ESG Assurance Readiness: How to Prepare Your Company for Limited Assurance

ESG Assurance Readiness: How to Prepare Your Company for Limited Assurance

ESG reporting has progressed from a voluntary disclosure to a regulated function, to be formally externally verified. Third party sign-off is now becoming a requirement for many companies—as frameworks like the Corporate Sustainability Reporting Directive and new international assurance standards are increasingly requiring it—making the gap between sustainability report prep and assurance a growing business risk. A lot of companies that create polished ESG disclosures find, too late, that their data, controls and documentation are not set up to withstand independent review. This article discusses what ESG assurance readiness entails, how companies can determine where they are on the path, what evidence assurance providers are looking for, and the practical steps required to get ready for a limited assurance engagement, along with a checklist and guidance on timing so that ESG assurance preparation becomes part of the reporting calendar instead of a hectic close. It’s written for sustainability, finance, and internal audit teams that are both tasked with ensuring that ESG data can withstand an independent review, and tasked with providing the necessary clear and concise roadmap to achieve that objective – not by relying on a theory of compliance, but through disciplined ESG data preparation and structured limited assurance preparation. 

What Is ESG Assurance Readiness and Why Does It Matter?

ESG assurance readiness is the state of a company’s sustainability data, governance, and internal controls that are ready to endure independent third-party verification by an external assurance provider. The modernization of the regulatory landscape, including the Corporate Sustainability Reporting Directive (CSRD) and the upcoming International Sustainability Assurance Standard (ISSA 5000), has made it imperative that companies demonstrate strong ESG assurance readiness to meet the demands of compliance. When companies take an afterthought approach to assurance, and do not establish a formal process into their sustainability reporting cycle, they may be in for a rude shock when they realise that their data cannot endure the scrutiny necessary for even a limited assurance opinion. Readiness is not about data being available somewhere within the organization; it is about the data being traceable, defined in a consistent way, and documented in such a way that an external party with no previous contact with the organization’s internal systems can replicate any data or analysis steps, from beginning to end. In general, this level of discipline requires multiple functional areas to work together, and it is uncommon for a single department to do so. Typical functional areas that need to collaborate include sustainability, finance, operations and information technology.

The impact of poor preparation is far from a later sign-off. The findings compliance providers are likely to present to a company when the company is not ESG assurance ready will be related to the lack of consistent data sources, lack of documented calculation methodologies, or lack of ownership of internal control. Such findings can lead to expensive remediation cycles, loss of investor confidence and, where assurance is now required, potential regulatory fines for failure to comply in jurisdictions. In addition to the financial and reputational challenges, low readiness levels communicate to the stakeholders that the organization’s sustainability commitments might not be as solid as its public reporting suggests, potentially impacting years of brand-building efforts on the environmental and social aspect. In addition, boards and audit committees have begun to take a more active interest in the outcomes of the assurance preparation – that is, the results of the assurance itself – as a governance indicator, leading to potentially awkward questions outside of the sustainability function where findings relate to poor ESG assurance preparation. Assurance outcomes are becoming a growing focus for investors and lenders as an indication of the overall quality of the governance of a company, and a challenging or qualified assurance engagement – typically driven by areas of weakness in ESG data preparation – can have a wider impact on investors’ access to capital than just the sustainability function. Thus, ESG assurance readiness should be considered an ongoing organizational capability and not a project completed near the audit deadline, and should be managed in the same manner as financial reporting controls. 

How to Assess Your ESG Assurance Readiness?

The first step in assessing ESG assurance readiness is to conduct a structured gap analysis to evaluate existing data governance practices against the identified assurance standards (ISAE 3000 or the upcoming ISSA 5000). This includes tracing all aspects of the material ESG metrics back through to their source systems; clarifying who is responsible for collecting and consolidating the data; and understanding whether the processes involved are well documented and can be independently verified by an external party. Many companies discover that their sustainability story is good, but the data supporting that story — including emissions data, workforce diversity, or similar data — has been collected from individual business units, or manually, with no consistency. The initial step is to document all disclosed metrics with the data owner, the formula used to calculate them and the systems used to support them; this exercise typically identifies the areas of the organisation that are most advanced in their approach to data preparation and the areas that still need work, using ad hoc spreadsheets that won’t be enough to meet external scrutiny. This inventory is also the basis for further steps in the ESG assurance preparation, as it enables the sustainability team to determine on which metrics to concentrate the limited assurance preparation effort when fieldwork is planned, instead of working on all metrics equally.

The maturity of internal control, beyond data accuracy, is also an important part of a comprehensive readiness assessment. This includes checking for formal assignment of roles and responsibilities for ESG reporting, for documented approval processes for sustainability reporting, and for previous year ESG data ever being internally or externally reviewed. One of the first problems that an assurance provider will hear is that there is no audit trail (or not obvious) between the reported numbers and where they originated from, which is usually a common issue with companies that are low on their ESG assurance readiness. One of the best ways to bring up these weaknesses prior to the formal engagement is through a mock assurance exercise, which is when a third-party or internal reviewer takes an assurance-type approach to testing a subset of ESG data points. The result of this assessment should be a prioritized remediation plan, ranking gaps by materiality and effort, to provide the sustainability team with a realistic sense of the amount of ESG assurance preparation work required, the remaining distance between ESG data preparation and reality and the time it will likely take for the overall effort to be completed and the organization truly ready for external review. 

ESG Assurance Readiness: What Evidence Should You Prepare?

Having clear, traceable evidence to support each of the metrics disclosed is the key to having a strong ESG assurance readiness. The providers of assurance will want to see evidence of how the final number was arrived at, the assumptions made and the sources used for the data. This usually involves utility bills, meter readings, emission factor references, calculation spreadsheets that have formulas visible. Qualitative or governance-related disclosures can have content substantiating board meeting minutes, policy documents, training records, grievance mechanism logs, etc. This is shared among all of these types of evidence: provision of an assurance should be traceable from the number(s) in the assurance report, back step-by-step to the original transaction, document, or system entry that generated the number(s), and not require verbal explanations only. The work of ESG data preparation—building traceability, in practice—is the key to the success of a wider ESG assurance readiness project, with companies that under-invest in this area often finding their ESG assurance readiness projects stall when they get to the evidence stage even if they have a robust reporting narrative and governance in place.

Since assurance engagements are not narrative driven, companies should make sure that they arrange for such documentation as much as possible before it is requested by the assurance provider. An organized, structured evidence store with a clear relationship to each of the metrics disclosed helps to minimize the time and disruptions associated with the assurance process. This is where ESG data preparation is a standalone workflow from the readiness assessment: It is the task of gathering, cleaning and organizing the underlying data to ensure that it is complete, uniformly formatted, and suitable for testing prior to going to the field. Companies that invest in ESG data preparation before the engagement, rather than trying to find invoices and approvals during the engagement, report completed assurance timelines that are generally much shorter and fewer requests for additional information at the completion of limited assurance preparation. Below is a list of common categories of evidence that companies should have ready as part of their broader efforts to prepare for the ESG data. 

Table 1: ESG Data Preparation — Evidence Categories

How to Prepare for Limited ESG Assurance?

Under the existing regulatory frameworks, limited assurance is the most frequently requested type of assurance, where the assurance provider carries out inquiry and analytical procedures instead of more rigorous testing procedures typically required in reasonable assurance. Though less of an assurance level, companies are still required to show that their data gathering is consistent, internal controls are documented and that the figures reported are capable of being substantiated upon request. Companies may not realize how rigorous this requirement can be, and may think that a limited assurance engagement will require less rigor than it does in practice. In practice, gaps in documentation are more likely to be evident at limited assurance than they are at a more comprehensive level, as inquiry and analytical review relies heavily on management’s own explanations and the provider may have fewer independent test procedures at its disposal to look at missing documentation. One of the most significant benefits of an early understanding of this distinction is that it sets the tone for all of the organization’s expectations regarding the level of documentation that should be completed prior to the start of fieldwork, when making an informed selection of limited assurance.An important benefit of this understanding at a limited assurance early stage is that it sets the tone throughout the organization for what level of documentation is actually required before the fieldwork commences.

Effective limited assurance preparation begins with establishing clear internal ownership of the engagement, preferably within a cross-functional team that is comprised of people from sustainability, finance and operations, who can respond promptly and accurately to the assurance provider’s data requests. It is also important to note that at this level of assurance, companies should have a data walkthrough document to follow the material metrics from their source to their final disclosure, as these are heavily relied upon by assurance providers. The earlier the company reaches out to the assurance provider, preferably before the end of the reporting period, the more likely it is to be able to preemptively anticipate questions of scope and materiality and will significantly shorten the overall engagement time frame and minimize surprises at the end of the engagement. A well conducted limited assurance preparation process also involves a brief internal rehearsal where the reporting team responds to the same questions that the assurance provider might ask during the formal engagement, which helps to highlight inconsistencies in language, definitions or ownership at an earlier stage – as they are more likely to be seen as findings when they occur at the formal engagement. If the companies that prepare for rehearsals are successful in structuring this rehearsal step into their annual calendar, they will find that the next time they undertake a limited assurance it takes significantly less time to prepare—because much of the walkthroughs and supporting evidence can be reused from the last time. 

ESG Assurance Readiness Checklist for Companies

It is easier to implement a structured checklist for each reporting cycle for companies to translate the ESG assurance readiness into a repeatable internal process, as opposed to preparing the reports ad hoc. The checklist approach will help to systematically cover data governance, documentation and ownership of control, which otherwise may be rediscovered in time crunch when the assurance provider is hired. It also establishes a level of consistency that sustainability and finance teams can rely on to measure progress and uncover any glaring areas of improvement in advance of the assurance deadline. The checklist is more effective when it is co-owned by the sustainability and finance functions, and each of the checklist components has an explicit sign-off, rather than it being a general shared responsibility that no one is individually responsible for completing. It is helpful for many companies to identify each checklist item as being applicable to general assurance preparation for the reporting period or limited assurance preparation for the reporting period, as this can help guide the prioritization of work as the engagement approaches.

The checklist should be reviewed on a periodic basis, not just on the eve of the inception of the assurance engagement. An early-cycle review of the data collection allows identification of the data collection problems before they are too late to correct, and a later-cycle review allows for a review of the proper completion of documentation. By keeping the checklist as a living document, current as systems, personnel, or reporting requirements change, the ESG assurance preparation keeps current with the company’s data environment and not with the data environment at a point in time in the past for the prior reporting cycle, and the limited assurance preparation for the next cycle begins from a solid foundation and not from scratch. The table below is a summary of the key areas companies need to get ready for when it comes to ESG assurance. 

Table 2: ESG Assurance Readiness Checklist

When Should Companies Start ESG Assurance Preparation?

The timing of ESG assurance preparation is a critical element of a successful assurance engagement, and a company’s timing of preparing for ESG assurance consistently correlates with more findings, longer engagement time, and increased assurance cost. Generally, the time to start the structured ESG assurance preparation should be at least six to 12 months before the planned date of assurance, reporting, or filing, for two reasons: the first is to allow time to fill in data gaps, the second is to give time to formalize assurance documentation and test the internal processes before the assurance provider commences fieldwork. The lead time is especially significant for companies preparing for assurance for the first time, as the preparation of new data governance structures and evidence repositories can’t be finished in a few weeks, and limited assurance is not effectively completed when rushed at the end of the cycle and leaves behind the type of inconsistent documentation that leads to findings. For those who have completed an ESG assurance cycle before, this window can sometimes be shortened if the ESG data and control gaps identified in the previous cycle have been addressed, but not as a result of assuming that the previous cycle’s assurance was sufficient to mean that no further preparation work on ESG assurance was required.

The best results are achieved by a phased approach. In the early stage, it’s important to concentrate on data governance and gap assessment; during the middle stage, the idea is to gather and structure the supporting data, which is an ongoing ESG data preparation process; and in the final stage, it’s about walking the assurance provider through the methodologies and addressing any remaining queries. Companies that incorporate ESG assurance preparation in their annual reporting schedule, instead of a project, are more prone to experience an improvement in ESG readiness over the years – as documentation and controls evolve and mature over the course of successive ESG reports, they are less likely to identify findings and to have them take longer to be addressed. Finally, a level of ESG assurance readiness is not about any one engagement but rather establishing an operating cycle in which data governance, evidence-gathering and assurance engagement are planned from the beginning of each reporting year and not at the end of the year.