Does an EU Voluntary Sustainability Report Need External Assurance?

A practical guide to internal review, voluntary verification, formal assurance, evidence readiness, engagement scope and transparent claim wording for SMEs.

Recital 5 of Commission Delegated Act C(2026) 5011 says that, to minimise compliance costs, undertakings applying the Standard are not obliged to seek assurance for the information they report. This is consistent with the Standard’s voluntary and proportionate purpose. The absence of a general assurance obligation should not be rewritten as a claim that external assurance is prohibited or never useful.

Annex I paragraph 11 separately requires reported information to be relevant, faithful, comparable, understandable and verifiable. Verifiable does not mean “externally assured”. It means the information and the process supporting it should be capable of being checked. In practice, the SME needs clear definitions, source records, methods, review evidence and approval even when no independent practitioner is engaged.

Figure 1. “Reviewed”, “verified” and “assured” communicate different work and must not be used interchangeably.

An internal review gives management a basis for approving the information and the B1 statement. It is part of the undertaking’s reporting process, not an independent assurance engagement. A small organisation may combine roles, but preparation and challenge should be separated for higher-risk metrics and claims wherever practicable. Where one person performs both, the organisation should add a compensating management or board review.

The decision should begin with users and risk, not with the belief that every credible report must be assured. For a first-time SME report, strengthening the dataset and evidence trail may create more value than paying for a broad engagement before the process is ready. External work becomes more compelling where the information directly affects finance, contractual eligibility, public claims or a high-risk decision.

“Assure our sustainability report” is too vague for a useful engagement. Management and the practitioner need to define the sustainability information, reporting criteria, entities, period, exclusions, level of assurance and intended users. The subject matter could be the complete Option A report, selected B3 emissions, the B8 workforce table, the B1 compliance statement or a separate data pack. Each choice produces a different evidence request and conclusion.

The Voluntary Standard itself does not prescribe the external engagement standard. The practitioner must determine the appropriate professional and jurisdictional basis. At the source cut-off, the IAASB’s International Standard on Sustainability Assurance (ISSA) 5000 provides a global sustainability-assurance baseline, is designed for mandatory and voluntary engagements and is effective for information reported for periods beginning on or after 15 December 2026, with early application permitted. Jurisdictional adoption dates and local equivalents can differ.

ISAE 3000 (Revised) is the IAASB standard for assurance engagements other than audits or reviews of historical financial information and has historically been used for sustainability and other external reporting engagements. Applicability after ISSA 5000’s effective date should be agreed with the practitioner using current IAASB guidance and local adoption. For a greenhouse-gas statement, ISO 14064-3:2019 specifies principles and requirements and provides guidance for verification and validation. A metric-specific ISO verification does not automatically assure the complete Voluntary Standard report.

Limited and reasonable assurance are different engagement levels with different procedures and forms of conclusion. Reasonable assurance is the higher level but is not absolute assurance. Limited assurance is meaningful assurance, not a casual review. It is misleading to translate either level into a universal percentage of accuracy or a fixed amount of testing because the work depends on risks, materiality, criteria, evidence and practitioner judgement.

Strengthen management review. Complete the Disclosure Index, evidence register, reconciliations, estimate review and release sign-off.

Run a readiness review. Ask an independent reviewer to identify gaps in criteria, evidence, boundaries, controls and wording before an assurance engagement.

Select the information that matters most. Consider metric-specific verification where user demand is narrow, such as GHG emissions.

Agree the engagement. Define criteria, subject matter, level, period, boundary, intended users, deliverables and access to evidence.

Remediate before fieldwork. Resolve unsupported claims, missing source populations, inconsistent boundaries and open exceptions.

Control the final report. Reconcile the practitioner’s scope and conclusion to every assurance reference, badge and statement in the publication.

Roll forward. Retain findings, evidence requests, adjustments and control improvements for the next reporting cycle.

Figure 2. SMEs can build confidence in stages and stop at the level justified by user needs and risk.

Organisation. Alder Packaging Ltd is a hypothetical 115-employee supplier. Its largest customer requests independently verified Scope 1 and 2 emissions for procurement scoring. The board also wants confidence in the complete Option A report, but no contract requires report-wide assurance.

Decision. Management first commissions a readiness review of the complete report. The review identifies inconsistent treatment of leased-site energy, an unsupported policy-effectiveness sentence and incomplete reviewer evidence for workforce metrics. The company remediates those findings and maintains management approval over the complete report.

External engagement. It then commissions metric-specific GHG verification for the customer-required boundary and period under agreed criteria. The verifier’s statement covers only the GHG statement. The public report says that management reviewed and approved the complete Option A report and separately identifies the verified GHG information with a direct reference to the verification statement.

Why this is proportionate. The engagement responds to the actual customer decision, avoids implying assurance over untested narrative information, and uses the readiness findings to strengthen the wider reporting system for future assurance.

An SME can report under the EU Voluntary Standard without obtaining external assurance. Credibility starts with management responsibility, controlled evidence, documented estimates, paragraph-level completeness and an honest B1 claim. External work should then be selected because it serves a real user or risk decision - not because “assured” sounds stronger. The safest public statement is the most precise one: who performed the work, what information was covered, against which criteria, for which period and entity, at what level, and where the conclusion can be read.

An assurance provider will usually ask for the reporting basis and boundary, governance approvals, data dictionary, evidence register, source populations, calculations, estimates, reconciliations, omissions and correction records. The exact request depends on the defined subject matter, criteria, period and assurance scope, so evidence should be assembled for the information actually covered.