Limited vs Reasonable Assurance Under ISSA 5000: What Actually Changes

Introduction

Every sustainability assurance proposal asks the same early question: limited or reasonable? The answer drives the fee, the timetable and how much of the company’s own process will be examined. Under the old standards the difference was described in general terms. ISSA 5000 makes it concrete by writing the two sets of requirements next to each other, paragraph by paragraph, marked L for limited and R for reasonable.

This article walks through where the two levels diverge and what each means for the company being assured.

The two levels in one sentence each

• Reasonable assurance is a high but not absolute level of assurance that the sustainability information is free from material misstatement. It is the same level as a financial statement audit.
• Limited assurance is substantially lower than reasonable assurance, but still enhances users’ confidence to a level that is meaningful for them. It corresponds to a review of financial statements.

Both levels sit under the same standard, the same ethics and independence rules and the same preconditions. The difference is in the nature, timing and extent of the work.

Where the work diverges

Area	Limited assurance (L)	Reasonable assurance (R)
Risk assessment	Risks of material misstatement identified and assessed at the disclosure level	Identified and assessed at the assertion level for each disclosure: completeness, accuracy, cut-off, occurrence and so on
Control environment	Understand it	Understand it and evaluate whether management has created a culture of honesty and ethical behaviour and whether it is an appropriate foundation for the other controls
Entity’s risk assessment process	Understand its results	Understand the process itself, its results, and evaluate whether it is appropriate
Monitoring of internal control	Understand its results	Understand the process and its results, and evaluate whether it is appropriate
Information system	Understand it and evaluate whether it supports preparation of the information (same for both levels)	Same
Control activities	Only where the practitioner plans to test controls	Identify controls to test, including those where substantive procedures alone are not enough, plus the IT applications involved and the general IT controls over them
Testing controls	Optional	Required where substantive procedures alone cannot provide sufficient evidence
Conclusion	”Nothing has come to our attention” form	Positive opinion

Sources: ISSA 5000 paragraphs 103L and 103R, 114L to 116R, 117 to 120R, 190.

Disclosure level versus assertion level

This single difference explains most of the extra effort in a reasonable assurance engagement. At disclosure level, the assurer asks whether the Scope 1 figure as a whole could be materially wrong. At assertion level, it asks separately whether every source is included, whether each source is measured accurately, whether the right period is captured and whether the emission factors are correctly applied, and designs evidence for each.

Understanding results versus evaluating processes

Under limited assurance, the assurer reads what the company’s own risk assessment and monitoring produced. Under reasonable assurance, it looks at how those processes work and forms a view on whether they are appropriate. A company that has never documented how it monitors its sustainability data has nothing to show for this second step.

IT general controls

For reasonable assurance the assurer must identify the IT applications that produce the data it relies on and the general IT controls over them: access, change management, interfaces. A spreadsheet passed between people by email, with no access or version control, gives the assurer no general IT controls to rely on.

How the report reads

The assurance report makes the level visible in its first section.

Reasonable assurance. Heading “Reasonable Assurance Opinion”. The opinion states positively that the sustainability information is prepared, in all material respects, in accordance with the applicable criteria.

Limited assurance. Heading “Limited Assurance Conclusion”. The conclusion states whether, based on the procedures performed and the evidence obtained, anything has come to the practitioner’s attention that causes them to believe the information is not prepared, in all material respects, in accordance with the criteria. The Basis for Conclusion section must also state that limited assurance procedures vary in nature and timing from, and are less in extent than, reasonable assurance procedures, and that the assurance obtained is substantially lower.

Combined engagements. ISSA 5000 allows different levels for different parts of the information, for example reasonable assurance on greenhouse gas emissions and limited assurance on the narrative. The report must make clear which conclusion covers which information, and any modified conclusion must say which part is affected.

“

The level of assurance is printed in the first heading of the report. Readers notice it.

The meaningful level test

ISSA 5000 does not allow limited assurance to become a formality. Before accepting a limited assurance engagement, the practitioner must expect to obtain a meaningful level of assurance (paragraph 80(a)). An engagement scoped so narrowly, or with evidence so thin, that the conclusion would mean nothing to users should not be accepted as an assurance engagement at all.

Where the market is heading

The IAASB notes that most jurisdictions that have introduced, or are introducing, mandatory sustainability assurance start with limited assurance and plan to move to reasonable over time. In the European Union, the Commission is developing a Delegated Act to adopt standards for mandatory limited assurance based on ISSA 5000. Some investors already ask for reasonable assurance, because they expect sustainability information to carry the same confidence as audited accounts.

In the GCC, Qatar’s securities regulator requires external assurance of listed companies’ sustainability reports but has not stated the level. The GCC adoption article sets out the position country by country.

Choosing the level

Three questions settle it:

1. Does a regulator, lender or rating scheme set the level? If so, that decides it.
2. What will users rely on the figures for? Emissions numbers that feed loan pricing or a transition plan warrant more confidence than a narrative disclosure.
3. Are the controls ready? Reasonable assurance on undocumented processes produces a qualified opinion or a disclaimer, not a better report.

A practical route for many GCC companies: limited assurance on the full report in the first year, reasonable assurance on Scope 1 and 2 emissions once the data controls have run for a full cycle, and the rest of the report following as systems mature.

How ESGweise helps

ESGweise performs limited and reasonable assurance under ISSA 5000 and runs readiness reviews that test whether the controls behind a disclosure would support a reasonable assurance opinion before anyone commits to one. See our assurance service and the readiness checklist for a first ISSA 5000 engagement.

Sources

• IAASB, ISSA 5000, General Requirements for Sustainability Assurance Engagements, November 2024, paragraphs 80, 103L and 103R, 114L to 120R, 190.
• IAASB, ISSA 5000 Frequently Asked Questions, January 2025 (difference between limited and reasonable assurance).
• IAASB, ISSA 5000 Fact Sheet, January 2025.
• IAASB, Understanding ISSA 5000, Jurisdictional Adoption Details updated September 2026 (European Commission Delegated Act footnote), checked 24 October 2026.