How to Prepare a GRI Report for External Assurance

Technical status: source-grounded publication draft; final human technical review required before release.

GRI encourages organisations to use internal controls and seek external assurance to enhance the credibility of sustainability reporting, but GRI 1 does not make external assurance a condition for reporting in accordance. Disclosure 2-5 requires the organisation to explain its policy and practice for seeking external assurance and, where assurance has been obtained, to provide the assurance report and describe the scope, basis, standards, level, limitations and relationship with the provider.

Assurance readiness therefore has two objectives. It prepares information that can be tested against suitable criteria, and it ensures the public description of assurance is accurate. The project should strengthen the reporting system even if the final engagement covers only selected disclosures.

A request for proposal that says “assure our GRI report” is not sufficiently precise. The organisation should first prepare a scope-and-criteria memorandum. It does not need to predetermine the practitioner’s procedures, but it should define the intended subject matter and what management is prepared to support.

GRI 1 recommends an assurance provider that is independent of the organisation, demonstrably competent in the subject matter and assurance practices, quality controlled, systematic, documented and evidence based. ISSA 5000 is profession agnostic: it can be applied by professional accountants and other assurance practitioners who meet the applicable ethical, quality-management and competence requirements.

The procurement process should evaluate the engagement team, not only the firm brand. Ask who will lead the work, which specialists will test GHG, social, human-rights or value-chain information, how group components will be covered, what quality review applies, and how independence threats are identified and addressed.

The evidence map is the central readiness deliverable. It decomposes each in-scope disclosure into criteria and connects each published claim to source evidence, calculation or narrative files, control owners and approvals. It also identifies which evidence is public and which remains restricted.

Figure 1. Assurance readiness requires traceability from the published disclosure to criteria, calculation, source evidence and control.

A calculation can be numerically correct once and still be difficult to assure if the process is uncontrolled. Readiness testing should ask how data are initiated, captured, changed, consolidated, reviewed and approved. Important controls include master-data governance, access rights, unit validation, automated interfaces, manual journal review, completeness reconciliations, factor version control, estimate approval, variance analysis, restatement assessment and publication sign-off.

For narrative disclosures, controls are equally important. The team should retain the policy or commitment in force during the reporting period, evidence of implementation, results used to support effectiveness claims, governance minutes, stakeholder evidence, limitations and approvals. A polished paragraph without a source trail is an assurance risk.

Select a sample of high-risk disclosures and follow them end to end: from source event to system, consolidation, calculation, review and published text. The walkthrough should involve the actual preparer and reviewer. It should identify manual hand-offs, unrecorded judgement, spreadsheet overrides, inconsistent boundaries and evidence that is produced only after the fact.

Assurance risk arises when the organisation cannot show a complete impact universe, the role of Sector Standards, the sources used to identify impacts, significance criteria, how stakeholder evidence informed judgement, why thresholds were selected and who approved the final material topics. A matrix without the underlying evidence trail is rarely sufficient.

Disclosures 2-1 to 2-5 cannot use reasons for omission. Common issues include inconsistency between legal entities and the sustainability boundary, unexplained departures from financial consolidation, reporting-period mismatch, undocumented restatements and assurance wording that is broader than the practitioner’s report. Worker and governance disclosures also create cross-system definition challenges.

Generic policy descriptions are not enough. The evidence map should cover actual and potential impacts, policies or commitments, actions, tracking effectiveness, stakeholder engagement and how lessons are incorporated. Effectiveness claims need outcome evidence or careful limitation wording. Activities such as training delivered or audits performed do not by themselves prove that impacts improved.

Common findings concern reporting boundary, definitions, units, factor source, estimation, completeness, changes in methodology, base-year recalculation, inconsistent comparatives and lack of reconciliation to operational or financial systems. For value-chain metrics, the provider will often challenge supplier data quality, sampling and extrapolation.

A dry review should occur while there is still time to change the report and strengthen evidence. Test a representative mix of high-risk quantitative metrics, narrative management disclosures, estimates, group components and web references. Findings should be recorded with severity, affected disclosure, criterion, evidence gap, owner, due date and accepted resolution.

Not every issue requires more text. The correct remedy may be to improve a control, correct a number, narrow a claim, disclose a limitation, revise a boundary, add a reason for omission, or remove unsupported wording. The reporting lead should maintain a single finding log so that the practitioner, data owners, editor and final approver work from the same status.

ISSA 5000 requires written representations on matters such as management’s responsibility for preparing the sustainability information, providing all relevant information and access, uncorrected misstatements, assumptions, control deficiencies, fraud or non-compliance and subsequent events, as applicable. Representations are dated as near as practicable to the assurance report.

The final report should make it easy to identify what was assured, against which criteria, at what level and for which period. Disclosure 2-5 should link to the assurance report and describe the provider relationship. The report design should not separate a reassuring assurance badge from the scope limitation or imply that unaudited narrative is covered.

Figure 2. Illustrative ten-week assurance-readiness plan.

The readiness team first removes the ambiguous phrase “assurance over the sustainability report” from the draft. It creates a metric-level scope table, reconciles employee data to the HR consolidation boundary, documents the market- and location-based Scope 2 methods, tests waste contractor evidence and separates cash contributions from programme outcomes. A dry review finds that two community metrics were based on project-team estimates with no retained support. Management either obtains evidence or removes the metrics from the assured scope and explains the limitation.

At publication, the report links to the practitioner’s conclusion, identifies the selected information and limited-assurance level, and makes clear that the materiality process and other narrative disclosures were not included. The project also creates a Year 2 plan to expand assurance only after GRI 3-3 evidence and value-chain controls mature.

After publication, convert the finding log into the next reporting-cycle control plan. Track recurring issues by disclosure, root cause and owner; retain the final evidence pack; and decide whether assurance scope should expand, remain stable or narrow. A mature assurance programme grows with the reliability of the reporting system, not with the ambition of the report design.

The assurance provider may perform some readiness work where the applicable ethical and independence requirements permit it and the work does not create an unmanaged self-review or other threat. Define the services and roles before appointment, assess safeguards and keep management responsible for decisions, evidence and preparation.

Management representations support an assurance engagement but do not replace underlying evidence, data controls or remediation. They should confirm management responsibility, completeness, methods, assumptions and known limitations, while unresolved evidence gaps remain findings that can affect the engagement scope or conclusion.