CSRD assurance is not optional, not deferrable, and not something you can handle internally. Independent third-party verification of your sustainability report is a hard legal requirement — and the audit market for it is already severely capacity-constrained. This guide tells you exactly what to do and when.
What is CSRD assurance and why is it required?
CSRD requires all in-scope companies to obtain independent assurance over their sustainability reports. This is modelled on financial audit assurance — an independent third party reviews your sustainability data, processes and disclosures and provides a formal opinion on whether they are materially correct and complete.
Assurance exists because the EU's Green Deal depends on reliable ESG data for capital allocation decisions. Without independent verification, sustainability reports are marketing documents. With it, they become credible inputs to investment, lending, procurement and regulatory decisions.
Limited assurance (now)
- ▸Required from first CSRD reporting year
- ▸Lower level of scrutiny than reasonable assurance
- ▸Assurer concludes nothing has come to their attention
- ▸Negative assurance — 'we found no material errors'
- ▸Less extensive procedures — analytical review + inquiry
- ▸Comparable to a financial statement review engagement
Reasonable assurance (from 2028)
- ▸Higher level — equivalent to full financial audit
- ▸Positive assurance — 'in our opinion, this is correct'
- ▸Extensive testing of data, systems and controls
- ▸Requires auditable data trail from source to report
- ▸Significantly more expensive and time-intensive
- ▸Commission to set standards by July 2027
⚠ Important
The capacity crisis is real
The Big Four and major mid-tier audit firms have limited CSRD assurance capacity. Wave 1 companies in 2025 have already consumed most available slots. Companies that have not begun engaging an assurance provider by Q3 2026 for FY2027 reporting risk not finding qualified capacity — which means filing unverified reports and triggering regulatory action.
Who can provide CSRD assurance?
Under CSRD, sustainability assurance can be provided by two types of providers. First, statutory auditors — the same firms that audit your financial statements (Big Four, mid-tier audit firms). They are already licensed and familiar with your business. Second, independent assurance service providers (IASPs) — specialist ESG assurance firms that are not statutory auditors but are licensed to provide sustainability assurance. Member states decide whether to allow IASPs.
Option 1Easy
Your financial auditor
Advantages: knows your business, one engagement, simplified coordination. Risk: limited ESG expertise at smaller firms, potential independence conflicts if they also advise on CSRD preparation.
Option 2Medium
Big Four ESG assurance
Deloitte, PwC, EY, KPMG all have dedicated sustainability assurance practices. Deep expertise but premium pricing and severe capacity constraints for non-existing clients.
Option 3Easy
Mid-tier audit firms
Grant Thornton, BDO, Mazars and others have rapidly built CSRD assurance capacity. Often more accessible than Big Four and well-suited for mid-market companies.
Option 4Medium
Specialist IASPs
Specialist firms like Bureau Veritas, SGS, TÜV SÜD. Strong technical ESG expertise. Availability depends on member state IASP licensing decisions. Check national rules.
What assurers actually check
Understanding what your assurance provider will scrutinise helps you prepare. Limited assurance for CSRD involves three main areas of inquiry — each requiring specific evidence from your organisation.
Data and calculations
- ▸Source data for all quantitative disclosures (GHG, energy, water, waste)
- ▸Calculation methodology and emission factor sources
- ▸Data aggregation from subsidiaries and business units
- ▸Year-on-year consistency and restatements
- ▸Base year selection and adjustment methodology
- ▸Scope 3 data collection processes and supplier data
Processes and controls
- ▸Internal controls over sustainability data collection
- ▸Governance structures for sustainability oversight
- ▸Double materiality assessment process and documentation
- ▸Stakeholder engagement evidence
- ▸Board approval process for sustainability report
- ▸Consistency between sustainability and financial reports
How much does CSRD assurance cost?
Assurance costs vary significantly based on company size, complexity, number of subsidiaries, and choice of provider. The market is still maturing and pricing is not yet fully standardised. These ranges reflect real market data from Wave 1 engagements in 2024–2025.
€20K
Minimum limited assurance cost (simple structure)
€80K
Typical mid-market limited assurance cost
€250K+
Large complex group limited assurance cost
3×
Estimated cost uplift from limited to reasonable
§ Key fact
Preparation dramatically reduces assurance cost
Companies that arrive at the assurance engagement with auditable data trails, documented methodology, and clean internal controls spend 40–60% less on assurance than companies where the assurer has to reconstruct data and documentation. Every hour your team spends preparing saves three hours of assurance fee.
How to prepare for your CSRD assurance engagement
Assurance readiness is the single biggest lever companies have over their assurance cost and the likelihood of receiving a clean opinion. Start preparation at least 12 months before your first assurance engagement — preferably 18 months for complex groups.
ESRS E1 checklist
0/8 complete
Engage your assurance provider at least 12 months before your first reporting deadline Build a data trail from every quantitative disclosure back to its original source data Document your GHG calculation methodology — emission factors, boundary definitions, exclusions Implement internal controls over sustainability data — segregation, review, approval Document your double materiality assessment process with evidence of stakeholder engagement Ensure board meeting minutes record sustainability report approval and oversight Run an internal pre-assurance review 3 months before the engagement Prepare a data dictionary mapping each ESRS disclosure to its data source, owner and calculation method Independence rules — what your assurer cannot do
CSRD assurance follows the same independence principles as financial audit. Your assurance provider cannot also be your CSRD consultant — they cannot prepare the report they are then asked to verify. This is the most common practical problem companies face: they engage a Big Four firm to help them build their CSRD programme, then discover that same firm cannot provide assurance.
✓ Practical tip
Separate your advisory and assurance providers
If you are using a consulting firm to help prepare your CSRD report, do not use the same firm for assurance. Engage your assurance provider early, separately, and independently. Brief them on your approach so they can flag issues before the assurance engagement begins — not during it.
What happens if your assurance fails?
If your assurance provider cannot issue a clean opinion, they will issue either a qualified opinion (specific issues identified but report is otherwise acceptable) or an adverse opinion (report is materially misstated). Both outcomes have regulatory consequences — they must be disclosed and will draw regulatory attention. Most regulators treat a qualified opinion as a serious compliance failure requiring follow-up.
The most common reasons for qualified opinions in early CSRD assurance engagements are: Scope 3 emissions with insufficient data quality documentation, missing evidence for materiality assessment conclusions, and inconsistencies between sustainability and financial disclosures. All three are preventable with proper preparation.
Free tool
ESGMaster produces audit-ready sustainability data.
Every calculation in ESGMaster is traceable to source data with documented methodology. Your assurance provider gets a complete data trail — reducing your assurance engagement time and cost by up to 60%. Free for 6 months.