# Preparing for Your First ISSA 5000 Assurance: A Readiness Checklist for Companies > What an ISSA 5000 assurer will ask for, drawn from the standard's preconditions and risk assessment requirements, and what a company should have in place before FY2027. **Source:** https://www.esgweise.com/insights/issa-5000-readiness-checklist-for-companies/ **Author:** Sumit Agarwal **Published:** 2026-10-24 **Frameworks:** ISSA 5000, IFRS S1, IFRS S2, GRI **Countries:** Global, UAE, KSA, Qatar, Oman --- ## Key points - Before accepting an engagement, an ISSA 5000 assurer must confirm the preconditions: a process to identify what is reported, suitable and available criteria, measurable subject matter, obtainable evidence and a rational purpose. - The assurer must understand and evaluate the information system behind the report, including how value chain data enters it and how estimates and forward-looking information are prepared. - Every KPI needs a written definition, an owner, a data source and a reconciliation that can be reperformed. Entity-developed criteria must be made available to report users. - Data from management's experts, such as engineers or emission factor providers, is tested for the expert's competence, capabilities and objectivity. - For a calendar-year company the first ISSA 5000 year is FY2027. A dry run on FY2026 data is the most reliable way to find the gaps while there is time to fix them. --- ## Introduction [ISSA 5000](/insights/issa-5000-sustainability-assurance-standard-explained/) is written for assurers, but most of what it requires them to examine sits inside the company: the materiality process, the KPI definitions, the spreadsheets, the supplier data, the emission factors. A company that has not prepared those pieces will not get a clean report, however good its assurer. This checklist translates the standard's preconditions and risk assessment requirements into what the company needs to have ready. Paragraph references are to ISSA 5000. It sits alongside our free 55-point [pre-assurance checklist](/resources/pre-assurance-checklist/) in Excel. ## Part 1: The preconditions An ISSA 5000 practitioner cannot accept an engagement until the preconditions are present (paragraphs 75 to 81). Each one is a question about the company. ### 1. A process to identify what is reported The practitioner must consider whether the entity has a process to identify the sustainability information to be reported (paragraph 76(a)). For most companies this is the materiality assessment required by the framework: IFRS S1 and S2, GRI or ESRS. **Have ready:** the documented assessment, the stakeholders and intended users considered, the thresholds applied, who approved it and when, and how its results map to the disclosures in the report. ### 2. Clear responsibilities and a reasonable basis The practitioner evaluates whether the roles of management, those charged with governance and the engaging party are suitable, and whether management has a reasonable basis for the information (paragraph 76(b)). **Have ready:** board or committee oversight of sustainability reporting in the terms of reference, a named owner for the report, and named owners for each metric. ### 3. Measurable subject matter The sustainability matters must be identifiable and capable of consistent measurement or evaluation against the criteria (paragraph 77). An aspiration cannot be assured. A target with a baseline, a method and a reported value can. ### 4. Suitable criteria, available to users The practitioner identifies whether criteria come from the framework, are developed by the entity, or both, and evaluates whether they are relevant, complete, reliable, neutral and understandable (paragraph 78). It also evaluates how the criteria will be made available to the intended users. **Have ready:** a basis of preparation or reporting criteria document that defines every KPI in scope, its boundary, its unit, its calculation and its sources, published with the report or referenced from it. Where a KPI is defined by the company rather than the framework, the assurance report has to identify those criteria and say where they are located (paragraph 190(c)(vii)). A definition that lives only in an internal spreadsheet cannot support the report. ### 5. Obtainable evidence The practitioner must expect to obtain the evidence it needs (paragraph 79). Records destroyed after a quarter, readings taken without logs, or supplier data with no audit trail all fail here. ### 6. A rational purpose and a sensible scope The engagement must be useful and not misleading, and the scope must be appropriate, including when part of the reported information is excluded (paragraph 80). For limited assurance the practitioner must also expect a meaningful level of assurance. **Decide early:** which disclosures are in scope, at which level, and why. A scope limited to the metrics that are easiest to evidence invites the question of whether it misleads. ## Part 2: What the assurer will examine ### 7. The information system The practitioner must understand the information system and evaluate whether it supports preparing the information in line with the criteria (paragraphs 117 and 118). This applies at both levels of assurance. **Have ready:** a data flow map for each KPI in scope, from source record to reported figure, with every spreadsheet, system and manual step named and its owner identified. ### 8. Value chain and external data The practitioner must understand how information from external sources, such as service organisations or other entities in the value chain, is recorded, processed, corrected as necessary and incorporated (paragraph 117(b)). **Have ready:** for Scope 3, supplier data and outsourced activities, the source of each input, how it is checked, and what happens when a supplier's figure looks wrong. ### 9. Estimates and forward-looking information For estimates and forward-looking information, the practitioner must understand how the entity identifies its methods, assumptions and data sources and decides when to change them (paragraph 117(c)). This reaches scenario analysis, transition plan figures, emission estimates for missing data and climate-related financial effects. **Have ready:** a short method note for each estimate, the assumptions and their sources, and the reason for any change from the prior year. ### 10. Information produced by the company and its experts When the practitioner uses information produced by the entity, it must evaluate whether that information is accurate, complete, precise and detailed enough (paragraph 91). Where a management's expert prepared it, such as an engineer, a laboratory or a modelling firm, the practitioner evaluates that expert's competence, capabilities and objectivity and understands the work done (paragraph 92). **Have ready:** reconciliations from source data to reported figures that someone outside the team can reperform, and for each external expert, the engagement letter, their qualifications and their method. ### 11. Internal control At both levels the practitioner understands the control environment and the results of the company's risk assessment and monitoring. Under reasonable assurance it evaluates those processes and identifies controls to test, including general IT controls (paragraphs 114 to 120). Our article on [limited versus reasonable assurance](/insights/issa-5000-limited-vs-reasonable-assurance/) sets out the difference. **Have ready:** review and approval steps for each KPI, evidence that the reviews happened, and access control over the files and systems holding the data. ### 12. Consistency with the financial statements ISSA 5000 covers communication with the financial statement auditor, and the practitioner reads other information reported with the sustainability information for material inconsistencies. **Have ready:** reconciliations between sustainability figures and the accounts where they overlap: revenue used in intensity ratios, headcount, capital expenditure on transition, financed amounts for banks. Assurance tests data created months earlier. The time to fix a process is before the data exists. ## The calendar | When | Action | |---|---| | Now to December 2026 | Agree scope and level with the assurer. Document criteria and data flows. Assign KPI owners | | Early 2027 | Dry run on FY2026 data: a pre-assurance review that tests the evidence trail as the assurer will | | From 1 January 2027 | FY2027 data, the first ISSA 5000 year for calendar-year companies, is created under the improved process | | During 2027 | Interim review of half-year data to catch control failures before year end | | Early 2028 | Year-end assurance under ISSA 5000 | ## What a single error does The IAASB's June 2026 materiality FAQ gives an example: a limited assurance engagement on a report of more than 250 pages, in which water consumption alone is materially understated because a source was left out. Management declines to correct it. The result is a **qualified conclusion** on the whole report. One weak metric decides the headline. More on this in our article on [materiality under ISSA 5000](/insights/issa-5000-materiality-double-materiality/). ## How ESGweise helps ESGweise runs ISSA 5000 readiness reviews for companies whose report will be assured by their external auditor or another firm. We test each in-scope disclosure against the preconditions and the evidence trail above, produce a findings list ranked by assurance risk, and re-test after fixes. See our [assurance service](/services/assurance/). ## Sources - IAASB, *ISSA 5000, General Requirements for Sustainability Assurance Engagements*, November 2024, paragraphs 75 to 82 (preconditions), 91 and 92 (information used as evidence), 114 to 120 (internal control and information system), 190 (report content). - IAASB staff, Frequently Asked Questions: The Application of Materiality under ISSA 5000, June 2026, Q21. - IAASB, ISSA 5000 Fact Sheet, January 2025. --- ## Frequently asked questions ### What are the preconditions for an ISSA 5000 engagement? The practitioner must establish that the entity has a process to identify the sustainability information to be reported, that management and those charged with governance have suitable roles and a reasonable basis for the information, that the sustainability matters are measurable, that the criteria are suitable and available to users, that the evidence needed can be obtained, and that the engagement has a rational purpose. If these are not present and cannot be fixed, the engagement cannot be accepted as an ISSA 5000 engagement. ### What happens if the preconditions are not met? The practitioner discusses the matter with the company. If changes cannot be made, the engagement cannot be accepted as an assurance engagement unless law or regulation requires it, and then the report cannot refer to ISSA 5000. If a precondition is found to be missing after acceptance, the practitioner decides whether it can be resolved, whether to continue, and how to communicate it in the report. ### Does the assurer test our materiality assessment? The assurer must understand the entity's process to identify the sustainability information to be reported, which is usually the materiality assessment, and evaluate whether the information system supports preparing the information in line with the criteria. It does not redo the assessment, but a process that is undocumented or inconsistent with the framework becomes a finding. ### Can we have only part of the report assured? Yes, the scope can cover all or part of the sustainability information. The practitioner must be satisfied the scope is appropriate, including when part of the reported information is excluded, so that the engagement as a whole is useful and not misleading to users. A scope that selects only the easiest metrics can fail that test. ### How long does readiness take? It depends on the starting point. A company that already reports under a framework and has a GHG inventory usually needs one reporting cycle to document criteria, assign data owners and close control gaps. Running a dry run on FY2026 data gives time to fix issues before FY2027 data, the first ISSA 5000 year for a calendar-year company, is created. --- Published by ESGweise Global LLC, Dubai. https://www.esgweise.com