Short answer
The answer, before the reasoning
An ESRS sustainability statement is ready for limited assurance when the undertaking can reconstruct how material impacts, risks and opportunities were identified; explain the reporting boundaries and estimates used; trace each material metric and narrative claim to controlled evidence; demonstrate the link between policies, actions, resources, targets and results; and show who prepared, reviewed, challenged and approved the information. Readiness does not mean that assurance has been obtained.
It means that the entity-controlled reporting process gives an assurance practitioner a clear line of sight from the applicable criteria to the published disclosure.
A practitioner guide to preparing the ESRS reporting system for limited assurance before the final sustainability statement is drafted.
Technical status
EDUCATIONAL STATUS
This article is an educational implementation guide. It is not legal advice, an assurance opinion or a substitute for checking the applicable ESRS edition, national transposition, assurance requirements and entity-specific facts.
In practice
Article map
| Stage | What the reader will be able to do |
|---|---|
| Answer | Define limited-assurance readiness without treating readiness work as an assurance conclusion. |
| Build | Create an evidence architecture for DMA, boundaries, estimates, P/A/T, metrics, narrative and governance. |
| Diagnose | Recognise common control gaps and understand why they create assurance risk. |
| Remediate | Sequence correction work from technical blockers to disclosure quality and dry-run testing. |
| Review | Use a pre-assurance checklist and mock evidence request before formal fieldwork. |
Technical status
SOURCE AND LEGAL-STATUS WARNING
The main technical analysis uses the Commission-adopted revised ESRS dated 3 July 2026. At the source cut-off of 2 August 2026, the delegated act was not yet in force pending publication in the Official Journal and completion of the scrutiny process. The 2023 ESRS remain the legally applicable baseline until the revised act takes effect. Verify the applicable edition, reporting period and national assurance rules before using this article for a live report.
Why readiness begins with the reporting system, not the assurance request list
Limited assurance is not a lighter version of copy-editing. The practitioner considers whether the sustainability information is materially misstated against the applicable reporting criteria. That work reaches backwards from the published statement into the undertaking’s materiality process, source systems, estimates, policies, controls and governance records. If those foundations are assembled only after drafting, the team is forced to recreate decisions, locate missing evidence and explain inconsistencies under time pressure.
The practical objective is therefore not to predict every assurance procedure. It is to design an ESRS reporting environment in which material information is complete, balanced, traceable and reviewable. The CEAOB guidelines are non-binding and do not override national requirements, but they are useful interim evidence of the areas that practitioners are likely to understand and challenge: the reporting process, double materiality, risks of material misstatement, forward-looking information, internal controls, other information and the conditions for incorporation by reference.
Rule
LIMITED ASSURANCE IS NOT A REDUCED EVIDENCE STANDARD
The work effort is lower than in a reasonable-assurance engagement and the conclusion is expressed in a negative form. The undertaking still needs a coherent basis for preparation and evidence capable of supporting material disclosures. “Limited” describes the assurance level and nature of procedures, not permission to rely on informal, unversioned or unreviewed reporting records.
In practice
Four distinctions that prevent expensive misunderstandings
| Distinction | What it means | Practical consequence |
|---|---|---|
| Entity evidence vs assurance evidence | Entity evidence supports management’s reporting judgements and disclosures. Assurance evidence is obtained and evaluated by the practitioner. | Prepare a traceable evidence environment, but do not describe internal review or advisory work as independent assurance. |
| Readiness review vs assurance engagement | A readiness review identifies gaps and tests whether evidence and controls are likely to withstand challenge. It does not produce the statutory assurance conclusion. | Label the scope, provider, procedures and output accurately. Avoid “assured” or “verified” claims unless supported by the actual engagement. |
| Control design vs operating effectiveness | A documented control may be logically sound but may not have operated during the reporting period or may lack evidence of performance. | Retain evidence of execution: review notes, reconciliations, approvals, exceptions and remediation. |
| Technical compliance vs fair presentation | Completing a disclosure checklist does not by itself demonstrate that the statement fairly presents all material IROs and how they are managed. | Challenge completeness, balance, connected information, entity-specific information and whether material limitations are visible. |
The ESRS assurance-readiness architecture
Figure 1. A controlled evidence chain should connect reporting criteria, materiality and boundaries to source evidence, methods, controls, disclosure and governance.
A useful organising rule is one material disclosure, one evidence chain. A disclosure may contain several claims, but each claim should have a stable identity and a documented relationship to the relevant IRO, source data, method, review control, limitation and approval. The same model applies to a quantitative metric, a description of a policy, a statement that an action has been implemented, a claim about progress towards a target and a forward-looking explanation of anticipated financial effects.
Eight workstreams to make the sustainability statement assurance-ready
1. Lock the reporting basis and applicable edition
Before evidence requests begin, prepare a basis-of-preparation memorandum. It should identify the reporting undertaking, whether the statement is individual or consolidated, the reporting period, the applicable ESRS edition, any transitional reliefs, the statement structure, incorporation-by-reference choices, the treatment of comparative information and the governance route for approval.
At the current source cut-off this step is particularly important because the revised ESRS were adopted by the Commission on 3 July 2026 but were not yet in force. The memorandum should not quietly combine paragraph references from the 2023 and revised standards. Where the reporting team is preparing for the revised standards, it should separately explain the legal status and the trigger for moving the reporting basis to the new delegated act.
Maintain a controlled source register with document, version, publication date, legal status and paragraph anchors.
Map every disclosure to the selected ESRS edition and flag historical or superseded references.
Document national transposition and assurance requirements separately from the content requirements of ESRS.
Use a release gate so that the basis-of-preparation wording cannot be changed without technical and governance review.
2. Preserve the double materiality assessment trail
The practitioner needs to understand how the undertaking identified the sustainability topics and IROs that could be material and how it determined the information to report. A final matrix is not enough. Retain the business-model and value-chain analysis, the IRO universe, stakeholder and expert inputs, criteria, thresholds or qualitative decision rules, severity and likelihood assessments, financial-materiality analysis, aggregation decisions, exclusions, challenge records and approvals.
The reporting index should reconcile to the approved DMA outcome. If a matter appears in risk management, strategy, financial planning, due diligence or board papers but not in the sustainability statement, the file should explain whether it was assessed, how it was characterised and why the related information was not material.
3. Reconcile reporting boundaries and value-chain information
A group boundary statement should start with the financial consolidation perimeter and then identify metric-specific or topic-specific differences. It should explain subsidiaries, joint arrangements, associates, acquisitions, disposals, dormant entities and material sites. For value-chain information, document the segment, geography, counterparty population, data source, estimation method, coverage, limitations and improvement plan.
A common finding is that the narrative describes the consolidated group while a metric covers only selected operations, or that the denominator used for a rate does not match the disclosed workforce or site boundary. The control is not merely a footnote. It is a boundary register that is reconciled to the financial reporting entity and applied consistently across data requests, calculations and narrative.
4. Control estimates, proxies and modelled information
ESRS reporting often uses estimates because value-chain or forward-looking information cannot be measured directly. The evidence file should show why estimation was needed, the source hierarchy, assumptions, model design, data coverage, calculation version, sensitivity, uncertainty, reviewer challenge and the plan to improve data. The disclosure should explain material measurement uncertainty and significant methodological changes without suggesting that an estimate is actual data.
For forward-looking information, readiness means that assumptions are reasonable and supportable in the reporting context, are connected to strategy and financial planning where appropriate, and have been approved at a suitable level. It does not mean guaranteeing that an anticipated outcome will occur.
5. Evidence policies, actions, resources and targets as separate claims
Policies, actions and targets are often drafted as one optimistic narrative, but each has a different evidence requirement. A policy claim needs the approved policy, scope, owner, approval date and current version. An action claim needs proof that the action occurred, the covered operations or value-chain segment, resources, status and expected or achieved result. A target needs an approved baseline, boundary, methodology, milestone, owner and progress calculation.
Do not infer effectiveness merely from the existence of a policy or activity. Where the statement claims that an action reduced an impact or risk, retain outcome evidence and a defensible explanation of causality. If the evidence supports only implementation, the narrative should not claim effectiveness.
6. Build metric-level data lineage and reconciliations
For each material metric, maintain a data dictionary and lineage record from source system to published value. The record should identify metric definition, unit, boundary, period, owner, extraction date, source population, transformations, assumptions, estimates, controls, comparative treatment, restatements and final disclosure location.
Reconciliations should be designed around risk. Examples include energy totals to invoices and meters; headcount to payroll and financial reporting populations; CapEx to the fixed-asset or project ledger; incidents to legal and compliance registers; and GHG activity data to energy, procurement, fleet and logistics records. A control without retained evidence of performance will rarely resolve a review question.
7. Support narrative and connected information
Narrative disclosures are not “soft” information. A statement about board oversight should be supported by terms of reference, agendas, papers, minutes and evidence of decisions. A claim about stakeholder engagement should show the affected stakeholder groups, method, timing, themes and how views informed decisions. A statement about strategy should reconcile to approved strategy, risk appetite, investment plans and management reporting.
Connected information is a specific control area. The same fact should not appear with different definitions or amounts in the sustainability statement, management report, financial statements, remuneration report and investor materials. Direct cross-references to financial-statement amounts should be tied out. Where assumptions differ because the measurement objectives differ, the statement should explain significant differences rather than silently using inconsistent inputs.
8. Evidence governance and internal controls over sustainability reporting
ESRS 2 GOV-4 requires information on risk management and internal controls over sustainability reporting. The underlying file should therefore demonstrate more than a generic control framework. It should show which risks were identified, which controls respond to them, who performs and reviews the controls, how deficiencies are escalated and how management and the administrative, management and supervisory bodies receive information.
A proportionate control matrix can use the same language as financial reporting: risk, assertion, control objective, frequency, owner, reviewer, evidence, exception, remediation and sign-off. The assertions may include completeness, existence, accuracy, valuation or estimation, boundary, period, consistency, presentation and connected information.
In practice
| DMA evidence component | Minimum record | Control question |
|---|---|---|
| Population | Topics, subtopics and entity-specific IROs considered across own operations and value chain. | Can the team show that the search was complete enough for the business model, sectors, geographies and relationships? |
| Decision criteria | Impact and financial materiality criteria, time horizons, thresholds and qualitative overrides. | Are criteria stable, approved and applied consistently rather than adjusted to reach a preferred result? |
| Evidence | Operational data, incidents, complaints, stakeholder views, risk registers, forecasts, expert analysis and external information. | Is each conclusion supported by current, relevant evidence, including contrary evidence? |
| Judgement log | Decision, rationale, alternatives, uncertainty, challenge, owner, approver and date. | Can another reviewer reconstruct why an IRO or item of information was included or excluded? |
| Reporting bridge | IRO IDs linked to ESRS DRs, entity-specific disclosures, policies, actions, targets, metrics and financial effects. | Does the published statement match the final approved materiality conclusion? |
In practice
| Estimate control | Evidence to retain | Typical failure |
|---|---|---|
| Need and scope | Data-gap assessment, population covered, omitted segments and reason direct data were not reasonably available. | A proxy is used without identifying which part of the disclosed total it represents. |
| Method and inputs | Formula, source data, factor provenance, assumptions, units, conversions and model version. | The calculation cannot be reproduced or uses mixed periods and units. |
| Uncertainty and sensitivity | Range, key drivers, alternative assumptions and materiality of possible error. | A precise number is published without explaining high uncertainty. |
| Review and approval | Preparer, reviewer, challenge, exceptions, changes and approval. | The model owner approves their own estimate with no independent challenge. |
| Improvement plan | Owner, milestones, expected primary-data coverage and future restatement approach. | “Data will improve” is stated without a controlled action plan. |
In practice
| Disclosure claim | Core evidence | Review test |
|---|---|---|
| Policy | Approved document, scope, exclusions, commitments, owner, governance approval, public availability and version history. | Does the published description match the policy actually in force during the period? |
| Action | Action register, implementation evidence, locations, dates, resources, dependencies, completion status and outputs. | Is “implemented” supported, and are planned actions clearly distinguished from completed actions? |
| Resource | Budget, CapEx/Opex record, business case, approval, funding source and reconciliation to financial systems where relevant. | Are significant resources connected to the actions and to reported financial amounts? |
| Target | Approval, baseline, boundary, target year, metric definition, methodology, assumptions and interim milestones. | Can progress be recalculated and is the target consistent with the disclosed scope? |
| Effectiveness / progress | Outcome metric, trend, counterfactual or other support, review and limitation. | Does the evidence support the level of causal language used? |
Technical status
STATUS OF THE FINDINGS
The findings below are a London Reporting Academy practitioner synthesis of reporting-system risks indicated by ESRS, CEAOB and ISSA 5000 implementation materials. They are not an official regulator checklist and should not be attributed to a specific assurance provider.
In practice
Common limited-assurance readiness findings
| Finding | How it appears | Why it matters — Correction evidence |
|---|---|---|
| DMA cannot be reconstructed | Only the final material-topic matrix is retained. | Completeness and the basis for material conclusions cannot be evaluated. — IRO universe, criteria, evidence, decisions, exclusions, challenge and approval. |
| Boundary varies silently | Narrative, metrics and financial amounts use different entity/site populations. | Users cannot understand scope and metrics may be materially misstated. — Boundary register, financial-perimeter reconciliation and metric-specific scope notes. |
| Value-chain estimate is opaque | A supplier or spend-based estimate is included without coverage or method. | Uncertainty and possible bias are hidden. — Population, source hierarchy, method, assumptions, coverage, review and improvement plan. |
| Policy claim exceeds evidence | The report says a policy is group-wide, but approval or implementation is local. | The statement overstates governance maturity and coverage. — Current approved policy, scope, implementation status and exceptions. |
| Actions are confused with outcomes | Training or a programme is described as proof that an impact was reduced. | Activity evidence does not support an effectiveness claim. — Separate action evidence from outcome metrics and qualify causal wording. |
| Target baseline is unstable | The target is recalculated using a different boundary or method without explanation. | Progress is not comparable and may be misleading. — Approved target file, restatement rule, change log and recalculated comparative. |
| Metric cannot be reproduced | Published number is copied from a presentation or manually adjusted. | No reliable lineage, review or change control exists. — Source extract, calculation file, review evidence and final tie-out. |
| Narrative has no evidence owner | Claims about governance, stakeholder views or resilience are drafted centrally without records. | Material qualitative information may be unsupported or inconsistent. — Narrative claim register, evidence owner, source records and approval. |
| Forward-looking assumptions conflict | Climate or financial-effect assumptions differ from planning or financial statements without explanation. | Connected information is weakened and uncertainty may be understated. — Assumption crosswalk, rationale for differences, governance challenge and disclosure. |
| Cross-reference is unusable | Reference is vague, points to a later publication or an ineligible document. | Material information may not be accessible within the reporting package. — Exact reference, eligibility check, simultaneous publication and assurance-level evidence. |
| Control exists only on paper | The control matrix names reviews, but no review notes or exceptions are retained. | Operating effectiveness cannot be demonstrated. — Dated evidence of performance, exceptions, remediation and retest. |
| Sign-off is ceremonial | Approvers receive the final PDF but not open judgements or data limitations. | Governance approval is not informed and may not cover material risks. — Sign-off pack, open-item register, management representations and minutes. |
A risk-based remediation sequence
Figure 2. Remediate technical and evidence blockers before refining narrative and performing a dry run.
In practice
| Phase | Priority actions | Exit evidence |
|---|---|---|
| 1. Stabilise criteria | Confirm edition, scope, DMA method, material IROs, statement architecture and high-risk judgements. | Approved reporting basis, IRO register and disclosure index. |
| 2. Repair evidence chains | Close missing source records, boundary gaps, estimate methods, metric lineage and narrative ownership. | Complete evidence register and reproducible calculations. |
| 3. Strengthen controls | Clarify prepare-review-approve roles, perform reconciliations, evidence reviews, govern models and record exceptions. | Operating control evidence and deficiency log. |
| 4. Improve disclosure | Correct overclaims, make limitations visible, connect P/A/T/metrics, improve cross-references and financial-statement links. | Technically reviewed draft and disclosure checklist. |
| 5. Dry run and close | Issue a sample request list, select high-risk claims, test response time and quality, resolve findings and obtain sign-off. | Closed readiness report, management representations and governance approval. |
Hypothetical scenario
ILLUSTRATIVE SCENARIO
A diversified manufacturer has completed its DMA and drafts an ESRS statement. The final matrix identifies climate, own workforce and business conduct as material. During a readiness dry run, the team discovers that the climate Scope 3 estimate covers only 62% of relevant spend; the workforce turnover denominator excludes two subsidiaries; a “group-wide” human-rights policy is not yet implemented in one acquisition; and the board paper does not identify these limitations. The team does not conceal the gaps. It corrects the workforce boundary, labels and explains the Scope 3 estimate and improvement plan, narrows the policy claim to the supported scope, and gives the board a judgement pack. The evidence file records the original issue, correction, reviewer, retest and disclosure effect. This is stronger than merely rewriting the report because the underlying reporting system has changed.
Illustrative only. It shows how the decision is made, not wording that can be copied or relied on.
In practice
Weak versus stronger assurance readiness
| Area | Weak approach | Stronger approach |
|---|---|---|
| Evidence timing | Owners are asked for files after the report is substantially complete. | Evidence requirements, owners and controls are designed with the disclosure process. |
| DMA | Only the final materiality matrix is retained. | The full IRO population, evidence, criteria, exclusions, challenge and approval are versioned. |
| Estimates | A modelled number is inserted with a generic data-limitation note. | Method, coverage, assumptions, uncertainty, review and improvement plan are specific and traceable. |
| Narrative | The reporting team drafts governance and strategy claims from interviews. | Each material claim has an evidence owner, source record and approval. |
| Controls | A control matrix is prepared for the assurance provider. | Controls operate during the reporting cycle and retain evidence of performance and exceptions. |
| Governance | The board approves the final designed report. | The board receives material judgements, limitations, control findings and representations before approval. |
Rule
MYTH VERSUS REALITY
Myth: “Limited assurance means the practitioner will only check a sample of numbers, so narrative and materiality evidence can be informal.” Reality: limited assurance is risk-based and may address the process used to prepare the sustainability statement, double materiality, narrative information, estimates, forward-looking information, connected information and the conditions for incorporation by reference. The exact procedures depend on the engagement and applicable rules, but unsupported material narrative is not outside the assurance perimeter merely because it is qualitative.
Common ESRS control gaps include a DMA that cannot be reconstructed, a boundary that varies silently and an opaque value-chain estimate. These arise when only the final material-topic matrix is retained, narrative, metrics and financial amounts use different entity or site populations, or a supplier or spend-based estimate lacks coverage or method.
Self-check
- Select one material IRO. Can you trace it from the DMA population to the final disclosure, policy/action/target/metric records and governance approval?
- Select one estimated metric. Can a reviewer reproduce the result, identify the estimated portion, understand uncertainty and see evidence of model review?
- Select one statement about effectiveness or progress. Does the evidence support the causal strength of the wording?
- Select one financial-statement connection. Are the amounts and assumptions reconciled or are significant differences explained?
Questions
Questions people ask
What does ESRS assurance readiness mean?
An ESRS sustainability statement is ready for limited assurance when the undertaking can reconstruct how material impacts, risks and opportunities were identified; explain the reporting boundaries and estimates used; trace each material metric and narrative claim to controlled evidence; demonstrate the link between policies, actions, resources, targets and results; and show who prepared, reviewed, challenged and approved the information. Readiness does not mean that assurance has been obtained. It means that the entity-controlled reporting process gives an assurance practitioner a clear line of sight from the applicable criteria to the published disclosure.
What evidence supports a DMA?
The practitioner needs to understand how the undertaking identified the sustainability topics and IROs that could be material and how it determined the information to report. A final matrix is not enough. Retain the business-model and value-chain analysis, the IRO universe, stakeholder and expert inputs, criteria, thresholds or qualitative decision rules, severity and likelihood assessments, financial-materiality analysis, aggregation decisions, exclusions, challenge records and approvals.
Which ESRS control gaps are common?
Common ESRS control gaps include a DMA that cannot be reconstructed, a boundary that varies silently and an opaque value-chain estimate. These arise when only the final material-topic matrix is retained, narrative, metrics and financial amounts use different entity or site populations, or a supplier or spend-based estimate lacks coverage or method.
Does a readiness review count as assurance?
Readiness does not mean that assurance has been obtained. It means that the entity-controlled reporting process gives an assurance practitioner a clear line of sight from the applicable criteria to the published disclosure.
Conclusion
Limited-assurance readiness is best treated as a reporting-system discipline. The undertaking should be able to explain what it reported, why the information was material, what population and boundary were used, how the value or narrative was produced, which controls operated, what uncertainty remains and who approved the result. The most effective readiness programme therefore starts with the DMA and the evidence architecture, not with a last-minute assurance request list. A controlled dry run then shows whether the system works under challenge and whether remediation has genuinely closed the risk.
Rule
PRODUCTION NOTE
The following material is for technical review, CMS assembly, visual production, controlled reuse and future updates. It is not intended to appear in full in the public web article.
Take it with you
The checklists as a working spreadsheet
Every checklist and table on this page, with empty status, owner and evidence columns for your team to fill in and keep.
✓ LRA AI Assistant · Human-in-the-loop
Ask about this guide
It answers from this page, and reaches into the linked disclosure cards when your question is about the standard itself. Your first two answers are free without signing in.
Go deeper · ESRS
ESRS and CSRD training
Double materiality, datapoints and the sustainability statement, with a mentor on your own report.
Available as Guided Flex, Live Cohort, 1:1 Expert Mentorship or Corporate Programme.
