Frameworks

Limited Assurance for CSRD: What Issuers Need to Know Now (and What the 2026 Consultation Changes)

What CSRD limited assurance means now: the CEAOB's ISSA 5000-based advice, what auditors will test, and how to respond to the EU consultation.

Julianne Flesher

CEO & Co-Founder

November 13, 2026

Limited Assurance for CSRD: What Issuers Need to Know Now (and What the 2026 Consultation Changes)

Introduction

The European Commission opened a targeted consultation on the limited assurance standard for sustainability reporting on 12 November 2026. Responses are due by 18 January 2027, and the Commission has until 1 July 2027 to adopt the final standard as a delegated act.

The draft builds on technical advice from the Committee of European Auditing Oversight Bodies (CEAOB), adopted on 25 September 2026. The CEAOB took the IAASB's ISSA 5000 as its starting point and adjusted it where EU law requires. For companies reporting under CSRD, the advice is useful well beyond the consultation. It sets out, paragraph by paragraph, the procedures your assurance provider is expected to follow and the wording of the conclusion you will receive.

Below we summarise what the advice means for issuers today, then look at what the Commission is asking and where preparers may want to respond.

In brief

The Omnibus I Directive ((EU) 2026/470) fixed limited assurance as the required level and dropped the planned move to reasonable assurance.
The EU standard will be based on ISSA 5000, with carve-outs and additions for the EU legal framework.
Providers will issue one conclusion covering three things: fair presentation under the ESRS (including the double materiality process), EU Taxonomy Article 8 disclosures and the ESEF mark-up.
The CEAOB proposes that the standard apply to reporting periods beginning on or after 15 December 2027, which for calendar-year companies means FY2028. Earlier application would be allowed.
The consultation asks preparers about scope, the Taxonomy and tagging procedures, and the effective date.

What limited assurance means under CSRD

In a limited assurance engagement, the assurance provider reports whether anything has come to their attention to suggest the sustainability statement is materially misstated. This is a negative-form conclusion. A financial statement audit, by contrast, gives reasonable assurance and a positive opinion that the accounts present fairly.

The CEAOB keeps ISSA 5000's wording on the difference: limited assurance procedures "vary in nature and timing from, and are less in extent than" those for reasonable assurance (paragraph 9 T). In practice, providers rely more on inquiry and analytical review, and do less detailed testing of controls and transactions.

	Limited assurance (CSRD)	Reasonable assurance (financial audit)
Form of conclusion	Negative: nothing has come to our attention	Positive: presents fairly, in all material respects
Typical procedures	Inquiry, analytical review and testing targeted at assessed risks	Extensive testing of controls and details
Status under CSRD	Required, and confirmed as the long-term level by Omnibus I	No longer planned for sustainability reporting
Provider	Statutory auditors, or independent assurance services providers where the Member State allows	Statutory auditors

All undertakings required to report under the ESRS (as revised in 2026) must have that reporting assured. The engagement covers everything the entity reports under the ESRS, not a selection of KPIs (paragraph 5 M).

Current guidance: the CEAOB technical advice

The Commission asked the CEAOB for advice on 27 January 2026. The resulting document reproduces ISSA 5000 (November 2024 version) alongside the CEAOB's changes. New paragraphs are labelled "ADD", modified ones "M", and carve-outs "not applicable". Until the delegated act is adopted, it is the most detailed indication of what the EU standard will require. The points below are the ones most likely to affect preparers.

Applicable criteria: the ESRS and the EU Taxonomy

The criteria are defined as all provisions of the ESRS and the Taxonomy Regulation (paragraph 18.12 ADD). The ESRS are treated as a fair presentation framework and the Taxonomy as a compliance framework. Because the criteria are set in EU law, the practitioner does not have to assess whether they are suitable (paragraph 107 ADD). References to the ESRS or the Taxonomy in the statement need no further evaluation (paragraph 162 ADD).

The double materiality process is in scope

The ESRS part of the conclusion covers the process the entity used to identify the information it reports (paragraph 190 M). Providers must understand that process as part of the entity's information system (paragraph A384 ADD). Expect to be asked for documentation of how the assessment was carried out, not just its results.

Fair presentation and the stand-back review

Once the practitioner has assessed and responded to risks across the ESRS requirements, they consider the statement as a whole. The question is whether its presentation, structure and content fairly represent the company's sustainability matters (paragraphs 181 to 183). A statement can meet every disclosure requirement and still fall short here if it is hard to follow or unbalanced.

EU Taxonomy disclosures and digital tagging

The advice adds two areas that ISSA 5000 does not cover. For Article 8 Taxonomy disclosures, the application material lists procedures such as checking the reporting templates, eligibility and alignment conditions and technical screening criteria, recalculating KPIs, and reconciling them to the financial statements (paragraph A427 ADD).

For the ESEF mark-up, once tagging of sustainability statements applies, the practitioner will look at the tagging process and related controls. They will then test completeness, accuracy and machine readability (paragraphs 177.1 to 177.13 ADD).

The form of the conclusion

There will be a single limited assurance conclusion, but it answers three questions separately. Has anything come to the practitioner's attention to suggest that:

the sustainability information is not fairly presented under the ESRS;
the Taxonomy disclosures are not prepared in accordance with the Taxonomy Regulation; or
the mark-up does not comply with the ESEF Regulation?

The heading is "Limited Assurance Conclusion", with "Qualified", "Adverse" or "Disclaimer of" added if the conclusion is modified (paragraph 190 M). Where national law permits and the same firm audits the accounts, the report can appear as a separate section of the audit report (paragraph A537 ADD).

CSRD limited assurance conclusion covering ESRS fair presentation, EU Taxonomy Article 8 disclosures and ESEF mark-up

Coordination with the statutory auditor

The assurance provider must communicate with the statutory auditor during the engagement and before either report is signed. The discussion covers risks and misstatements affecting the link between the financial statements and the sustainability statement (paragraph 68 ADD). This still applies when the same firm runs both engagements under different partners.

Third-party reports, voluntary information and dual-standard reports

Where EU law requires a report from an accredited independent third party, the provider uses it as evidence rather than redoing the work. They first check the third party's accreditation and the scope of its report (paragraphs 55.1 to 55.3 ADD).

Voluntary information in the sustainability statement is assured against the relevant ESRS requirements. Requirements from other frameworks, such as GRI or the ISSB standards, fall outside the EU engagement, and the assurance report may say so (paragraphs A20 and A551 ADD).

A company may ask for an engagement under both the EU standard and another standard, for instance ISAE 3000 for US investors. In that case all EU requirements still apply, and any wording the other standard requires goes in a separate, clearly titled section of the report (paragraphs 197.1 and 197.2 ADD).

Joint assurance and file closure

The advice adds provisions for joint assurance by more than one provider (paragraph 18.31 ADD). It also requires the engagement file to be closed within 60 days of the report date (paragraph 72 ADD), which has knock-on effects for the year-end timetable.

Until the delegated act applies, engagements continue under national requirements. Many providers have already moved their methodologies towards ISSA 5000, so it is worth asking yours how closely their current approach matches the CEAOB advice.

CSRD limited assurance readiness checklist

The checklist below is a practical way to test whether your reporting process would hold up in an engagement run on the CEAOB approach.

Double materiality and scope

☐ DMA methodology documented, including thresholds, scoring, stakeholder engagement, value chain coverage and approval
☐ Each material impact, risk and opportunity traceable to the disclosures it gives rise to
☐ Reporting boundary and consolidation scope reconciled to the financial statements

Data and controls

☐ Owner, definition and calculation method recorded for every material metric
☐ Key controls over sustainability data identified and evidenced, including review and approval
☐ Estimates, assumptions and external data sources documented, with limitations disclosed

EU Taxonomy and digital reporting

☐ Eligibility and alignment assessments supported against the technical screening criteria and DNSH conditions
☐ Turnover, CapEx and OpEx KPIs reconciled to the accounts
☐ ESEF tagging process, tools and review controls in place before the mark-up requirement applies

Governance and coordination

☐ Reporting timetable aligned with the statutory audit, with time built in for the auditor and assurance provider to communicate
☐ Audit committee briefed on the three-part conclusion and the consequences of a modified conclusion
☐ Voluntary content (GRI, ISSB, TCFD) clearly labelled and kept separate from ESRS disclosures
☐ Accredited third-party verification reports collected and checked for scope
☐ Any need for a dual-standard report (for example, ISAE 3000) agreed with your provider early

The Commission's consultation on the EU limited assurance standard

The consultation, announced on 12 November 2026, is designed to test how the CEAOB-based standard would work in practice. The legal basis is Article 26a(3) of the Audit Directive, as amended by Omnibus I, which requires the delegated act by 1 July 2027.

The Commission is clear that it is not reopening the requirement for assurance, the choice of limited over reasonable assurance, or the content of the ESRS. The questionnaire has 12 questions across five areas, followed by open fields for other comments.

Area	Questions	Topics covered
Applicable criteria	Q1	Using the ESRS and the Taxonomy as criteria without a suitability assessment
Scope of the engagement	Q2 to Q8.2	The fair presentation stand-back review; other information; accredited third-party reports; voluntary information; Taxonomy and ESEF procedures; which ISSA 5000 paragraphs should apply in the EU
Conclusion and reporting	Q9, Q10	The three-part conclusion, including the DMA process; reports issued under the EU standard and another standard
Market readiness	Q11	Whether the standard should be mandatory from financial years beginning 1 January 2027, 1 January 2028, or later
Other issues	Open fields	DMA process versus outcome; coordination with the statutory auditor; proportionality and cost; limited versus reasonable work effort; report content; definitions

Most questions ask respondents to rate the proposal on a four-point scale, from "appropriate as proposed" to "not appropriate". Each has space to explain the reasoning, cite paragraphs and suggest drafting changes.

EU limited assurance standard consultation: five question areas, responses due 18 January 2027

What the consultation means for issuers

Preparers have a direct interest in several of the questions. The most relevant are Q6 on Taxonomy procedures, Q7 on the mark-up, Q9 on how the conclusion covers the double materiality process, and Q11 on the effective date.

Timeline

27 January 2026: the Commission requests technical advice from the CEAOB.
25 September 2026: the CEAOB adopts its advice, which reaches the Commission on 30 September.
12 November 2026: the consultation opens.
18 January 2027: the consultation closes. Only responses submitted through the online questionnaire will be considered.
1 July 2027: deadline for the Commission to adopt the delegated act.
Reporting periods beginning on or after 15 December 2027: proposed date for mandatory application, depending on the outcome of Q11. Earlier voluntary application would be permitted.

Where preparers' input is most useful

On the effective date (Q11), the Commission asks how long methodology changes, training and systems work will take. Preparers can add their own view, including whether voluntary early adoption would help avoid a change of approach partway through a reporting cycle.

On the Taxonomy and tagging procedures (Q6 and Q7), practical experience counts most. Examples include the difficulty of reconciling Taxonomy KPIs to the accounts, and how ready your tagging processes and tools are.

On the double materiality assessment (Q9, and the open field on process versus outcome), companies can comment on how far providers should test the process behind materiality decisions, as opposed to the disclosures that result.

On cost and proportionality, figures on current fees, internal effort and any duplication from dual-standard engagements will carry weight. If you report under GRI or the ISSB standards alongside the ESRS, Q5 asks whether the proposed treatment of voluntary information is workable.

Responding

The Commission says the most useful responses explain their reasoning and support it with data, examples and paragraph references. You can answer only the questions relevant to you. It is worth agreeing key messages with your assurance provider, audit committee and industry association beforehand. Responses may be published, depending on the privacy option you choose in the questionnaire.

Preparing for the standard

Test your most recent sustainability statement against the three parts of the conclusion.
Close any gaps in your double materiality documentation before the FY2026 year-end.
Agree with your statutory auditor and assurance provider how and when they will communicate.
Build Taxonomy reconciliations and ESEF tagging into the close calendar.
Watch for differences between the final delegated act and the CEAOB draft, especially on timing.

Frequently asked questions about CSRD limited assurance

Will CSRD move to reasonable assurance?

No. Omnibus I confirmed limited assurance as the required level and removed the option of moving to reasonable assurance later.

Which standard will assurance providers use?

A Commission delegated act based on ISSA 5000, with the EU-specific changes set out in the CEAOB technical advice. The Commission must adopt it by 1 July 2027.

When will the EU limited assurance standard apply?

The CEAOB proposes reporting periods beginning on or after 15 December 2027, with earlier application allowed. The consultation asks whether it should start in 2027, 2028 or later.

Does limited assurance cover the double materiality assessment?

Yes. The ESRS part of the conclusion includes the process the company used to identify the information it reports.

Is EU Taxonomy reporting assured?

Yes. The Article 8 Taxonomy disclosures are covered by a separate part of the conclusion, as is the ESEF mark-up of the sustainability statement.

Are GRI or ISSB disclosures in the sustainability statement assured?

Voluntary information is assured against the relevant ESRS requirements. Requirements from other frameworks are outside the EU engagement, and the report may say so.