Limited Assurance on Selected GRI Indicators vs Assurance of the Whole Report

Working edition · 1 August 2026

Assurance is often purchased incrementally: greenhouse-gas emissions, energy, workforce numbers or a small set of priority indicators may be covered first. The risk appears later, when a cover page, website banner, tender answer or board paper compresses the conclusion into a broader phrase such as “externally assured GRI report”. A reader can reasonably understand that phrase to mean that the whole reporting package has been tested.

The assurance statement, engagement terms and public explanation must describe the same subject matter. A logo beside the report title, an assurance badge or a general sentence in the chair's statement cannot extend the practitioner's conclusion. The organisation remains responsible for the unassured information, its Content Index and its GRI statement of use.

Describe the organisation's policy and practice for seeking external assurance, including whether and how the highest governance body and senior executives are involved.

Where sustainability reporting has been externally assured, provide a link or reference to the assurance report or statement.

Describe what was assured and on what basis, including the assurance standards used, the level obtained and any limitations of the assurance process.

Describe the relationship between the organisation and the assurance provider.

GRI guidance also points to accessible information about scope, responsibilities, the signed conclusion, work performed and the provider's experience and qualifications.

External assurance is not a condition for reporting in accordance with the GRI Standards. GRI encourages it as one way to enhance credibility.

Assurance on one indicator does not verify the organisation's complete compliance with the GRI reporting requirements.

A review of the Content Index is not automatically assurance of the data or narrative to which the index points.

Limited assurance is not “light certification”. It is a defined assurance level with procedures and a conclusion that differ from reasonable assurance.

The provider's work does not remove management's responsibility for preparing the sustainability information and maintaining appropriate controls.

Figure 1. A selected-indicator engagement and a whole-report engagement have different subject matter, criteria, boundaries and conclusions.

ISSA 5000 addresses both limited and reasonable assurance and permits an engagement to cover all sustainability information or only part of it. Under the standard, limited-assurance procedures vary in nature and timing and are less extensive than procedures for reasonable assurance. The limited conclusion is expressed in a form that conveys whether anything has come to the practitioner's attention to cause the practitioner to believe the information is materially misstated. A reasonable-assurance opinion is expressed positively.

Using “assured report” in the title while the assurance statement covers only a handful of indicators.

Listing GRI disclosure numbers without identifying the individual requirements, methodologies or geographic coverage included.

Failing to distinguish limited and reasonable assurance or mixed levels across different indicators.

Omitting the assurance provider's limitations, qualifications or scope constraints from the organisation's summary.

Describing a provider's review of the Content Index as external assurance of the underlying information.

Allowing press releases, tenders or websites to use broader language than the report itself.

Treating the assurance engagement as a substitute for management controls, data-owner confirmation or board challenge.