CSRD Assurance Requirements: Limited vs Reasonable Assurance and the Mistakes Auditors and Issuers Make

EU law requires limited assurance on sustainability reporting: an opinion "based on a limited assurance engagement" under Article 34 of the Accounting Directive. Omnibus I removed the plan to move to reasonable assurance and gave the Commission until 1 July 2027 to adopt EU limited assurance standards. Until then, national standards may apply. The statutory auditor gives the opinion by default. Member States may open the work to other auditors or to accredited independent assurance services providers. Auditors approved before 1 January 2026 must first build sustainability knowledge through continuing professional education.

Limited and reasonable assurance compared

The EU texts use the two terms without defining the difference in procedures; that will come with the limited assurance standards. The base does set out how each stands legally:

Omnibus I recital 4 records the background: undertakings had raised concerns about assurance providers' work and asked for flexibility on specific risks. The Commission is asked to take those concerns into account when drafting the standards.

Scope of the opinion: more than the numbers

• compliance with the Accounting Directive and the ESRS;
• the process carried out to identify the information reported, in practice the double materiality assessment;
• compliance with the marking-up requirement in Article 29d, which only bites once marking-up rules have been adopted in Delegated Regulation (EU) 2019/815;
• compliance with EU Taxonomy Article 8 reporting.

Separately, the financial statement auditor's opinion on the management report expressly excludes the Article 19a sustainability reporting requirements. The two engagements are distinct, even when the same firm performs both. Member States may require the assurance report to appear as a separate section of the audit report where the same statutory auditor does both (Audit Directive, Article 28a(5)).

Who may sign the assurance report

Where an audit firm provides the assurance, it must designate at least one key sustainability partner who is approved as a statutory auditor in that Member State (Audit Directive, Article 24b). The signing statutory auditor signs and dates the assurance report. Where more than one firm is engaged, they issue a joint report, or set out any disagreement in separate paragraphs (Article 28a). Sanctions can include a temporary ban of up to three years on the auditor, firm or key sustainability partner carrying out sustainability assurance or signing assurance reports (Article 30a).

Qualifying as a sustainability assurance auditor

1. New auditors: the professional exam must also test sustainability reporting standards, sustainability analysis, due diligence and assurance standards (Article 8(3)). At least eight months of the minimum three years' practical training must be spent on sustainability assurance or related services (Article 10(1)).
2. Approved before 1 January 2024: not subject to those additional requirements (Article 14a).
3. In the approval process on 1 January 2024: likewise exempt, provided the process was completed by 1 January 2026.
4. Approved before 1 January 2026 and wishing to do sustainability assurance: must acquire the necessary knowledge, including the Article 8(3) subjects, through continuing education (Article 14a, third paragraph).

IASPs accredited before 1 January 2024, or completing an accreditation under way on that date by 1 January 2026, are exempt from the training and examination requirements. They too must acquire the knowledge through continuing education.

Responsibilities on the issuer's side

The board, not the assurance provider, answers for the sustainability statement. Under Article 33 of the Accounting Directive, members of the administrative, management and supervisory bodies are collectively responsible for ensuring that the management report is drawn up and published in accordance with the directive, the ESRS and the electronic format rules of Article 29d. Member States may relieve them of collective responsibility for the Article 29d format. National liability rules apply, at least towards the undertaking, for breaches of these duties.

For public-interest entities, the CSRD also amended Regulation (EU) No 537/2014. Assurance of sustainability reporting does not need audit committee approval as a non-audit service. It is excluded from the limits set in Article 4(2) of that Regulation. And preparing sustainability reporting is a prohibited non-audit service for the statutory auditor. Under Article 5 of the CSRD, the Audit Directive amendments apply to financial years starting on or after 1 January 2024.

1. Confirm which Member State options apply: another auditor, IASPs, national standards.
2. Check that the engagement partner meets the Article 14a conditions, including continuing education where needed.
3. Agree the scope in writing, covering the materiality process, Taxonomy disclosures and marking-up.
4. Align your supplier data requests with the value-chain cap before the assurance provider tests them.

Common mistakes, and how to avoid them

• Scoping a reasonable assurance engagement "to be ready". The current texts do not provide for reasonable assurance. Agree the limited assurance basis and the applicable national standard.
• Treating materiality as out of scope. The opinion covers the process used to identify reported information.
• Appointing an IASP in a Member State that has not opted in, or assuming a cross-border IASP may act before 6 January 2027.
• Overlooking the continuing education condition for experienced financial auditors approved before 2026.
• Forgetting the group auditor's role. For consolidated sustainability reporting, the group auditor bears full responsibility and must evaluate and review component providers' work, including third-country auditors (Article 27a).
• For UK companies listed on an EU regulated market: sustainability assurance reports by third-country auditors not registered in that Member State have no legal effect there. A simplified transitional registration applies to reports for financial years starting from 1 January 2025 to 31 December 2030 (Audit Directive, Article 45(5b)).

The base covers EU directives only and says nothing about UK audit regulation. To check a scenario, ask the CSRD & ESRS knowledge base, for example: "Can someone other than our statutory auditor sign off on our sustainability report?" Answers cite the consolidated Audit Directive and Omnibus I.

This article reflects the EU texts indexed on 5 October 2026 and is not legal or audit advice. Member State options decide several of the points above.