Disclosure focus
If the sustainability reporting has been externally assured, the organisation must also link or refer to the assurance report, describe what was assured and on what basis, and explain its relationship with the assurance provider. The basis includes the exact assurance standards used, the level of assurance obtained, and any limitations of the assurance process.
External assurance is encouraged by GRI but is not mandatory for reporting in accordance with the GRI Standards. Disclosure 2-5 itself is mandatory for an in-accordance claim. Reasons for omission are not permitted for this disclosure.
Do not describe every external check as assurance. A certification, consultancy review, independent data check, audit-support exercise, or agreed-upon procedures engagement is assurance only when an independent, competent provider issues a formal assurance conclusion or opinion; agreed-upon procedures report findings rather than an assurance conclusion.
The seven datapoints below are LRA’s operational decomposition of one unconditional requirement and three conditional elements. They are not seven separate GRI requirements, and ‘Assurance limits’ sits within the description of assured content and basis under 2-5-b-ii.
This LRA educational guidance supports disclosure preparation. For the exact requirements, always refer to the official GRI source.
Prepare
What to collect before drafting
Tick each field as the evidence lands. Owners are the teams that usually hold the source files.
-
Assurance policy and practice
Sustainability reporting / GovernanceThe organisation’s actual policy and practice for seeking external assurance, whether or not assurance was obtained. A separate written policy is not required.
Evidence Assurance policy, reporting governance papers, board or executive committee minutes, internal approval notes.
Watch for The narrative names the policy but omits the board or executive involvement, so the governance role does not match the actual approval trail.
-
Governance involvement in assurance
Sustainability reporting / GovernanceWhether and how the highest governance body and senior executives are involved in the policy and practice for seeking external assurance.
Evidence Board and executive committee packs, assurance planning papers, sign-off records, governance calendar.
Watch for The account says the top governance group is involved, but the documented process shows a different committee or no executive review at all.
-
Assurance report link
Sustainability reporting / Investor relationsThe web link or document reference for each external assurance report or assurance statement covering the sustainability report, where assurance has been obtained.
Evidence Published report archive, investor relations site, assurance provider deliverables, document register.
Watch for The link points to the wrong report version or a draft file, so the published assurance statement does not reconcile to the final reporting pack.
-
Assured content and basis
Sustainability reporting / External assuranceExactly what sustainability information was assured and the basis of assurance, including the exact assurance standards used. A brief referral is sufficient where the linked assurance report contains the detail.
Evidence Assurance statement, scope letter, engagement terms, provider report, reporting controls file.
Watch for The scope description is broader or narrower than the assurance provider’s actual work, or the standard named in the narrative does not match the signed assurance statement.
-
Assurance level obtained
Sustainability reporting / External assuranceThe level of assurance the external reviewer gave for the sustainability reporting, stated clearly and consistently with the assurance statement.
Evidence Assurance statement, provider opinion letter, final report issued by the assurance firm.
Watch for The narrative says the wrong assurance level, or mixes a limited review with a higher level opinion from another engagement.
-
Assurance limits
Sustainability reporting / External assuranceAny stated constraints, exclusions, or caveats in the external assurance process that affect what was checked or how far the work went.
Evidence Assurance statement, management representation letter, engagement scope, issue log from the assurance process.
Watch for The disclosure leaves out a scope restriction or exclusion that is explicit in the assurance statement, so the reported coverage overstates what was actually tested.
-
Assurer relationship
Procurement / Legal / External assuranceA short description of the organisation’s relationship with the assurance provider, including anything relevant to independence, prior work, or other ties.
Evidence Assurance engagement letter, procurement records, independence declarations, conflict checks, provider profile.
Watch for The relationship description does not match the engagement records, for example a prior advisory link or other tie is omitted from the assurance provider file.
Before you start
- What is our actual policy and practice for seeking external assurance, and how often is the decision reviewed?
- Whether and how are the highest governance body and senior executives involved in that policy and practice?
- Did an independent, competent provider issue a formal signed assurance conclusion or opinion for this reporting period?
- If assurance was obtained, which exact report version and sustainability information does each statement cover?
- What exact assurance standards were used, what level of assurance was obtained, and what limitations or exclusions are stated?
- What is our relationship with the provider, including appointment, independence, conflicts, and any other services?
How to prepare it
Request the data
Request the assurance pack and sign-off details
Translate the disclosure into an internal business question — then adapt it to your organisation's own language.
What is our policy and practice for seeking external assurance, how are the highest governance body and senior executives involved, and did any provider issue a formal assurance conclusion for this reporting period?
Use the organisation’s operational language when collecting evidence, but do not map a review, certification, consultancy assignment, independent check, audit support, or agreed-upon procedures engagement to ‘external assurance’ unless an independent, competent provider issued a formal assurance conclusion or opinion.
Weak request
Can you send the external assurance info for the sustainability report?
Why it fails: It is too vague to tell the owner which documents, dates, scope, review basis, governance involvement, or relationship details are needed. It also uses framework language without telling the team how to answer in their own operational terms.
Better request
Please confirm our policy and practice for seeking external assurance and how the highest governance body and senior executives are involved. For each current-period assurance engagement, send the final signed statement, exact assured content, standards and criteria, level of assurance obtained, limitations, final report version, and provider independence and other-services records. If no assurance was obtained, describe the review frequency, decision criteria, plans, and governance involvement.
Formal email template
Subject: Request for sustainability reporting external assurance details for [reporting period] Hello [name/team], We are preparing GRI 2-5 for [reporting period]. Please confirm our current policy and practice for seeking external assurance, its review frequency and criteria, and whether and how the highest governance body and senior executives are involved. If external assurance was obtained, please send the final signed assurance report and confirm: - the exact publication version and information assured - the assurance standards and criteria used - the level of assurance obtained - all limitations, exclusions, sampling boundaries, and mixed levels - the provider’s appointment, independence, conflicts, and any other services If no external assurance was obtained, please confirm that and describe the decision approach, review frequency, criteria, future plans, and governance involvement. An internal decision record is useful evidence but is not itself a GRI requirement. Please distinguish assurance from certification, consultancy, independent checks, and agreed-upon procedures. A possible LRA training template is attached; adapt it to your organisation and check the official source before sign-off. Many thanks, [preparer name] [team] [contact details]
Short Teams / Slack version
Hi [name] — for [reporting period], please confirm our policy and practice for seeking external assurance and whether/how the highest governance body and senior executives are involved. If assurance was obtained, send each final signed statement with its exact scope, standards, level, limitations, report version, and provider independence/other-services record. If none was obtained, describe the annual decision approach, criteria, and plans. Thanks.
Industry examples
Manufacturing
Context. The sustainability report includes site-level environmental metrics and a small number of social indicators covered by an external assurance conclusion.
Adapted request. Please share the external assurance pack for [reporting period]: the final signed assurance statement, exact site metrics and sections assured, standards and criteria, level of assurance obtained, limitations by plant or data stream, governance involvement, and provider independence and other services. If no assurance was obtained, describe the annual decision approach, criteria, and plans.
Example response. Attached are the signed limited assurance statement, scope schedule for energy, water, waste, and workforce safety metrics, exact assurance standards and criteria, site-sampling limitations, the Audit Committee paper, independence declaration, and other-services record.
Financial services
Context. The organisation publishes an annual ESG section within the annual report and obtains external assurance on selected metrics and narrative claims.
Adapted request. Please send the assurance pack for [reporting period] covering the ESG section: the signed assurance statement, exact sections and metrics assured, standards and criteria, level of assurance obtained, limitations, governance involvement, and provider independence and other services. Keep any agreed-upon procedures engagement separate because it does not provide an assurance conclusion.
Example response. The pack includes the signed limited assurance statement, scope schedule for climate and conduct metrics, exact ISAE standards and criteria, exclusion of forward-looking statements, the Board Risk Committee paper, independence declaration, and a separate record of advisory services.
Draft your disclosure
Notes that turn data into a disclosure
LRA training templates — adapt them to your organisation, and check the official source before sign-off.
Method note
Describe the organisation’s policy and practice for seeking external assurance and whether and how the highest governance body and senior executives are involved. If assurance was obtained, refer to each signed assurance report and state the exact assured content, standards used, level of assurance obtained, limitations, and provider relationship.
Context note
Make the boundary of each assurance claim unmistakable. Explain whether the statement covers the full report or selected information, keep separate engagements distinct, and state provider independence and relevant other services consistently with the signed report and engagement records.
Fluctuation statement
Where the assurance approach changed, explain any change in governance involvement, assured content, standards, level, limitations, provider, or report version. Do not imply that assurance is mandatory under the GRI Standards.
Content index entry
GRI 2-5 External assurance — [location / page] / [notes]Download Centre
Preparation tools & forms
Download preparation tools for GRI 2-5 with free verified email access for 24 hours. Source-report links remain public.
Check
For each claim, check the evidence
The policy and practice described are the organisation’s actual current approach, whether or not assurance was obtained.
Risk Boilerplate implies a standing assurance programme that does not exist, or silence is treated as acceptable because no assurance was obtained.
Evidence to check Documented practice, reporting calendar, decision criteria, and current-period governance papers
The disclosure accurately says whether and how the highest governance body and senior executives are involved.
Risk Generic references to directors or management hide the actual governance route or incorrectly imply involvement.
Evidence to check Board or committee papers, minutes, executive approvals, and reporting governance terms of reference
Every claimed assurance engagement is supported by a formal signed assurance conclusion or opinion.
Risk A certification, consultancy review, independent check, or agreed-upon procedures report is incorrectly presented as assurance.
Evidence to check Final signed assurance report and engagement letter
The published description matches the statement’s exact scope, standards, assurance level, limitations, and report version.
Risk The page overstates coverage, merges separate engagements, substitutes vague terminology, or links to a mismatched version.
Evidence to check Signed report, scope schedule, standards and criteria, final publication, and version approval
The relationship with the provider is transparent and consistent with independence records.
Risk Relevant non-assurance services, conflicts, or provider involvement in preparing the assured information are omitted.
Evidence to check Independence declarations, conflict checks, procurement file, and non-assurance services record
Evidence pack to prepare
Common reporting gaps
- Treating 2-5 as not applicable because no external assurance was obtained, instead of describing the policy, practice, and governance involvement.
- Calling an independent check, certification, consultancy review, or agreed-upon procedures engagement ‘assurance’ without a formal assurance conclusion or opinion.
- Saying the whole sustainability report was assured when the statement covers only selected disclosures, indicators, sites, or entities.
- Using vague terms such as ‘verified’, ‘checked’, ‘reviewed’, ‘level of confidence’, or ‘level of review reached’ instead of the statement’s assurance terminology.
- Naming a framework generally but not the exact assurance standards used.
- Omitting the level of assurance obtained or merging limited and reasonable assurance into one description.
- Leaving out limitations, exclusions, sampling boundaries, or mixed assurance levels that appear in the signed statement.
- Linking to a draft, prior-period, or different report version from the one covered by the assurance statement.
- Failing to describe the relationship with the provider, including independence and relevant other services.
- Merging separate engagements with different providers, scopes, standards, or levels into one assurance claim.
Where drafts go wrong
Mistakes to avoid and where judgement is needed
The left column is what preparers get wrong while collecting; the right column is where you will have to make and explain a judgement.
Mistakes to avoid
- Starting only when assurance existsThe team treats 2-5-a as conditional and prepares nothing when no external assurance was obtained, even though policy, practice, and governance involvement must still be described.
- Misclassifying the engagementA certification, consultancy review, independent check, internal audit, or agreed-upon procedures report is labelled assurance without a formal independent assurance conclusion.
- Using a generic governance labelThe draft refers to ‘directors’ or ‘management’ but does not say whether and how the highest governance body and senior executives are involved.
- Overstating the scopeThe public page says the report was externally assured when the signed statement covers selected indicators, entities, sites, or topics only.
- Merging engagementsDifferent providers, standards, scopes, or assurance levels are collapsed into one description, making it impossible to trace each claim to its signed conclusion.
- Paraphrasing technical termsThe team substitutes ‘confidence’, ‘verification’, or ‘review level’ for the exact assurance standard and level stated by the provider.
- Dropping limitationsSampling, exclusions, unavailable sites, mixed levels, or other limits in the signed report are omitted from the public description.
- Missing provider relationshipAppointment, independence, conflicts, or relevant non-assurance services are not checked against procurement and independence records.
Judgement needed
- Exact scope differs from the report headlineState precisely which disclosures, metrics, entities, sites, or report sections were assured; do not let ‘externally assured report’ imply broader coverage than the statement.
- Statement covers a different period or versionConfirm that the signed conclusion covers the final published report and reporting period. Explain any genuine version link rather than silently reusing an earlier statement.
- Limited and reasonable assurance both applyIdentify which information received limited assurance and which received reasonable assurance. Never combine them into one overall level.
- Different standards apply to different informationMap each exact assurance standard and criterion to the relevant engagement and assured information, including topic-specific standards such as ISAE 3410.
- Limitations include sampling or selected sitesDescribe the limitations stated by the provider, including sampling, site selection, exclusions, and work not performed, without suggesting assurance requires testing every record.
- Provider also supplies non-assurance servicesDescribe services relevant to understanding the relationship and confirm how independence was assessed. Do not use an invented ‘material connection’ threshold.
Examples
How it reads on the page
Synthetic, written by LRA — not from a company report, not text from any standard.
Our policy is to assess annually whether external assurance would strengthen the credibility of our sustainability reporting. The Audit Committee approves the assurance plan, and senior executives confirm readiness, scope, and responses to findings. For 2025, selected greenhouse gas, water, and workforce disclosures were externally assured; the signed statement is linked in the report annex. The provider performed the engagement under ISAE 3000 (Revised), and ISAE 3410 for greenhouse gas information, and issued a limited assurance conclusion. The statement identifies the selected disclosures, sampling approach, sites not visited, and exclusion of forward-looking information. The provider was appointed through procurement, did not prepare the assured information, confirmed its independence from the organisation, and its other services are described in the assurance statement.
Synthetic example for practitioner learning only. It uses the exact standards and ‘limited assurance conclusion’, keeps scope and limitations visible, and describes the provider relationship and independence.
Our policy is to review annually whether to seek external assurance. The Audit Committee considers the recommendation, and senior executives assess reporting readiness, regulatory requirements, and stakeholder expectations. We did not obtain external assurance for the 2025 sustainability reporting. We will reassess the decision for the next reporting cycle using the same criteria and our planned improvements to reporting controls.
Synthetic example for practitioner learning only. GRI 2-5-a still applies when no external assurance was obtained; the disclosure describes the decision approach, review frequency, criteria, plans, and governance involvement without presenting an internal decision record as a GRI requirement.
Quality ladder
- Basic
We review annually whether to seek external assurance; the Audit Committee considers the decision and senior executives assess reporting readiness. We did not obtain external assurance this period.
- Better
Our annual assurance policy and governance roles are described, and the linked signed statement identifies the selected information assured, exact standards used, level of assurance obtained, limitations, and provider relationship.
- Best
Our policy, decision criteria, review frequency, and governance involvement are clear. Each current-period engagement is separately linked and reconciled to the final publication, with exact scope, standards, assurance level, limitations, provider independence, and other services stated consistently with the signed conclusion.
Check your understanding
Scenarios to work through
An organisation did not obtain external assurance this year. Its policy is reviewed annually; the Audit Committee considers the recommendation, and senior executives assess readiness, regulatory requirements, and stakeholder expectations.
A provider performed agreed-upon procedures under ISRS 4400 and reported factual findings, but issued no assurance conclusion or opinion.
One signed statement provides limited assurance under ISAE 3000 (Revised) for selected ESG disclosures, while a second provides reasonable assurance under a different standard for a narrower regulatory dataset.
The assurance provider was appointed through procurement, did not prepare the assured information, confirmed independence from the organisation, and also supplied a separate controls advisory service.
Real reports
How 3 companies report it
Examples of full and partial reporting practice. These are evidence-led reviews, not exact disclosure templates to copy.
Zydus Lifesciences Limited
Partial
Interconexión Eléctrica S.A. E.S.P.
Partial
Chang Hwa Commercial Bank, Ltd.
Partial| Field | Zydus Lifesciences Limited | Interconexión Eléctrica S.A. E.S.P. | Chang Hwa Commercial Bank, Ltd. |
|---|---|---|---|
| Assurance policy and practice | Partial | Partial | Partial |
| Governance involvement in assurance | Not found | Partial | Not found |
| Assurance report link | Not found | Not found | Not found |
| Assured content and basis | Not found | Not found | Not found |
| Assurance level obtained | Not found | Not found | Not found |
| Assurance limits | Not found | Not found | Not found |
| Assurer relationship | Not found | Not found | Not found |
Ask the Knowledge Hub AI Assistant about this disclosure
Get practical answers for your reporting context.
Check your text
Paste one or two paragraphs. The fragment is used for this check only and is not stored in your conversation.
Peer comparison uses examples on this card, not prevalence in the report corpus.
Advice, not assurance
Framework references
Relevant GRI requirements and related disclosures
GRI
GRI 2-5
within GRI 2: General Disclosures
Guides that settle this question
Related & explore
More in GRI 2 →Browse full catalogue →Search all disclosures →
FAQ
Questions this page answers
Use the page’s datapoint list as your starting checklist: assurance policy and practice, governance involvement, assurance report link, assured content and basis, assurance level obtained, assurance limits, and assurer relationship. The page also gives a step-by-step preparation flow, so you can turn that list into a practical data request and draft plan.
Treat it as a working sequence for collecting the right inputs, checking what needs to be evidenced, and then shaping the disclosure draft. It is designed to help you move from raw information to a report-ready narrative rather than leaving you with a theory-only summary.
Ask Sustainability Reporting and the external assurance contact for the current policy and practice, signed statement, exact scope, standards, level, limitations, and final report version. Finance, Internal Audit, Company Secretariat or Governance, Legal, Procurement, and the Audit Committee may need to confirm controls, governance involvement, appointment, independence, and other services.
Sustainability Reporting normally coordinates the disclosure with the external assurance contact. Finance and Internal Audit can support reporting controls; Company Secretariat or Governance and the Audit Committee can confirm governance involvement; Legal and Procurement can evidence appointment, conflicts, independence, and other services.
Use the page’s evidence pack: documented practice, governance papers, engagement letter, signed report, scope schedule, standards and criteria, management representations where used, independence and conflict declarations, other-services record, final publication version, and approvals.
They test the policy and practice, governance involvement, whether the engagement is genuine assurance, whether scope and terminology match the signed statement, and whether the provider relationship is transparent. Use them before sign-off to prevent overstatement.
The page lists common gaps and mistakes so you can check for missing evidence, unclear scope, or weak links between the narrative and the assurance information. It is useful as a final quality-control pass before the disclosure goes into the report.
Start with the policy and practice and explain governance involvement. If assurance was obtained, add a clear referral to each signed statement and a concise description of scope, standards, level, limitations, and provider relationship, then complete the GRI content-index line.
Focus on the page’s assurance datapoints and make sure the narrative clearly states what was assured, the basis, the level obtained, any limits, and the assurer relationship. The evidence pack and claim checks are there to help you keep the wording aligned with the underlying support.
The Download Centre includes a Prep & Assurance workbook in .xlsx format, which is intended to support preparation and assurance readiness. Use it alongside the page’s step-by-step guidance, evidence pack, and common mistakes list to organise inputs and track what still needs to be confirmed.
The Download Centre also provides a printable Library Card in .pdf format. It is a practical companion for keeping the disclosure’s key datapoints, evidence needs, and draft prompts in one place while you work through preparation.
More questions this page can help with