Limited assurance under CSRD: who checks your sustainability statement, and what they ask for

CSRD limited assurance is now a permanent fixture: every sustainability statement filed under the EU’s Corporate Sustainability Reporting Directive (CSRD) is checked by an external provider who signs a published opinion on it. This guide explains how CSRD limited assurance works in practice: who performs the engagement, the standard it runs under, and what evidence they ask for.

Your sustainability statement gets a signed opinion

If your company reports under the Corporate Sustainability Reporting Directive (CSRD), your sustainability statement does not just get published. It gets checked, and the person who checks it signs a formal written conclusion that is published too.

The mechanics sit in the EU audit rules that the CSRD amended. The assurance provider must present their results in a written “assurance report on sustainability reporting” that identifies your company, the statement and period covered, and the reporting framework you applied. That report is published alongside your annual report, next to the audit opinion on your accounts.

In plain terms: your sustainability disclosures now carry the same basic structure of accountability as your financial statements. Someone outside the company reads what you wrote, tests it against evidence, and puts their name to a public conclusion. Your finance colleagues have worked this way for as long as anyone can remember. For most sustainability teams, it is new.

CSRD assurance is limited, not reasonable, and now permanent

Assurance comes in two depths, and the difference matters for how much evidence you need ready.

A limited assurance engagement checks process and coherence: could this figure, as presented, be materially wrong? The practitioner does not rebuild your number or re-run your models. A reasonable assurance engagement digs into the individual claims behind each figure: is the register complete, are the values accurate, does the calculation do what it says it does.

The CSRD requires limited assurance. The original directive also set a path to escalate to reasonable assurance later, once the Commission assessed whether the market could handle it. That path is now closed. The Omnibus directive, Directive (EU) 2026/470, in force since 18 March 2026, states the intent plainly:

“To avoid an increase in the costs of assurance for undertakings, the requirement to adopt reasonable assurance standards should be removed.”

In plain terms: limited assurance is not a phase you pass through on the way to a full audit. It is the permanent depth of the check. That holds compliance costs down, but it does not shrink what you have to be able to show. A limited review still requires documented processes and a trail from each disclosed figure back to its source. It changes how deeply the assurer digs, not whether they dig. For how the two depths differ procedure by procedure under the international standard, see our guide to presenting physical climate risk data for assurance.

What the engagement does	Limited assurance (what CSRD requires)	Reasonable assurance
What it checks	Process and coherence: could this figure, as presented, be materially wrong?	The individual claims behind each figure: is the register complete, are the values accurate, does the calculation do what it says?
Rebuilds your numbers?	No. The practitioner does not rebuild your number or re-run your models.	Yes. It digs into the individual claims behind each figure.
Evidence you must have ready	Documented processes and a trail from each disclosed figure back to its source.	Deeper testing of the completeness and accuracy behind each figure.
Status under CSRD	Required, and permanent since the Omnibus, Directive (EU) 2026/470.	Escalation removed; no longer on the CSRD path.

A statutory auditor or accredited provider performs the engagement

The default answer is: your statutory auditor. The audit rules as amended by the CSRD require Member States to have statutory auditors and audit firms carry out the assurance of sustainability reporting. In practice that means the engagement is done either by the firm that already audits your accounts or by another audit firm you appoint for sustainability only.

There is a second option. Member States may allow an “independent assurance services provider”, an accredited firm that is not an audit firm, to give the opinion instead. The directive only permits this where the provider is subject to requirements equivalent to those for auditors: training and examination, continuing education, quality assurance systems, investigations and sanctions. Where such a provider signs the opinion, your audit committee still reviews and monitors their independence. Whether this route exists for you depends on the Member State you file in.

In plain terms: whoever signs, they come from the audit world or are regulated to its standard. That shapes their expectations. They will think in terms of controls, documentation, and traceability, because that is what their own regulator holds them to.

No EU assurance standard exists yet, so national rules apply

Here is the part of the regime that surprises most preparers: the EU standard the engagement is supposed to run under has not been adopted yet.

The audit rules, in the article the CSRD added on assurance standards (Article 26a of the EU audit directive), tell the Commission to adopt limited assurance standards by delegated act. The original deadline was 1 October 2026; the Omnibus directive moved it:

“To allow adequate time to develop the limited assurance standards, the deadline for their adoption should be postponed to 1 July 2027.”

Until those standards arrive, the same article says Member States may apply national assurance standards, procedures or requirements, notified to the Commission. So the standard your engagement runs under today is set at national level, and can differ between the country where you file and the country where a peer files.

Two things keep that gap from being chaos. First, the CSRD’s recitals point to the Committee of European Auditing Oversight Bodies (CEAOB), the EU’s committee of national audit regulators, to issue non-binding guidelines on limited assurance to keep practice consistent until the EU standard arrives. Second, practice has somewhere to converge: the international standard built to become the common baseline is ISSA 5000, the International Standard on Sustainability Assurance. It comes from the International Auditing and Assurance Standards Board (IAASB), the body that writes the standards auditors work to. The IAASB approved ISSA 5000 in September 2024; it takes effect for assurance of information covering periods beginning on or after 15 December 2026, with earlier application permitted.

In plain terms: if you ask your assurer “what standard are you applying?”, the answer in 2026 is a national one, shaped by international sustainability assurance practice, and from mid-2027 it should become a single EU standard.

Assurers challenge your materiality process before your numbers

There is now real evidence of what assurance providers challenge, and it is not what most teams expect.

In October 2025, the European Securities and Markets Authority (ESMA), the EU regulator that coordinates national enforcement of company reporting, published a fact-finding review of 91 issuers’ first CSRD sustainability statements across 23 Member States. Every issuer in the sample was subject to assurance, almost all at the limited level. Nearly all received clean conclusions. The exceptions cluster in one place:

“A qualified opinion was delivered for two issuers of the sample reporting under CSRD and ESRS. The opinions pointed at significant omissions in the sustainability statement, including in relation to the materiality assessment for one of the issuers.”

Four further issuers received unqualified opinions in which the assurer nonetheless stressed materiality considerations as an “emphasis of matter”, including one flagging that a supply-chain materiality assessment stopped at tier 1.

In plain terms: the opinions that went wrong in year one went wrong on the materiality process, the reasoning by which a company decided what to report at all, not on the arithmetic of a disclosed metric. Your assurer’s first question is not “is your flood number right?” It is “show me how you decided flood risk was, or was not, material.” For climate that question carries extra weight, because the reporting standards treat climate as the one topic you must explain in detail if you conclude it is not material. How that materiality assessment works for physical risk is its own subject; we cover it in double materiality for physical risk.

Each physical-risk number needs an evidence trail an assurer can follow

When climate is material, the disclosure with the sharpest evidence question is the anticipated-financial-effects requirement. In the European Sustainability Reporting Standards (ESRS), the detailed rulebook the CSRD requires companies to report under, the requirement as adopted in 2023 is numbered E1-9; the November 2025 amended draft, not yet adopted, renumbers and expands it as E1-11. This piece covers its physical-risk side only; the same requirement also has a transition-risk side, which is out of scope here.

Under E1-9 (2023 issuance), the physical-risk disclosure is four numbers, each with a natural evidence trail an assurer can follow:

1. The monetary amount and percentage of assets at material physical risk, before counting adaptation actions, split into acute risks (storms, floods) and chronic risks (sea level rise, sustained heat). The asset values must reconcile to the fixed-asset figures in your financial statements. The risk designation must trace to an identifiable assessment of which assets face which hazards. In practice this is the hardest of the four to assemble. Fixed-asset registers hold values by legal entity and asset class, not by site, so allocating a value to each location is usually the largest piece of data work behind the disclosure. The allocation method itself becomes part of the evidence trail.
2. The proportion of those assets addressed by adaptation actions. This needs a record linking specific adaptation measures to specific assets. A percentage with no underlying register is exactly the kind of figure a limited review flags as incoherent.
3. The location of significant assets at material physical risk. This needs a site list. You cannot locate what you have not mapped, and address registers pulled from company systems are rarely clean. In real portfolios a meaningful share of addresses fail to resolve to usable coordinates until the register itself is cleaned, and that cleaning is part of the evidence too.
4. The monetary amount and percentage of net revenue at material physical risk. This ties back to your revenue and segment accounting.

Each disclosed figure is, in effect, the visible end of a chain: asset locations, hazard data at those locations, exposure assessment, financial mapping. A limited assurance review asks whether that chain exists, whether it is documented, and whether the figure could be materially wrong given how it was built. The ESRS reinforces this by requiring you to disclose the methodology and assumptions behind the numbers.

Timing matters here. Wave 1 reporters, those already filing, were allowed to defer these quantitative disclosures and must first report them for financial year 2027, filed in 2028, if they remain in scope after the Omnibus threshold change. Wave 2 reporters start with financial year 2027 as well. So the first assured physical-risk numbers land in the same reporting cycle for both groups, and the data work behind them is happening now. For the paragraph-level walk of the requirement across both versions of the standard, see ESRS E1-9 anticipated financial effects from physical risk.

This is where the assurance question becomes a data-sourcing question. If a provider supplies your physical-risk assessment, their outputs become part of your evidence chain, and your assurer can ask how those outputs were produced. Continuuiti’s asset-level assessments are built for that question: named public datasets, documented methodology, stated model limitations, scenario and horizon choices recorded per assessment. Outputs carry a method version and are preserved as delivered, so an assurer can compare the figures a company used against the record of what was supplied. We do not certify compliance with any assurance standard; no data provider can. What we supply is the part of the chain an assurer can test.

One link no provider can supply: the record of how the assessment outputs became your disclosed amounts. That mapping, from provider figures to filed figures, is a document only your team can write, and it is the one assurers most often find missing. What to put in front of them, item by item, is covered in the assurance evidence-pack guide.

Disclosed figure (ESRS E1-9)	What it is	Evidence the assurer follows	Reconciles to
Assets at material physical risk	The monetary amount and percentage of assets at material physical risk, before adaptation, split into acute and chronic risks.	An identifiable assessment of which assets face which hazards, plus the method used to allocate a value to each location.	The fixed-asset figures in your financial statements.
Adaptation coverage	The proportion of those assets addressed by adaptation actions.	A record linking specific adaptation measures to specific assets.	The adaptation-action register.
Location of significant assets	The location of significant assets at material physical risk.	A cleaned site list; addresses often fail to resolve to usable coordinates until the register is cleaned.	Your address and site register.
Net revenue at risk	The monetary amount and percentage of net revenue at material physical risk.	The mapping from business activities back to the revenue figure.	Your revenue and segment accounting.

Mandatory limited assurance now, an EU standard by 2027

• Now: sustainability statements filed under CSRD carry mandatory limited assurance, performed under national standards.
• 18 March 2026: Omnibus directive in force. Reasonable-assurance escalation removed; limited assurance is permanent.
• Financial year 2027: post-Omnibus scope applies (net turnover above EUR 450 million and more than 1,000 employees). First year Wave 1 must quantify E1-9 physical-risk financial effects; first reporting year for Wave 2.
• 1 July 2027: deadline for the Commission to adopt EU limited-assurance standards, replacing national ones.

Frequently asked questions

Who audits a CSRD sustainability report?

Strictly, nobody audits it; it receives limited assurance, which is a lighter engagement than an audit. The work is done by a statutory auditor or audit firm, or, in Member States that allow it, by an accredited independent assurance services provider regulated to equivalent requirements.

Will CSRD assurance escalate to reasonable assurance later?

No. The original CSRD kept that possibility open, but Directive (EU) 2026/470 removed the requirement to adopt reasonable assurance standards. Limited assurance is the permanent level.

What standard does the assurer apply today?

A national assurance standard, because the EU-level limited-assurance standards are not yet adopted; the Commission’s deadline is 1 July 2027. The international reference point is ISSA 5000, the IAASB’s sustainability assurance standard, built as the common global baseline for these engagements.

Does the assurer check my climate risk numbers?

At limited depth they check process and coherence rather than systematically rebuilding your figures: whether a documented chain runs from hazard data and asset locations to the disclosed amounts, and whether the materiality reasoning behind the disclosure holds up. They may still sample individual figures and trace them back to source, so the chain has to be real, not just described. In the first year of CSRD opinions, the findings assurers raised most were about materiality assessments, not metric arithmetic.

Sources

• Directive (EU) 2022/2464 (CSRD), amending Directive 2006/43/EC (Articles 26a, 28a) and Directive 2013/34/EU (Article 34). EUR-Lex CELEX: 32022R2464.
• Directive (EU) 2026/470 (Omnibus I), Official Journal 26 February 2026.
• ESMA, Materiality matters (!) fact-finding on FY2024 sustainability statements, ESMA32-846262651-5288, 14 October 2025.
• Commission Delegated Regulation (EU) 2023/2772 (ESRS Set 1), ESRS E1-9 paragraphs 64 and 66. EUR-Lex CELEX: 32023R2772.
• Commission Delegated Act C(2025) 4812 (Wave 1 “Quick Fix”), 11 July 2025.
• IAASB, International Standard on Sustainability Assurance (ISSA) 5000, General Requirements for Sustainability Assurance Engagements, approved September 2024.