Ir al foco de la divulgación

Biblioteca de divulgacionesGuía práctica para cada divulgación de los informes

GRI 2: General Disclosures·Disclosure GRI 2-5

External assurance

Guía práctica para preparar esta divulgación. Use esta ficha para identificar la información a preparar, verificar afirmaciones y organizar la evidencia de soporte. Para los requisitos exactos, consulte siempre la fuente oficial de GRI.

Pasaporte publicado

Última revisión el 2026-07-18
RK Revisado por Dr Ross KurinkoLinkedIn Strategic ESG Advisor · IFRS S1 & S2 / GRI / ESRS expert GRI Certified Global Trainer · PhD, University of Cambridge · ESG-AI expert 15+ years on FTSE 100 & Fortune Global 500 disclosures Canary Wharf, London Material formativo de LRA · No emitido ni avalado por GRI

Norma

GRI 2: General Disclosures

Disclosure GRI 2-5

En vigor

2023-01-01

Fuente oficial: Abrir ↗

Última revisión

2026-07-18

Material formativo de LRA · No emitido ni avalado por GRI

Foco de la divulgación

GRI 2-5 always requires an organisation to describe its policy and practice for seeking external assurance, including whether and how the highest governance body and senior executives are involved. This applies even when the organisation did not obtain external assurance for the reporting period; a separate written ‘External Assurance Policy’ is not required if the actual policy and practice are explained clearly.

If the sustainability reporting has been externally assured, the organisation must also link or refer to the assurance report, describe what was assured and on what basis, and explain its relationship with the assurance provider. The basis includes the exact assurance standards used, the level of assurance obtained, and any limitations of the assurance process.

External assurance is encouraged by GRI but is not mandatory for reporting in accordance with the GRI Standards. Disclosure 2-5 itself is mandatory for an in-accordance claim. Reasons for omission are not permitted for this disclosure.

Do not describe every external check as assurance. A certification, consultancy review, independent data check, audit-support exercise, or agreed-upon procedures engagement is assurance only when an independent, competent provider issues a formal assurance conclusion or opinion; agreed-upon procedures report findings rather than an assurance conclusion.

The seven datapoints below are LRA’s operational decomposition of one unconditional requirement and three conditional elements. They are not seven separate GRI requirements, and ‘Assurance limits’ sits within the description of assured content and basis under 2-5-b-ii.

Este material formativo de LRA apoya la preparación de la divulgación. Para los requisitos exactos, consulte siempre la fuente oficial de GRI.

Antes de empezar

Antes de empezar

Una breve lista de comprobación antes de preparar esta divulgación: marque cada punto a medida que lo resuelva.

Preparación

Información clave que preparar

Campo de preparación Qué recopilar Pista de evidencia Responsable
Assurance policy and practice The organisation’s actual policy and practice for seeking external assurance, whether or not assurance was obtained. A separate written policy is not required. Assurance policy, reporting governance papers, board or executive committee minutes, internal approval notes. Sustainability reporting / Governance
Governance involvement in assurance Whether and how the highest governance body and senior executives are involved in the policy and practice for seeking external assurance. Board and executive committee packs, assurance planning papers, sign-off records, governance calendar. Sustainability reporting / Governance
Assurance report link The web link or document reference for each external assurance report or assurance statement covering the sustainability report, where assurance has been obtained. Published report archive, investor relations site, assurance provider deliverables, document register. Sustainability reporting / Investor relations
Assured content and basis Exactly what sustainability information was assured and the basis of assurance, including the exact assurance standards used. A brief referral is sufficient where the linked assurance report contains the detail. Assurance statement, scope letter, engagement terms, provider report, reporting controls file. Sustainability reporting / External assurance
Assurance level obtained The level of assurance the external reviewer gave for the sustainability reporting, stated clearly and consistently with the assurance statement. Assurance statement, provider opinion letter, final report issued by the assurance firm. Sustainability reporting / External assurance
Assurance limits Any stated constraints, exclusions, or caveats in the external assurance process that affect what was checked or how far the work went. Assurance statement, management representation letter, engagement scope, issue log from the assurance process. Sustainability reporting / External assurance
Assurer relationship A short description of the organisation’s relationship with the assurance provider, including anything relevant to independence, prior work, or other ties. Assurance engagement letter, procurement records, independence declarations, conflict checks, provider profile. Procurement / Legal / External assurance
+ Mostrar los subelementos de GRI 2-5 (lista de trabajo de LRA)

Cómo prepararlo

Document the organisation’s actual policy and practice for seeking external assurance. Record whether and how the highest governance body and senior executives are involved, even if no assurance was obtained this period.
Confirm whether the engagement is genuinely external assurance: look for a formal signed conclusion or opinion from an independent, competent provider. Do not relabel certification, consultancy, independent checks, or agreed-upon procedures as assurance.
For every assurance engagement, map the exact report version and assured content to the signed statement. Keep separate engagements separate where scopes, standards, levels, or providers differ.
Capture the exact assurance standards used, the level of assurance obtained, and all stated limitations, exclusions, sampling boundaries, sites, or topic-specific differences. If the linked assurance report contains this fully, a brief referral can be sufficient.
Describe the relationship with the assurance provider, including appointment, independence, conflicts, and any other services. GRI guidance also encourages accessible information on responsibilities, the work performed, the signed conclusion, and provider competence.
Before publishing, reconcile the disclosure, content index, public link, and final signed statement. Confirm that the provider was independent and competent, applied quality controls, and issued a public conclusion, then check the official GRI source.

Solicitar los datos

Request the assurance pack and sign-off details

Traduzca la divulgación a una pregunta de negocio interna y adáptela después al lenguaje propio de su organización.

What is our policy and practice for seeking external assurance, how are the highest governance body and senior executives involved, and did any provider issue a formal assurance conclusion for this reporting period?

Use the organisation’s operational language when collecting evidence, but do not map a review, certification, consultancy assignment, independent check, audit support, or agreed-upon procedures engagement to ‘external assurance’ unless an independent, competent provider issued a formal assurance conclusion or opinion.

Solicitud débil

Can you send the external assurance info for the sustainability report?

Por qué falla: It is too vague to tell the owner which documents, dates, scope, review basis, governance involvement, or relationship details are needed. It also uses framework language without telling the team how to answer in their own operational terms.

Solicitud mejor

Please confirm our policy and practice for seeking external assurance and how the highest governance body and senior executives are involved. For each current-period assurance engagement, send the final signed statement, exact assured content, standards and criteria, level of assurance obtained, limitations, final report version, and provider independence and other-services records. If no assurance was obtained, describe the review frequency, decision criteria, plans, and governance involvement.

Plantilla de correo formal
Subject: Request for sustainability reporting external assurance details for [reporting period]

Hello [name/team],

We are preparing GRI 2-5 for [reporting period]. Please confirm our current policy and practice for seeking external assurance, its review frequency and criteria, and whether and how the highest governance body and senior executives are involved.

If external assurance was obtained, please send the final signed assurance report and confirm:
- the exact publication version and information assured
- the assurance standards and criteria used
- the level of assurance obtained
- all limitations, exclusions, sampling boundaries, and mixed levels
- the provider’s appointment, independence, conflicts, and any other services

If no external assurance was obtained, please confirm that and describe the decision approach, review frequency, criteria, future plans, and governance involvement. An internal decision record is useful evidence but is not itself a GRI requirement.

Please distinguish assurance from certification, consultancy, independent checks, and agreed-upon procedures. A possible LRA training template is attached; adapt it to your organisation and check the official source before sign-off.

Many thanks,
[preparer name]
[team]
[contact details]
Versión corta para Teams / Slack
Hi [name] — for [reporting period], please confirm our policy and practice for seeking external assurance and whether/how the highest governance body and senior executives are involved. If assurance was obtained, send each final signed statement with its exact scope, standards, level, limitations, report version, and provider independence/other-services record. If none was obtained, describe the annual decision approach, criteria, and plans. Thanks.

Ejemplos sectoriales

Manufacturing

Contexto. The sustainability report includes site-level environmental metrics and a small number of social indicators covered by an external assurance conclusion.

Solicitud adaptada. Please share the external assurance pack for [reporting period]: the final signed assurance statement, exact site metrics and sections assured, standards and criteria, level of assurance obtained, limitations by plant or data stream, governance involvement, and provider independence and other services. If no assurance was obtained, describe the annual decision approach, criteria, and plans.

Ejemplo de respuesta. Attached are the signed limited assurance statement, scope schedule for energy, water, waste, and workforce safety metrics, exact assurance standards and criteria, site-sampling limitations, the Audit Committee paper, independence declaration, and other-services record.

Financial services

Contexto. The organisation publishes an annual ESG section within the annual report and obtains external assurance on selected metrics and narrative claims.

Solicitud adaptada. Please send the assurance pack for [reporting period] covering the ESG section: the signed assurance statement, exact sections and metrics assured, standards and criteria, level of assurance obtained, limitations, governance involvement, and provider independence and other services. Keep any agreed-upon procedures engagement separate because it does not provide an assurance conclusion.

Ejemplo de respuesta. The pack includes the signed limited assurance statement, scope schedule for climate and conduct metrics, exact ISAE standards and criteria, exclusion of forward-looking statements, the Board Risk Committee paper, independence declaration, and a separate record of advisory services.

Redacte su divulgación

Notas que convierten los datos en una divulgación

Plantillas formativas de LRA: adáptelas a su organización y consulte la fuente oficial antes de la aprobación.

Nota metodológica

Describe the organisation’s policy and practice for seeking external assurance and whether and how the highest governance body and senior executives are involved. If assurance was obtained, refer to each signed assurance report and state the exact assured content, standards used, level of assurance obtained, limitations, and provider relationship.

Nota de contexto

Make the boundary of each assurance claim unmistakable. Explain whether the statement covers the full report or selected information, keep separate engagements distinct, and state provider independence and relevant other services consistently with the signed report and engagement records.

Declaración sobre las variaciones

Where the assurance approach changed, explain any change in governance involvement, assured content, standards, level, limitations, provider, or report version. Do not imply that assurance is mandatory under the GRI Standards.

Entrada del índice de contenidos

GRI 2-5 External assurance — [location / page] / [notes]

Centro de descargas

Herramientas y formularios de preparación

Herramientas profesionales de preparación para GRI 2-5 — gratuitas con la membresía de LRA Community. Regístrese una vez (es gratis) y se desbloquean todas las descargas, junto con la Biblioteca de divulgaciones, las plantillas y el asistente de IA de LRA.

Gratis · Miembros de la Community

Preparación para el aseguramiento

Para cada afirmación, compruebe la evidencia

Afirmación Riesgos Evidencia que comprobar
The policy and practice described are the organisation’s actual current approach, whether or not assurance was obtained.Boilerplate implies a standing assurance programme that does not exist, or silence is treated as acceptable because no assurance was obtained.Documented practice, reporting calendar, decision criteria, and current-period governance papers
The disclosure accurately says whether and how the highest governance body and senior executives are involved.Generic references to directors or management hide the actual governance route or incorrectly imply involvement.Board or committee papers, minutes, executive approvals, and reporting governance terms of reference
Every claimed assurance engagement is supported by a formal signed assurance conclusion or opinion.A certification, consultancy review, independent check, or agreed-upon procedures report is incorrectly presented as assurance.Final signed assurance report and engagement letter
The published description matches the statement’s exact scope, standards, assurance level, limitations, and report version.The page overstates coverage, merges separate engagements, substitutes vague terminology, or links to a mismatched version.Signed report, scope schedule, standards and criteria, final publication, and version approval
The relationship with the provider is transparent and consistent with independence records.Relevant non-assurance services, conflicts, or provider involvement in preparing the assured information are omitted.Independence declarations, conflict checks, procurement file, and non-assurance services record

Paquete de evidencia que preparar

Carencias habituales en los informes

Treating 2-5 as not applicable because no external assurance was obtained, instead of describing the policy, practice, and governance involvement.
Calling an independent check, certification, consultancy review, or agreed-upon procedures engagement ‘assurance’ without a formal assurance conclusion or opinion.
Saying the whole sustainability report was assured when the statement covers only selected disclosures, indicators, sites, or entities.
Using vague terms such as ‘verified’, ‘checked’, ‘reviewed’, ‘level of confidence’, or ‘level of review reached’ instead of the statement’s assurance terminology.
Naming a framework generally but not the exact assurance standards used.
Omitting the level of assurance obtained or merging limited and reasonable assurance into one description.
Leaving out limitations, exclusions, sampling boundaries, or mixed assurance levels that appear in the signed statement.
Linking to a draft, prior-period, or different report version from the one covered by the assurance statement.
Failing to describe the relationship with the provider, including independence and relevant other services.
Merging separate engagements with different providers, scopes, standards, or levels into one assurance claim.

Carencias habituales

Errores que evitar al recopilar los datos

Starting only when assurance existsThe team treats 2-5-a as conditional and prepares nothing when no external assurance was obtained, even though policy, practice, and governance involvement must still be described.
Misclassifying the engagementA certification, consultancy review, independent check, internal audit, or agreed-upon procedures report is labelled assurance without a formal independent assurance conclusion.
Using a generic governance labelThe draft refers to ‘directors’ or ‘management’ but does not say whether and how the highest governance body and senior executives are involved.
+ Mostrar 5 más

Dónde suele hacer falta juicio profesional

Exact scope differs from the report headlineState precisely which disclosures, metrics, entities, sites, or report sections were assured; do not let ‘externally assured report’ imply broader coverage than the statement.
Statement covers a different period or versionConfirm that the signed conclusion covers the final published report and reporting period. Explain any genuine version link rather than silently reusing an earlier statement.
Limited and reasonable assurance both applyIdentify which information received limited assurance and which received reasonable assurance. Never combine them into one overall level.
+ Mostrar 3 más

Ejemplos

Ejemplos ilustrativos

Sintéticos, redactados por LRA: no proceden del informe de ninguna empresa ni del texto de ninguna norma.

Illustrative (synthetic) example — assurance obtained

Our policy is to assess annually whether external assurance would strengthen the credibility of our sustainability reporting. The Audit Committee approves the assurance plan, and senior executives confirm readiness, scope, and responses to findings. For 2025, selected greenhouse gas, water, and workforce disclosures were externally assured; the signed statement is linked in the report annex. The provider performed the engagement under ISAE 3000 (Revised), and ISAE 3410 for greenhouse gas information, and issued a limited assurance conclusion. The statement identifies the selected disclosures, sampling approach, sites not visited, and exclusion of forward-looking information. The provider was appointed through procurement, did not prepare the assured information, confirmed its independence from the organisation, and its other services are described in the assurance statement.

Synthetic example for practitioner learning only. It uses the exact standards and ‘limited assurance conclusion’, keeps scope and limitations visible, and describes the provider relationship and independence.

Illustrative (synthetic) example — no assurance obtained

Our policy is to review annually whether to seek external assurance. The Audit Committee considers the recommendation, and senior executives assess reporting readiness, regulatory requirements, and stakeholder expectations. We did not obtain external assurance for the 2025 sustainability reporting. We will reassess the decision for the next reporting cycle using the same criteria and our planned improvements to reporting controls.

Synthetic example for practitioner learning only. GRI 2-5-a still applies when no external assurance was obtained; the disclosure describes the decision approach, review frequency, criteria, plans, and governance involvement without presenting an internal decision record as a GRI requirement.

Informes de empresas

Cómo informan las empresas sobre GRI 2-5 en la práctica

Ejemplos de práctica de reporte completa y parcial. Son análisis basados en evidencia, no plantillas exactas para copiar.

Informes reales publicados
Zydus Lifesciences Limited
Pharmaceuticals / Biotech / Life Sciences · India · 2025
Abrir el informe →
Zydus publishes two separate Intertek limited assurance statements: selected ESG disclosures on pages 142–143 under ISAE 3000 (Revised), and selected Scope 3 categories on pages 144–146 under ISAE 3000 (Revised) and ISAE 3410. They state scope, criteria, methodology, limitations, conclusions, competence, and independence. The remaining GRI 2-5 gap is a clear description of the organisation’s policy and practice for seeking assurance and whether and how the highest governance body and senior executives are involved.
Interconexión Eléctrica S.A. E.S.P.
Electric Utilities / IPP / Energy Traders · Colombia · 2024
Abrir el informe →
ISA’s report profile on page 9 identifies KPMG, the assurance basis, and the annexed independent report; the GRI index on page 131 supports navigation. The signed memo on pages 150–153 provides limited assurance, covered disclosures, ISAE 3000 and ISAE 3410 basis, limitations, independence, and responsibilities. Board certification of material topics is governance context, not a complete description of the policy and practice for seeking assurance or of highest-governance-body and senior-executive involvement under GRI 2-5-a.
Chang Hwa Commercial Bank, Ltd.
Banks / Diverse Financials / Insurance · Taiwan · 2024
Abrir el informe →
CHB’s external assurance overview on page 189 separates BSI’s AA1000AS v3 work from EY’s ISAE 3000 engagement and states the respective scopes and assurance levels. The signed BSI statement on page 190 provides scope, methodology, sampling, moderate assurance opinion, responsibilities, competence, and independence; the EY statement follows on page 191. The policy and practice for seeking assurance and whether and how the highest governance body and senior executives are involved still require separate confirmation.

Comparar en paralelo →

✓ Asistente de IA de LRA · Con supervisión humana
Dr Ross Kurinko

Pregunte al asistente de IA de Study Studio sobre esta divulgación

Obtenga respuestas prácticas para su contexto de reporte. Las dos primeras respuestas son gratuitas: únase gratis a LRA Community para continuar sin límite.

Pruebe ¿Cómo preparo GRI 2-5? ¿Qué datos necesito recopilar? ¿Dónde puedo ver un ejemplo de un informe real? ¿Qué errores debo evitar?
2 respuestas gratis

Compruebe su comprensión

Escenarios para trabajar

An organisation did not obtain external assurance this year. Its policy is reviewed annually; the Audit Committee considers the recommendation, and senior executives assess readiness, regulatory requirements, and stakeholder expectations.

PCan the organisation omit GRI 2-5 or use a reason for omission?
Mostrar la respuesta modelo →

A provider performed agreed-upon procedures under ISRS 4400 and reported factual findings, but issued no assurance conclusion or opinion.

PMay the organisation call the sustainability information externally assured?
Mostrar la respuesta modelo →

One signed statement provides limited assurance under ISAE 3000 (Revised) for selected ESG disclosures, while a second provides reasonable assurance under a different standard for a narrower regulatory dataset.

PHow should the organisation describe the assurance basis and level?
Mostrar la respuesta modelo →

The assurance provider was appointed through procurement, did not prepare the assured information, confirmed independence from the organisation, and also supplied a separate controls advisory service.

PWhat relationship information belongs in the disclosure?
Mostrar la respuesta modelo →

Referencias del marco

Requisitos aplicables de GRI y divulgaciones relacionadas

Referencias disponibles del marco y divulgaciones cercanas relevantes para preparar este requisito.

GRI

GRI 2-5

dentro de GRI 2: General Disclosures

Abrir la fuente oficial →

Relacionado y explorar

Más en GRI 2 → Ver el catálogo completo → Inicio de la Biblioteca de divulgaciones → Buscar en todas las divulgaciones →

Preguntas frecuentes

Preguntas que responde esta página

For GRI 2-5 General Disclosures, what data do I need to gather before I start drafting the assurance disclosure?+
How do I use the step-by-step ‘how to prepare’ section for GRI 2-5 in practice?+
What should I ask the assurance owner or audit contact for when preparing GRI 2-5?+
How do I decide who owns the GRI 2-5 assurance disclosure data in my organisation?+
What evidence pack do I need to make a GRI 2-5 assurance disclosure assurance-ready?+
How do the assurance claims to verify help me check my GRI 2-5 draft?+
What are the common reporting gaps or mistakes to avoid in a GRI 2-5 assurance disclosure?+
How can I turn the GRI 2-5 page into a first draft for the annual report?+
What should I include in the GRI 2-5 narrative if I want it to be assurance-ready?+
How do I use the Prep & Assurance workbook for GRI 2-5?+
What is the printable Library Card for GRI 2-5 and when should I use it?+

Más preguntas con las que puede ayudar esta página

Profundizar · GRI 2-5

Aprenda a preparar esta divulgación de principio a fin

This guide covers one disclosure. The GRI Standards Certified Training — taken as a bundle with an ESRS course — walks the full workflow: datapoints, evidence, drafting and assurance, with exercises on your own data.

Available as Guided Flex, Live Cohort, 1:1 Expert Mentorship or Corporate Programme.

Explore GRI training (ESRS bundle) →
Cómo se construye esta biblioteca 312 informes publicados indexados 63 171 páginas con citas a nivel de página 272 fichas de divulgación creadas por profesionales
/es/knowledge-hub/disclosure-cards/gri-2-5/