For most companies in scope of CSRD, the first limited assurance engagement will be a new kind of experience.
Sustainability reporting has been assured before, of course. Voluntary reports have carried assurance statements for years. But limited assurance under CSRD is different in both substance and scale. It is a regulatory requirement. It is applied to the full sustainability statement, not just a few selected metrics. And it is delivered by a statutory auditor or an independent assurance services provider working to a defined standard.
That shift is significant. Sustainability disclosures are moving from a communications output to an audited corporate report. The evidence, controls, documentation, and governance expected around the sustainability statement now look much closer to what finance teams have lived with for years under financial audit.
For ESG teams preparing for their first limited assurance engagement, the real question is not whether it will happen. The real question is how to prepare in a way that avoids scrambling at the last minute, holds up to scrutiny, and produces a report the business can actually stand behind.
This guide walks through what limited assurance under CSRD involves, how it differs from voluntary assurance, and how to prepare in a practical way.
What limited assurance actually means
Limited assurance and reasonable assurance are two distinct levels of confidence that an assurance provider can give over a set of disclosures.
Reasonable assurance is the higher level. It is what financial statement audits provide. The assurance provider performs enough work to express a positive conclusion that the information is, in all material respects, fairly presented.
Limited assurance is a lower level. The assurance provider performs fewer procedures, mostly focused on inquiries and analytical review, and expresses a conclusion in negative form. In other words, they state that nothing has come to their attention that would cause them to believe the information is materially misstated.
Under CSRD, the starting point is limited assurance over the sustainability statement. The European regulatory framework has indicated that reasonable assurance may come later, once the assurance ecosystem and reporting maturity are more developed. For now, limited assurance is the operative requirement, and it is already a meaningful step up from what most companies have been used to.
Why it is more demanding than it sounds
The phrase "limited assurance" can give a misleading impression. Some teams hear it and assume the engagement will be light-touch. In practice, it is anything but.
A limited assurance engagement on a full CSRD sustainability statement is large in scope. It covers governance, strategy, impact and financial materiality, policies, actions, metrics, targets, and a long list of topical disclosures across environmental, social, and governance areas. The assurance provider will expect to see evidence, documentation, methodology, and controls across all of it.
Even though the level of testing is lower than reasonable assurance, the surface area is much larger than anything most sustainability teams have faced before. That combination is often what makes the first engagement harder than expected. It is not that any single piece is unusually deep. It is that the total amount of structured evidence required, across the full statement, can overwhelm teams that have not prepared in advance.
Start with the materiality assessment
The assurance provider will usually begin with the materiality assessment. Under CSRD and ESRS, materiality is the entry point for the entire sustainability statement, because it determines which matters are disclosed and to what level of detail.
Expect questions on:
- The reporting perimeter used for the assessment
- How double materiality was operationalised in practice
- Stakeholder engagement and internal expertise involved
- Methodology for impact materiality and financial materiality
- Scoring approach, thresholds, and evidence
- Governance, challenge, and sign-off process
- Documentation and rationale for topics judged not material
If the materiality process is shaky, it is difficult for the rest of the sustainability statement to hold up in assurance. This is why well-run CSRD programmes usually treat materiality as a structured, defendable process with proper documentation, rather than a one-off workshop.
Build an evidence file for every disclosure
Assurance is fundamentally about evidence. The sustainability statement sets out what is reported. The evidence file sets out why it is reported that way, where the numbers came from, and how they can be re-performed.
For each material disclosure, the assurance provider will typically want to see:
- The source data and its provenance
- The methodology and calculation logic
- Any assumptions and the rationale for them
- Evidence of review, challenge, and sign-off
- Version control over data and documents
- Mapping to the relevant ESRS disclosure requirement
Companies that try to recreate this evidence at the end of the reporting cycle tend to struggle. Teams that build the evidence file alongside the sustainability statement itself have a much smoother engagement.
A common pattern is to maintain a single, well-organised evidence repository structured by ESRS standard, with cross-references to source systems, responsible owners, and review steps. The format matters less than the discipline of keeping it current.
Get the data architecture right
Most companies going through their first limited assurance engagement quickly discover that their data architecture was not designed for this level of scrutiny.
Typical pain points include:
- Data held across multiple spreadsheets, shared drives, and local files
- Calculation logic embedded in formulas that no one has documented
- Manual adjustments applied without clear traceability
- Inconsistent emission factors or methodology across business units
- Limited ability to re-perform calculations at a later date
- Controls that exist informally but are not documented
Under limited assurance, these gaps become much more visible. The assurance provider will typically want to walk through the end-to-end data flow for key metrics, from source to disclosure. Anything that cannot be re-performed or traced causes friction.
Fixing this does not necessarily mean buying a new sustainability data platform, although many companies do end up moving in that direction. At minimum, it means tightening data ownership, documentation, methodology, and controls around the most material disclosures.
Treat Scope 3 emissions with particular care
Scope 3 disclosure tends to attract some of the most detailed assurance questioning.
That is partly because Scope 3 data is usually the most complex, with the widest variety of methodologies, the most use of secondary data, and the greatest year-on-year variability. It is also because Scope 3 is often where the largest share of the company's carbon footprint sits, which makes it material in nearly every case.
Expect questions on:
- Which Scope 3 categories are covered and why
- Methodology for each category
- Use of primary versus secondary data
- Emission factors and their sources
- Treatment of estimation, interpolation, and gaps
- Year-on-year consistency and any restatements
Companies that treat Scope 3 as a structured, defensible methodology, rather than a best-effort calculation, tend to get through assurance more cleanly. That is a higher bar than some teams are currently working to, but it is where the expectation is heading.
Align governance and sign-off
Limited assurance is not only about data. It is also about governance.
The assurance provider will expect to see how the sustainability statement is reviewed, challenged, and approved internally. That usually includes:
- A defined role for the sustainability team, finance, risk, and legal
- Executive-level review of material disclosures
- Audit committee or equivalent oversight
- Board-level sign-off of the statement
- Clear links to existing reporting governance processes
One pattern that works well is to mirror the governance discipline already applied to financial reporting, rather than inventing a parallel process for sustainability. It tends to produce cleaner documentation, better internal challenge, and more credibility during assurance.
Plan the engagement timeline properly
First-time CSRD assurance engagements usually run longer than teams expect.
A practical timeline often looks like:
- Early scoping conversations with the assurance provider
- Walk-throughs of key processes, data flows, and controls
- Review of the materiality assessment in detail
- Interim testing of selected disclosures on draft data
- Final testing against the completed sustainability statement
- Review of the draft assurance report and management responses
- Finalisation alongside the annual report
Compressing any of these stages creates risk. In particular, teams that try to do all testing at the end, once the statement is finalised, often end up restating disclosures at the last minute, which introduces new review and governance steps and further delays.
Engaging the assurance provider early, even before the statement is drafted, tends to be one of the best investments a first-time CSRD reporter can make.
Common pitfalls to avoid
A few patterns come up repeatedly in first-time limited assurance engagements.
The first is underestimating the scope. Teams often assume limited assurance means selective testing. In practice, the breadth of the sustainability statement means that limited assurance still requires a significant amount of preparation across every material topic.
The second is treating sustainability reporting as a communications output. If the narrative has historically been written to impress rather than to describe, limited assurance is usually where that becomes a problem. Every statement in the sustainability statement is potentially assurable, and teams should be confident that the underlying evidence supports it.
The third is siloed preparation. Assurance-ready reporting requires cross-functional input from sustainability, finance, risk, operations, HR, legal, and IT. Programmes that rely on the sustainability team alone to carry the load almost always run into gaps.
The fourth is leaving transition plan, targets, and scenario analysis to the last minute. These areas tend to attract detailed assurance attention and require careful alignment with strategy, finance, and governance. They are difficult to fix under time pressure.
The fifth is weak documentation of judgements. Limited assurance accepts that sustainability reporting involves estimation and judgement. What it does not accept is judgement without documented rationale. Writing down the reasoning behind material choices is one of the simplest, highest-leverage things a team can do.
What good looks like
A well-prepared first-time limited assurance engagement usually shares a few characteristics.
The materiality assessment is structured, documented, and defensible. The sustainability statement is internally consistent and grounded in evidence. Data flows are traceable from source to disclosure. Scope 3 and other complex metrics are supported by a clear methodology. Governance is aligned with existing financial reporting processes. The evidence file is organised, current, and maintained alongside the statement rather than reconstructed at the end.
When all of that is in place, the assurance engagement becomes a review of a well-run process, rather than a forensic excavation of a rushed report. Conclusions tend to be cleaner, management points tend to be fewer, and the next reporting cycle tends to be easier than the first.
Final thought
Limited assurance under CSRD is a meaningful change. It brings sustainability reporting closer to the discipline of financial reporting, with all the evidence, controls, governance, and documentation that implies.
For ESG teams, that change is an opportunity as well as a challenge. A well-prepared first engagement builds internal capability that pays back across every subsequent reporting cycle. It also produces a sustainability statement the business can stand behind, which is ultimately the point.
The teams that start preparing early, treat evidence and controls as seriously as disclosure content, and build cross-functional discipline around the process tend to come through the first engagement in good shape.
For everyone else, the first limited assurance engagement can be a difficult year. For those who prepare well, it can be the year that sustainability reporting genuinely matures inside the business.