Do You Need Reasonable Assurance for Sustainability Data?

A guide to assurance levels in Sustainability.

As sustainability reporting moves from a voluntary to a regulated, audited discipline, one question companies may ask is: do you actually need reasonable assurance for sustainability data, or is limited assurance enough? This article dives into this topic and gives advice to Issuers. 

Reasonable assurance vs limited assurance: what's the difference?

The two assurance levels differ in the level of confidence a reader can take from the report.

Reasonable assurance is the equivalent of a financial audit opinion. The assurance provider gathers sufficient, appropriate evidence and issues a positive conclusion — a statement that the sustainability information is, in all material respects, fairly presented. It involves deeper testing, larger samples, site visits, and scrutiny of the systems and controls behind the data. Coverage typically reaches 80–90% of the relevant information.

Limited assurance is a lower level of confidence delivered through a negative conclusion: “nothing has come to our attention that causes us to believe the information is materially misstated.” Practitioners perform fewer procedures and gather less evidence, focusing on analytical review and enquiry rather than detailed substantive testing.

In short, reasonable assurance includes everything limited assurance does, and then goes considerably further at meaningfully higher cost and effort.

What happened to reasonable assurance under CSRD and the Omnibus?

The original EU Corporate Sustainability Reporting Directive (CSRD) set a clear trajectory: companies would begin with limited assurance and, over roughly four years, transition to mandatory reasonable assurance e.g. the same level of rigour applied to financial statements.

That changed with the EU's Omnibus simplification package. After months of negotiation, the EU finalised the Omnibus Directive in December 2025, and the Council of the European Union formally adopted it in February 2026. The Omnibus removed the obligation to transition to reasonable assurance. The European Commission will adopt limited assurance standards by 1 July 2027, and the directive confirms there will be no automatic move to reasonable assurance. In practice, CSRD reporting will stay at the limited assurance level indefinitely, unless a future review revisits the question.

Reasonable assurance under CSRD is now a choice, not a requirement. 

EFRAG's expectations on assurance under CSRD

EFRAG, the body that drafts the European Sustainability Reporting Standards (ESRS), delivered its final technical advice to the Commission on 3 December 2025 as part of the simplification effort. The headline outcome was a dramatic reduction in mandatory datapoints showing a cut by roughly 60% from over a thousand to a few hundred with an aim to make reporting and its assurance more manageable.

EFRAG sets the reporting standards rather than the assurance standard itself, but its direction of travel reinforces the Omnibus message: keep the assurance burden proportionate. With limited assurance as the baseline and a leaner ESRS dataset, EFRAG's expectation is that companies build robust, auditable data processes now, so that limited assurance is achievable and reasonable assurance remains within reach for those who want it.

What does IFRS say about reasonable assurance: ISSA 5000

Outside the EU, the assurance conversation is anchored by the International Standard on Sustainability Assurance (ISSA) 5000, approved in 2024 and effective for periods beginning on or after 15 December 2026 (early adoption permitted).

ISSA 5000 is framework-neutral: it can be applied to information prepared under the IFRS Sustainability Disclosure Standards (ISSB's IFRS S1 and S2), ESRS, GRI and others. It explicitly accommodates both limited and reasonable assurance, and works with single and double materiality.

The ISSB standards themselves don't mandate reasonable assurance, but national regulators adopting IFRS S1/S2 could choose to mandate it. ISSA 5000 gives assurers a common, audit-grade playbook for when reasonable assurance is sought. Some jurisdictions go further: California's SB 253 requires limited assurance on Scope 1 and 2 emissions from 2026 and reasonable assurance from 2030. 

3 companies that chose reasonable assurance

A growing number of companies obtain reasonable assurance on all or part of their data:

1. Schneider Electric: applies limited assurance across its sustainability indicators but elevated a limited number of key metrics: “a “reasonable” level of assurance for strategic indicators (ZeroCO2 sites, Energy consumption, Scopes 1 and 2 CO2 emissions).” See their 2025 report here. 

2. Infosys — obtained reasonable assurance over its BRSR Core indicators for the year ended 31 March 2025, in line with India's SEBI requirements. See their 2025 report here. (Appendix I indicators listed on PDF page 139 - report page 170)

3. Apple — has a limited number of Environmental indicators independently verified by Bureau Veritas with a positive conclusion that the data is “materially correct and a fair representation,” reflecting an audit-grade approach. The indicators included are: “Energy: Direct (Million Therms) and Indirect (Million kilowatt hours (mkWh)) • Renewable Energy (mkWh) • Water Withdrawal (Million Gallons) • Greenhouse Gas (GHG) Emissions: Direct Scope 1 emissions by weight, Indirect Scope 2 emissions by weight (Metric Tonnes of Carbon Dioxide equivalent) • Paper Quantities (Metric Tonnes) See their 2025 report here. 

How common is reasonable assurance — and is it worth it?

Reasonable assurance remains the exception, not the rule. Limited assurance is firmly the norm: around 88% of FTSE 100 companies that obtain ESG assurance do so solely at the limited level. Reasonable assurance tends to come from the most mature reporters, from companies in regulated regimes (India's BRSR Core, California's SB 253), or on a handful of high-priority metrics rather than the whole report.

Compliance: For most CSRD reporters, limited assurance now satisfies the law. Reasonable assurance is mandatory only in specific regimes or for specific KPIs.

Cost and time: Reasonable assurance is substantially more expensive and time-consuming. It demands extensive testing, site visits, sampling and stronger internal controls which sits closer to a financial audit than a review. Limited assurance is lighter, faster and cheaper.

Why do it: Higher credibility with investors, stronger defence against greenwashing claims, better internal data discipline, and readiness for future regulation.

Why wait: The cost and effort can outweigh the benefit if your data systems aren't mature, if regulation doesn't require it, and if stakeholders are satisfied with limited assurance.

Do you need reasonable assurance?

For most companies, the answer is no. If you are in the EU you could consider it for a limited number of sub-indicators but not your entire sustainability disclosure. Monitor local jurisdiction rules e.g California, India, that may require it for a small number of metrics.