1. The Shift from ISAE 3000/3410 to IAASB ISSA 5000
In 2024, the International Auditing and Assurance Standards Board (IAASB) approved International Standard on Sustainability Assurance (ISSA) 5000 (General Requirements for Sustainability Assurance Engagements), establishing a comprehensive global assurance standard alongside ISAE 3410 (Assurance Engagements on Greenhouse Gas Statements) and ISO 14064-3:2019.
Under EU CSRD (Directive (EU) 2022/2464), mandatory sustainability reporting starts with Limited Assurance and is structured to transition toward Reasonable Assurance as assurance standards mature.
2. Limited Assurance vs. Reasonable Assurance Testing Depth
Understanding how an external practitioner's procedures change between Limited and Reasonable Assurance allows internal controllers to right-size their evidence repositories before fieldwork begins:
| Assurance Dimension | Limited Assurance Engagement | Reasonable Assurance Engagement |
|---|---|---|
| Conclusion Form | Negative form ("Nothing has come to our attention that causes us to believe...") | Positive opinion ("In our opinion, the GHG statement is prepared, in all material respects...") |
| Internal Control Testing (COSO ICSR) | Inquiry and walkthrough of data collection processes and IT system boundaries | Design, implementation, and operating effectiveness testing of automated and manual controls |
| Substantive Evidence Sampling | Analytical procedures (year-over-year and intensity plausibility) + targeted invoice spot checks | Statistical sample testing of source invoices, meter calibration logs, and ERP reconciliations |
| Estimation Uncertainty (Scope 3) | Review of methodology appropriateness and factor provenance documentation | Rigorous challenge of management assumptions, sensitivity ranges, and supplier DQR scores |
3. Five Internal Controls Required Under COSO ICSR (2023)
Applying the COSO Internal Control over Sustainability Reporting (ICSR) framework requires establishing five auditable control gates prior to external verification:
- Organizational Boundary Completeness Reconciliation: Reconcile the facility and subsidiary roster against the audited financial statement consolidation perimeter and commercial lease registry.
- Billing Period Gap & Overlap Detection: Programmatically verify that every utility meter has 365 days of coverage (or documented estimation methodology for unbilled Stub Days at year-end).
- Locked Emission Factor Snapshot: Prevent retroactive modification of historical factor libraries by pinning each reporting period to an immutable
calculation_versionand factor dataset ID. - Segregation of Duties (Maker-Checker-Approver): Require independent review between the site analyst entering activity data and the corporate sustainability controller approving the ledger.
- Audit Trail Immutability: Retain timestamped change logs for every manual adjustment, unit conversion, and estimation override.
Geographic & Regulatory Applicability (UK / EU / US / UAE): IAASB ISSA 5000 and COSO ICSR govern assurance readiness across EU CSRD statutory audits, UK FRC sustainability assurance, US AICPA AT-C 205/210 attestation, and UAE Federal Decree-Law No. 11 of 2024 MRV verification. Controllers can verify deterministic calculation snapshots in our Corporate GHG Screening Calculator under Methodology v1.0.0 and evaluate audit-grade ESG reporting platforms with COSO ICSR controls.