Assurance

“Assurance can strengthen confidence in a defined statement; it cannot make the undefined true. ”

Assurance is often presented as the final stamp on sustainability information. A report carries an external conclusion, the logo of a respected firm appears beside the metrics, and readers assume that the organisation's sustainability performance has been confirmed. That interpretation usually exceeds what the engagement was designed to do.

Assurance is a structured relationship among subject matter, criteria, evidence, practitioner and intended users. The practitioner performs procedures and expresses a conclusion about whether defined information has been prepared in accordance with suitable criteria. Confidence increases within that boundary. Anything outside the subject matter, period, criteria or level of assurance remains outside the conclusion.

The boundary can be narrow.

An organisation may obtain assurance over selected greenhouse-gas metrics while biodiversity, labour conditions, value-chain estimates and marketing claims remain unassured. Even within an assured metric, some locations or categories may be excluded. A prominent assurance statement can create a whole-report halo unless the scope is easy for readers to understand. Limited and reasonable assurance are also different.

Limited assurance involves procedures designed to reduce engagement risk to a level that supports a negative-form conclusion, while reasonable assurance requires more extensive work to reduce risk to an acceptably low level and support a positive-form conclusion. Neither provides absolute certainty. The difference is not simply the wording of the report; it affects planning, evidence and work effort.

The International Auditing and Assurance Standards Board issued ISSA 5000 in 2024 as a global standard for sustainability assurance engagements across sustainability topics, reporting frameworks and practitioner backgrounds. It addresses both limited and reasonable assurance and becomes effective for periods beginning on or after 15 December 2026, with early application permitted.

The standard strengthens consistency, but it does not remove the need for suitable criteria, competent practitioners, independence and reliable underlying systems. Criteria are fundamental. An assurance practitioner cannot repair a vague claim by testing it carefully. If 'nature positive' has no defined boundary, baseline, timeframe or method, there may be no suitable basis for a meaningful conclusion.

Assurance over the calculation does not establish that the concept itself is appropriate, nor that the strategy will create the promised outcome. Evidence depends on internal controls. A company can commission independent assurance while its supplier data remain incomplete, estimates are manually adjusted and documentation is assembled shortly before reporting.

The practitioner may modify the conclusion, limit the scope or perform additional procedures, but assurance cannot substitute indefinitely for governance and systems capable of producing reliable information throughout the year. Independence protects the conclusion from conflicts of interest, yet independence is not the same as infallibility.

Practitioners make professional judgements about materiality, risk, sampling and evidence. Different engagement scopes can produce different levels of comfort. Transparency about assumptions and limitations is therefore part of assurance quality, not a sign that the work failed. Assurance should also be distinguished from neighbouring terms.

Verification and validation evaluate claims against specified requirements, often concerning historical or future information. Certification attests conformity of a product, process, service or management system within a scheme. Audit is a method or engagement type. Assurance is the broader confidence-enhancing purpose, defined by the exact engagement rather than by a generic badge.

The critical literature on the 'audit society' offers a useful warning. Independent checking can become ritual when organisations optimise what can be inspected while more consequential questions remain outside scope.

Assurance is valuable when it directs attention to material risk and improves information systems. It is weaker when the engagement is chosen primarily because it certifies the easiest part of the story. For practitioners, the discipline is to read the assurance conclusion backwards. What information was covered? Against which criteria? At what level? For which period and entities?

What was excluded, estimated or modified? Only then should the conclusion shape a decision or claim. Assurance is strongest when its limits are visible enough to prevent confidence from spreading beyond the evidence.

Practical application

Define intended users, subject matter, criteria, boundary and level of assurance before selecting the practitioner. Map data sources and controls early, include value-chain information in risk assessment where material, and resolve whether public claims fall inside or outside the engagement. Present the conclusion beside a plain-language scope statement.

Track findings to control improvements rather than treating the report as the endpoint. Review whether excluded information could create a misleading whole-report impression.

Why it matters

Sustainability information increasingly influences capital, procurement, regulation and public trust. High-quality assurance can improve reliability and discipline, but misplaced reliance on an unclear scope can create confidence precisely where none was provided.

Common misconception

An assured report is often assumed to mean that the organisation's sustainability performance, strategy and claims have been approved. Assurance applies only to the defined information, criteria, period and level stated in the engagement report.

Connections

Verification and Validation concern defined claims. Audit describes examination. Certification and Accreditation operate within conformity-assessment systems. Evidence and Data Quality support the engagement, while Substantiation and Burden of Proof determine whether public wording is justified.

A question worth asking

What does your assurance conclusion actually cover, and what might a reasonable reader incorrectly assume it covers?

Selected references

International Auditing and Assurance Standards Board. 2024. ISSA 5000: General Requirements for Sustainability Assurance Engagements. International Ethics Standards Board for Accountants. 2025. International Ethics Standards for Sustainability Assurance, Including International Independence Standards. International Organization for Standardization. ISO/IEC 17029:2019.

Conformity Assessment - General Principles and Requirements for Validation and Verification Bodies. Power, M. 1997. The Audit Society: Rituals of Verification. International Federation of Accountants. 2024. The State of Play: Sustainability Disclosure and Assurance.