Many ESG assurance readiness checklists stop at “have a policy” and “document your process”. An assurer does not test intentions; it asks for evidence, row by row. This workbook is built the other way round. Each of its 71 checks states what must be true, the evidence an assurance provider is likely to ask for, and the finding you risk if that evidence is missing. A dashboard turns your answers into an ESG assurance readiness score, a list of red flags and a countdown to fieldwork.
⚠️ Where assurance stands at 19 October 2026. Under the CSRD, the sustainability statement is subject to limited assurance. Omnibus I gives the Commission until 1 July 2027 to adopt limited assurance standards and removes the requirement to adopt reasonable assurance standards (Directive (EU) 2026/470, Art. 1(3) and recital 5). Until then, engagements follow national standards, with the CEAOB’s non-binding guidelines of September 2024 as a common reference. Requirements also depend on national transposition, so check the rules in your Member State before planning your ESG assurance readiness work.
- 71 checks across 12 areas
- 22 critical checks that raise a red flag
- 16 example datapoints in the evidence map
- 4 extra checks for reasonable assurance
Who should read this
- Sustainability reporting leads preparing a first or second CSRD assurance
- Financial controllers and internal audit teams who own reporting controls
- Carbon accounting teams facing assurance of GHG figures or an SBTi base year
- Consultants running an ESG assurance readiness review for a client
On this page
What Makes This ESG Assurance Readiness Checklist Different
Seven design choices set this ESG assurance readiness checklist apart from generic lists:
- Evidence, not intentions. Every check names the documents an assurer will typically request and the finding that follows if they are missing, so owners know exactly what to produce.
- A reference you can verify. Each check points to its basis: a section of the CEAOB guidelines on limited assurance, a paragraph of revised ESRS E1, the GHG Protocol Scope 3 Standard or SBTi criterion C7. Where a check reflects common practice rather than a rule, it says so.
- The nature of each reference, stated. A Basis column tells you whether a check rests on EU law, non-binding EU guidance, an assurance standard that binds your assurer rather than you, the GHG Protocol, a voluntary framework such as the SBTi, or good practice, so you can see how much of your ESG assurance readiness work rests on legal requirements.
- Limited or reasonable, in one switch. 4 checks concern evidence that reasonable assurance typically requires, such as controls operating through the whole period. They count only when you select Reasonable on the dashboard.
- A prepared-by-client (PBC) list built in. The Evidence Map tab documents each datapoint in ten fields, from source system to evidence folder, and tells you whether it is ready for sampling.
- A countdown, not just a score. Enter your fieldwork start date and the dashboard lists open items whose target date falls after it, so ESG assurance readiness is tracked against a real deadline.
- Honest limits. A blank file reads “Not assessed”, never “not ready”. The readiness bands are our working heuristic, and the score is a self-assessment, not an assurance opinion; the workbook says so on its first tab and on the dashboard.
What Is Inside the ESG Assurance Readiness Workbook
| Tab | What it does | What you fill in |
|---|---|---|
| Start here | How to use the workbook, the scoring rules, the legend and the regulatory basis with links. | Nothing. |
| Dashboard | Weighted ESG assurance readiness of assessed checks, assessment coverage, readiness band, red flags, Watch items, critical checks not yet assessed, items due after fieldwork, weeks to fieldwork, readiness by area, five charts and the first ten red flags to close. | Company, reporting period end, fieldwork start date and target level (Limited or Reasonable). |
| Checklist | 71 checks with evidence, typical finding, level, priority, reference and basis (EU law, EU guidance, assurance standard, accounting standard, voluntary framework or good practice). Calculated columns for points, flags and timing. | Status, owner, target date, evidence location and notes. |
| Evidence Map | A prepared-by-client list with 16 example datapoints (E1, S1, G1, Taxonomy) and room for more. Documentation score and “ready for sampling” for each row. | Ten documentation fields per datapoint, plus the reported value. |
| Lists | Drop-down values. | Nothing. |
Figure 1 shows how a single check moves from the checklist to your ESG assurance readiness dashboard.
Figure 1. How one check feeds the dashboard (example values).
How the ESG Assurance Readiness Score Works
Each check carries a priority weight: Critical = 3, High = 2, Standard = 1. A check marked Ready earns its full weight, Partial earns half, and Not started earns nothing. Checks marked N/A drop out of the calculation, so record the reason in the Notes column. A check left blank counts as not yet assessed: it stays out of the score, and the dashboard shows how many in-scope checks you have assessed. ESG assurance readiness is the share of available points earned on assessed checks, by area and overall.
Two signals sit beside the score. A red flag is a critical check marked Not started; a Watch item is a critical check that is only partly ready. A timing alert appears when a check is still open and its target date falls after the fieldwork start date.
| Band | Condition | What it usually means |
|---|---|---|
| Not assessed | No check has a status yet | Nothing to read yet: the file has not been filled in. |
| Assessment in progress | Some in-scope checks still blank | The ESG assurance readiness score covers assessed checks only; finish the assessment before relying on it. |
| Ready for fieldwork | All checks assessed, 85% or more and no red flags | Remaining gaps are minor; agree the PBC list and timetable. |
| Close the gaps first | 65% to 84%, or any red flag | Fieldwork is possible but findings are likely; prioritise red flags. |
| Not ready for fieldwork | Below 65% | Discuss timing and scope with your assurer before fieldwork is fixed. |
These bands are a working heuristic we use to prioritise ESG assurance readiness work, not thresholds from any assurance standard. The score is a self-assessment of your own preparation: it is not an assurance opinion, it does not predict your assurer’s conclusion, and it does not guarantee an engagement without findings. Your assurance provider decides what evidence is sufficient.
The 12 Areas an Assurer Will Look At
The checklist groups its 71 checks into the 12 areas that shape ESG assurance readiness in practice.
| Area | Checks | What the assurer typically probes | Main references |
|---|---|---|---|
| Scope & reporting boundary | 5 | Whether the perimeter matches the financial statements and the GHG boundary is applied consistently | CEAOB §25; ESRS E1-8 |
| Double materiality process | 7 | Whether the process described in the statement is the one that was actually carried out | CEAOB §8 |
| Governance & internal control | 9 | Owners, reviewers, process documentation and evidence that reviews took place | CEAOB §6, §7 |
| Data collection & systems | 7 | Data lineage, site completeness, manual adjustments, retrieval of source evidence | CEAOB §9 |
| Methods, estimates & restatements | 7 | Documented methods, sourced factors, identified estimates and restated comparatives | CEAOB §11; ESRS 1 para 65 |
| GHG emissions (ESRS E1) | 9 | Scope 1 reconciliations, Scope 2 instruments, Scope 3 screening and significance, no netting of credits | ESRS E1-8, AR 20(d), AR 24 |
| Value chain information | 4 | Sources, share estimated, plausibility checks and the value chain cap | CEAOB §27; ESRS 1 para 123 |
| Social & governance metrics | 4 | Headcount reconciliations, definitions, incident records | ESRS S1, G1 |
| Targets & forward-looking information | 4 | Target documentation and assumptions consistent with financial planning | CEAOB §10; ESRS E1 para 24 |
| Connectivity with financial statements | 3 | Reconciliation of financial amounts and EU Taxonomy KPIs | CEAOB §14–16, §23 |
| Disclosure & presentation | 5 | Completeness, comparatives, cross-references and consistency of figures | CEAOB §23, §24, §26 |
| Engagement readiness | 7 | Engagement terms, timetable, PBC list, representation letter, components | CEAOB §19, §25; ISSA 5000 |
The CEAOB section numbers refer to its guidelines on limited assurance on sustainability reporting, adopted on 30 September 2024. They are non-binding and predate both Omnibus I and the revised ESRS, but they remain the clearest EU-level description of what a limited assurance engagement involves. The E1 references follow the adopted text of revised ESRS E1 as reproduced in EFRAG’s ESRS Knowledge Hub.
Limited vs Reasonable Assurance: What Changes for Preparers
Limited assurance gives a negative-form conclusion: the practitioner reports whether anything has come to its attention suggesting the information is materially misstated. The procedures are more limited than for reasonable assurance and typically rely more on enquiry and analytical procedures, although the CEAOB guidelines expect practitioners to understand the entity’s system of internal control and to obtain evidence that responds to the risks they identify. Reasonable assurance gives a positive opinion and usually involves detailed testing, including of controls, across the period.
| Regime | Assurance position | Status and source |
|---|---|---|
| CSRD | Limited assurance of the sustainability statement; the move to reasonable assurance was removed by Omnibus I | Binding EU law, applied through national transposition — Directive (EU) 2026/470, Art. 1(3), recital 5 |
| ISSA 5000 (IAASB) | General standard covering both limited and reasonable assurance; effective for periods beginning on or after 15 December 2026, when ISAE 3410 is withdrawn | Assurance standard: binds assurance providers where adopted, not companies directly — IAASB; IAASB, May 2025 |
| SBTi Net-Zero Standard V2.0 | Category A companies obtain at least limited third-party assurance of the target base-year inventory (C7) | Final, effective 1 February 2027 — SBTi |
| California SB 253 | CARB accepts 2026 submissions without limited assurance; assurance for later years is left to the next rulemaking | Secondary (law firm) — Sullivan & Cromwell |
In the workbook, the switch on the dashboard adds the 4 reasonable-level checks to the score. If your engagement is limited today but may move to reasonable later, run both views: the gap between them measures your ESG assurance readiness for a future reasonable engagement.
The Evidence Map: Your PBC List Before the Assurer Asks
Assurance teams work from a prepared-by-client list: the documents and data they will request, item by item. The Evidence Map tab builds that list from your side as part of your ESG assurance readiness work, one row per datapoint in scope. It ships with 16 examples, from gross Scope 1 emissions to Taxonomy KPIs; delete or rename them to match your material topics.
Each row asks for ten things: the source system, the data owner, the reviewer, the method document, the factor or conversion source and version, the share estimated, the key control, the control evidence, what the figure reconciles to, and the evidence folder. Ten of ten marks the row as ready for sampling; six to nine is Partial. Rows where more than half of the figure is estimated are highlighted, because estimates call for closer review. Write “n/a” where a field does not apply, so the score stays meaningful.
Figure 2 shows why those ten fields matter for ESG assurance readiness: they are the links an assurer follows from the published figure back to source.
Figure 2. The evidence trail from source document to published figure.
💡 Practical tip. Share the Evidence Map with your assurance provider when you agree the PBC list. Matching their request list to your rows early avoids a familiar delay: evidence that exists but cannot be found quickly. For GHG figures, our Scope 3 reporting guide explains what assurance tests in Scope 3 inventories, and our broader guide lists the evidence an assurance-ready inventory needs.
Common Findings This Checklist Is Designed to Prevent
Process and controls
- A materiality process described more thoroughly than the evidence supports
- Reviews said to be done but not evidenced
- The same person preparing and reviewing a metric
- Critical spreadsheets without version control
Data and disclosure
- Sites missing from the data without explanation
- Estimates presented as measured data
- Market-based Scope 2 without cancelled certificates
- Carbon credits netted against gross emissions
Each of these maps to one or more checks in the ESG assurance readiness checklist, with the evidence that prevents it. An ESG assurance readiness review does not predict what your assurer will conclude; it helps you see the gaps before they do.
Six Weeks Before Fieldwork: A Practical Sequence
This is a suggested sequence for an ESG assurance readiness review, not a requirement. Adjust it to your engagement timetable.
Figure 3. A six-week sequence before fieldwork (suggested, not required).
- Week 6: set up. Enter the fieldwork date and target level, assign an owner to every check, and agree the scope of assurance with your provider.
- Week 5: first pass. Set a status for every check and list every datapoint in scope in the Evidence Map.
- Week 4: red flags. Close critical checks that have not started, starting with boundary, materiality process and review evidence.
- Week 3: evidence. Complete the ten documentation fields for each datapoint and test that you can retrieve a sample of source evidence within a few days.
- Week 2: dry run. Test your ESG assurance readiness: ask someone outside the reporting team to pick five datapoints and trace each from the published figure back to source.
- Week 1: hand-over. Share the Evidence Map as your PBC list, confirm the timetable and prepare the draft representation letter.
Bottom line. ESG assurance readiness comes down to evidence you can produce on request: a clear boundary, a documented materiality process, methods and estimates written down, reviews that leave a trace, and source documents you can retrieve in days. Score yourself honestly, close the red flags first, and share the evidence map with your assurer early.
Sources and Verification
| Claim | Source and status |
|---|---|
| CSRD limited assurance; limited assurance standards by 1 July 2027; Omnibus I in force 18 March 2026 | Directive (EU) 2026/470 — PRIMARY, binding EU law; applies through national transposition |
| Commission limited assurance standards by 1 July 2027; reasonable assurance standards requirement removed | Directive (EU) 2026/470, Art. 1(3) and recital 5 — PRIMARY, binding EU law |
| CEAOB guidelines: adopted 30 September 2024, non-binding; sections 4–27 used as references | CEAOB guidelines on limited assurance on sustainability reporting — PRIMARY, non-binding guidance |
| ISSA 5000 effective for periods beginning on or after 15 December 2026; designed for limited and reasonable assurance | IAASB, Understanding ISSA 5000 — PRIMARY; professional standard, applies where adopted |
| ISAE 3410 withdrawn from the ISSA 5000 effective date | IAASB announcement, 8 May 2025 — PRIMARY |
| Revised ESRS apply from FY2027; ESRS 1 paragraphs 65 and 123 | Delegated Regulation (EU) 2026/1563 — PRIMARY, binding |
| E1-6 to E1-9; E1-8 para 30; AR 20(d); AR 24; para 24 | EFRAG ESRS Knowledge Hub, E1 (Delegated Act version) — adopted text as reproduced by EFRAG; not cross-checked against the Official Journal PDF |
| Value chain cap and the voluntary standard | Directive (EU) 2026/470, Art. 2(4); Delegated Regulation (EU) 2026/1560 — PRIMARY, binding |
| Scope 3 requirements: exclusions, supplier-data share, base-year recalculation | GHG Protocol Scope 3 Standard (2011), Table 3.1 — PRIMARY; current accounting standard, obligations depend on the reporting regime |
| SBTi base-year assurance (C7) | SBTi Corporate Net-Zero Standard V2.0 — PRIMARY, final; effective 1 February 2027 |
| SB 253: 2026 submissions accepted without limited assurance | Sullivan & Cromwell, 14 October 2026 — SECONDARY (law firm) |
What we could not establish
- The content of the Commission’s limited assurance standards, which are due by 1 July 2027, and whether they will build on ISSA 5000.
- The revised ESRS S1 and G1 texts: checks on workforce and business conduct name the standard without datapoint numbers.
- How each Member State has transposed the assurance provisions, including who may provide assurance.
- Whether the CEAOB will update its 2024 guidelines for Omnibus I and the revised ESRS.
This checklist supports ESG assurance readiness ahead of an assurance engagement. It is not an assurance standard, legal advice or a substitute for your assurance provider’s requirements. Corrections: contact@aigreentools.com.
Frequently Asked Questions About ESG Assurance Readiness
What is ESG assurance readiness?
ESG assurance readiness is the state in which your sustainability information, and the evidence behind it, can be examined by an independent assurance provider without avoidable findings: boundaries are clear, methods and estimates are documented, controls leave evidence, and source documents can be produced quickly.
Is assurance still required under the CSRD after Omnibus I?
Yes, for undertakings in scope. The sustainability statement is subject to limited assurance; Omnibus I removed the planned move to reasonable assurance and set 1 July 2027 as the deadline for the Commission’s limited assurance standards. The rules apply through national law, so check your Member State.
What is the difference between limited and reasonable assurance?
Limited assurance gives a negative-form conclusion based on more limited procedures, mainly enquiry and analytical review, with an understanding of internal control. Reasonable assurance gives a positive opinion and usually requires detailed testing, including of controls over the full period.
Does a high ESG assurance readiness score mean the engagement will go well?
No. The score measures your own preparation against this checklist. It is not an assurance opinion and does not predict what your assurance provider will conclude: the provider decides what evidence is sufficient and may raise findings that the checklist does not cover.
What does an assurance provider usually ask for first?
Typically the reporting boundary, the double materiality documentation, methodology documents for the main metrics, and a list of source evidence for each datapoint. The Evidence Map tab is designed to answer that last request.
Does ISSA 5000 apply to my engagement?
It depends on your jurisdiction and your assurance provider. ISSA 5000 is the IAASB’s general sustainability assurance standard, effective for periods beginning on or after 15 December 2026; it binds assurance providers where it has been adopted, not companies directly. Under the CSRD, the Commission is due to adopt EU limited assurance standards by 1 July 2027; until then, national standards apply.
Can I use the checklist for SBTi or California SB 253 assurance?
Yes, as an ESG assurance readiness tool for GHG figures. The GHG area and the Evidence Map cover what a base-year or GHG assurance engagement examines. SBTi V2.0 requires Category A companies to obtain at least limited assurance of the base-year inventory; California’s assurance requirements for 2027 onwards are still being set by CARB.
How long before fieldwork should we start an ESG assurance readiness review?
For a first engagement, start your ESG assurance readiness review at least six weeks before fieldwork, and earlier if the materiality process or data lineage is undocumented. Those two areas take the longest to fix.
