven separate GRI requirements, and ‘Assurance limits’ sits within the description of assured content and basis under 2-5-b-ii.
This LRA educational guidance supports disclosure preparation. For the exact requirements, always refer to the official GRI source.
Before you start
Before you start
A quick mental checklist before you prepare this disclosure — tick each as you settle it.
Preparation
Key information to prepare
| Preparation field | What to capture | Evidence hint | Owner |
|---|---|---|---|
| Assurance policy and practice | The organisation’s actual policy and practice for seeking external assurance, whether or not assurance was obtained. A separate written policy is not required. | Assurance policy, reporting governance papers, board or executive committee minutes, internal approval notes. | Sustainability reporting / Governance |
| Governance involvement in assurance | Whether and how the highest governance body and senior executives are involved in the policy and practice for seeking external assurance. | Board and executive committee packs, assurance planning papers, sign-off records, governance calendar. | Sustainability reporting / Governance |
| Assurance report link | The web link or document reference for each external assurance report or assurance statement covering the sustainability report, where assurance has been obtained. | Published report archive, investor relations site, assurance provider deliverables, document register. | Sustainability reporting / Investor relations |
| Assured content and basis | Exactly what sustainability information was assured and the basis of assurance, including the exact assurance standards used. A brief referral is sufficient where the linked assurance report contains the detail. | Assurance statement, scope letter, engagement terms, provider report, reporting controls file. | Sustainability reporting / External assurance |
| Assurance level obtained | The level of assurance the external reviewer gave for the sustainability reporting, stated clearly and consistently with the assurance statement. | Assurance statement, provider opinion letter, final report issued by the assurance firm. | Sustainability reporting / External assurance |
| Assurance limits | Any stated constraints, exclusions, or caveats in the external assurance process that affect what was checked or how far the work went. | Assurance statement, management representation letter, engagement scope, issue log from the assurance process. | Sustainability reporting / External assurance |
| Assurer relationship | A short description of the organisation’s relationship with the assurance provider, including anything relevant to independence, prior work, or other ties. | Assurance engagement letter, procurement records, independence declarations, conflict checks, provider profile. | Procurement / Legal / External assurance |
How to prepare it
Request the data
Request the assurance pack and sign-off details
Translate the disclosure into an internal business question — then adapt it to your organisation's own language.
What is our policy and practice for seeking external assurance, how are the highest governance body and senior executives involved, and did any provider issue a formal assurance conclusion for this reporting period?
Use the organisation’s operational language when collecting evidence, but do not map a review, certification, consultancy assignment, independent check, audit support, or agreed-upon procedures engagement to ‘external assurance’ unless an independent, competent provider issued a formal assurance conclusion or opinion.
Weak request
Can you send the external assurance info for the sustainability report?
Why it fails: It is too vague to tell the owner which documents, dates, scope, review basis, governance involvement, or relationship details are needed. It also uses framework language without telling the team how to answer in their own operational terms.
Better request
Please confirm our policy and practice for seeking external assurance and how the highest governance body and senior executives are involved. For each current-period assurance engagement, send the final signed statement, exact assured content, standards and criteria, level of assurance obtained, limitations, final report version, and provider independence and other-services records. If no assurance was obtained, describe the review frequency, decision criteria, plans, and governance involvement.
Formal email template
Subject: Request for sustainability reporting external assurance details for [reporting period] Hello [name/team], We are preparing GRI 2-5 for [reporting period]. Please confirm our current policy and practice for seeking external assurance, its review frequency and criteria, and whether and how the highest governance body and senior executives are involved. If external assurance was obtained, please send the final signed assurance report and confirm: - the exact publication version and information assured - the assurance standards and criteria used - the level of assurance obtained - all limitations, exclusions, sampling boundaries, and mixed levels - the provider’s appointment, independence, conflicts, and any other services If no external assurance was obtained, please confirm that and describe the decision approach, review frequency, criteria, future plans, and governance involvement. An internal decision record is useful evidence but is not itself a GRI requirement. Please distinguish assurance from certification, consultancy, independent checks, and agreed-upon procedures. A possible LRA training template is attached; adapt it to your organisation and check the official source before sign-off. Many thanks, [preparer name] [team] [contact details]
Short Teams / Slack version
Hi [name] — for [reporting period], please confirm our policy and practice for seeking external assurance and whether/how the highest governance body and senior executives are involved. If assurance was obtained, send each final signed statement with its exact scope, standards, level, limitations, report version, and provider independence/other-services record. If none was obtained, describe the annual decision approach, criteria, and plans. Thanks.
Industry examples
Manufacturing
Context. The sustainability report includes site-level environmental metrics and a small number of social indicators covered by an external assurance conclusion.
Adapted request. Please share the external assurance pack for [reporting period]: the final signed assurance statement, exact site metrics and sections assured, standards and criteria, level of assurance obtained, limitations by plant or data stream, governance involvement, and provider independence and other services. If no assurance was obtained, describe the annual decision approach, criteria, and plans.
Example response. Attached are the signed limited assurance statement, scope schedule for energy, water, waste, and workforce safety metrics, exact assurance standards and criteria, site-sampling limitations, the Audit Committee paper, independence declaration, and other-services record.
Financial services
Context. The organisation publishes an annual ESG section within the annual report and obtains external assurance on selected metrics and narrative claims.
Adapted request. Please send the assurance pack for [reporting period] covering the ESG section: the signed assurance statement, exact sections and metrics assured, standards and criteria, level of assurance obtained, limitations, governance involvement, and provider independence and other services. Keep any agreed-upon procedures engagement separate because it does not provide an assurance conclusion.
Example response. The pack includes the signed limited assurance statement, scope schedule for climate and conduct metrics, exact ISAE standards and criteria, exclusion of forward-looking statements, the Board Risk Committee paper, independence declaration, and a separate record of advisory services.
Draft your disclosure
Notes that turn data into a disclosure
LRA training templates — adapt them to your organisation, and check the official source before sign-off.
Method note
Describe the organisation’s policy and practice for seeking external assurance and whether and how the highest governance body and senior executives are involved. If assurance was obtained, refer to each signed assurance report and state the exact assured content, standards used, level of assurance obtained, limitations, and provider relationship.
Context note
Make the boundary of each assurance claim unmistakable. Explain whether the statement covers the full report or selected information, keep separate engagements distinct, and state provider independence and relevant other services consistently with the signed report and engagement records.
Fluctuation statement
Where the assurance approach changed, explain any change in governance involvement, assured content, standards, level, limitations, provider, or report version. Do not imply that assurance is mandatory under the GRI Standards.
Content index entry
GRI 2-5 External assurance — [location / page] / [notes]Download Centre
Preparation tools & forms
Professional preparation tools for GRI 2-5 — free with an LRA Community membership. Register once (it's free) and every download unlocks, together with the Disclosure Library, templates and the LRA AI Assistant.
Assurance readiness
For each claim, check the evidence
| Claim | Risk | Evidence to check |
|---|---|---|
| The policy and practice described are the organisation’s actual current approach, whether or not assurance was obtained. | Boilerplate implies a standing assurance programme that does not exist, or silence is treated as acceptable because no assurance was obtained. | Documented practice, reporting calendar, decision criteria, and current-period governance papers |
| The disclosure accurately says whether and how the highest governance body and senior executives are involved. | Generic references to directors or management hide the actual governance route or incorrectly imply involvement. | Board or committee papers, minutes, executive approvals, and reporting governance terms of reference |
| Every claimed assurance engagement is supported by a formal signed assurance conclusion or opinion. | A certification, consultancy review, independent check, or agreed-upon procedures report is incorrectly presented as assurance. | Final signed assurance report and engagement letter |
| The published description matches the statement’s exact scope, standards, assurance level, limitations, and report version. | The page overstates coverage, merges separate engagements, substitutes vague terminology, or links to a mismatched version. | Signed report, scope schedule, standards and criteria, final publication, and version approval |
| The relationship with the provider is transparent and consistent with independence records. | Relevant non-assurance services, conflicts, or provider involvement in preparing the assured information are omitted. | Independence declarations, conflict checks, procurement file, and non-assurance services record |
Evidence pack to prepare
Common reporting gaps
Common gaps
Mistakes to avoid when collecting the data
Where judgement is often needed
Examples
Illustrative examples
Synthetic, written by LRA — not from a company report, not text from any standard.
Our policy is to assess annually whether external assurance would strengthen the credibility of our sustainability reporting. The Audit Committee approves the assurance plan, and senior executives confirm readiness, scope, and responses to findings. For 2025, selected greenhouse gas, water, and workforce disclosures were externally assured; the signed statement is linked in the report annex. The provider performed the engagement under ISAE 3000 (Revised), and ISAE 3410 for greenhouse gas information, and issued a limited assurance conclusion. The statement identifies the selected disclosures, sampling approach, sites not visited, and exclusion of forward-looking information. The provider was appointed through procurement, did not prepare the assured information, confirmed its independence from the organisation, and its other services are described in the assurance statement.
Synthetic example for practitioner learning only. It uses the exact standards and ‘limited assurance conclusion’, keeps scope and limitations visible, and describes the provider relationship and independence.
Our policy is to review annually whether to seek external assurance. The Audit Committee considers the recommendation, and senior executives assess reporting readiness, regulatory requirements, and stakeholder expectations. We did not obtain external assurance for the 2025 sustainability reporting. We will reassess the decision for the next reporting cycle using the same criteria and our planned improvements to reporting controls.
Synthetic example for practitioner learning only. GRI 2-5-a still applies when no external assurance was obtained; the disclosure describes the decision approach, review frequency, criteria, plans, and governance involvement without presenting an internal decision record as a GRI requirement.
Company reports
How companies report GRI 2-5 in practice
Examples of full and partial reporting practice. These are evidence-led reviews, not exact disclosure templates to copy.
Ask the Study Studio AI Assistant about this disclosure
Get practical answers for your reporting context. Your first two answers are free — join LRA Community for free to continue without a limit.
Check your understanding
Scenarios to work through
An organisation did not obtain external assurance this year. Its policy is reviewed annually; the Audit Committee considers the recommendation, and senior executives assess readiness, regulatory requirements, and stakeholder expectations.
A provider performed agreed-upon procedures under ISRS 4400 and reported factual findings, but issued no assurance conclusion or opinion.
One signed statement provides limited assurance under ISAE 3000 (Revised) for selected ESG disclosures, while a second provides reasonable assurance under a different standard for a narrower regulatory dataset.
The assurance provider was appointed through procurement, did not prepare the assured information, confirmed independence from the organisation, and also supplied a separate controls advisory service.
Framework references
Relevant GRI requirements and related disclosures
Available framework references and nearby disclosures relevant to preparing this requirement.
GRI
GRI 2-5
within GRI 2: General Disclosures
Related & explore
More in GRI 2 → Browse full catalogue → Disclosure Library home → Search all disclosures →
FAQ
Questions this page answers
Use the page’s datapoint list as your starting checklist: assurance policy and practice, governance involvement, assurance report link, assured content and basis, assurance level obtained, assurance limits, and assurer relationship. The page also gives a step-by-step preparation flow, so you can turn that list into a practical data request and draft plan.
Treat it as a working sequence for collecting the right inputs, checking what needs to be evidenced, and then shaping the disclosure draft. It is designed to help you move from raw information to a report-ready narrative rather than leaving you with a theory-only summary.
Ask Sustainability Reporting and the external assurance contact for the current policy and practice, signed statement, exact scope, standards, level, limitations, and final report version. Finance, Internal Audit, Company Secretariat or Governance, Legal, Procurement, and the Audit Committee may need to confirm controls, governance involvement, appointment, independence, and other services.
Sustainability Reporting normally coordinates the disclosure with the external assurance contact. Finance and Internal Audit can support reporting controls; Company Secretariat or Governance and the Audit Committee can confirm governance involvement; Legal and Procurement can evidence appointment, conflicts, independence, and other services.
Use the page’s evidence pack: documented practice, governance papers, engagement letter, signed report, scope schedule, standards and criteria, management representations where used, independence and conflict declarations, other-services record, final publication version, and approvals.
They test the policy and practice, governance involvement, whether the engagement is genuine assurance, whether scope and terminology match the signed statement, and whether the provider relationship is transparent. Use them before sign-off to prevent overstatement.
The page lists common gaps and mistakes so you can check for missing evidence, unclear scope, or weak links between the narrative and the assurance information. It is useful as a final quality-control pass before the disclosure goes into the report.
Start with the policy and practice and explain governance involvement. If assurance was obtained, add a clear referral to each signed statement and a concise description of scope, standards, level, limitations, and provider relationship, then complete the GRI content-index line.
Focus on the page’s assurance datapoints and make sure the narrative clearly states what was assured, the basis, the level obtained, any limits, and the assurer relationship. The evidence pack and claim checks are there to help you keep the wording aligned with the underlying support.
The Download Centre includes a Prep & Assurance workbook in .xlsx format, which is intended to support preparation and assurance readiness. Use it alongside the page’s step-by-step guidance, evidence pack, and common mistakes list to organise inputs and track what still needs to be confirmed.
The Download Centre also provides a printable Library Card in .pdf format. It is a practical companion for keeping the disclosure’s key datapoints, evidence needs, and draft prompts in one place while you work through preparation.
More questions this page can help with
Go deeper · GRI 2-5
Learn to prepare this disclosure end-to-end
This guide covers one disclosure. The GRI Standards Certified Training — taken as a bundle with an ESRS course — walks the full workflow: datapoints, evidence, drafting and assurance, with exercises on your own data.
Available as Guided Flex, Live Cohort, 1:1 Expert Mentorship or Corporate Programme.
Get your GRI 2-5 tools — free
Your preparation tools are free for LRA Community members and students. Register once (it's free) and your download starts right away — plus the Disclosure Library, templates and the LRA AI Assistant.
You're in — your download is starting
Your file is downloading now. Your Community Cabinet — with the Disclosure Library, templates and the LRA AI Assistant — is ready too.
Open your Cabinet →