ISSA 5000 is the IAASB's global standard for assuring sustainability information. What it covers, who can use it, and why FY2027 is the first year it applies.
Introduction
Until now there has been no assurance standard written specifically for sustainability information. Assurers used ISAE 3000 (Revised), a general standard for anything other than historical financial information, ISAE 3410 for greenhouse gas statements, ISO 14064-3 for GHG verification, or AA1000AS. Two reports on the same company could cite different standards, test different things and still both be called “assured”.
ISSA 5000 is the IAASB’s answer. It is one standard for assurance on any sustainability information, under any suitable reporting framework, at either level of assurance. This article explains what it is, when it takes effect, who can use it and what it changes for companies. Four companion articles go deeper: limited versus reasonable assurance, materiality, adoption in the GCC and how to prepare for a first engagement.
What ISSA 5000 is
The full title is ISSA 5000, General Requirements for Sustainability Assurance Engagements. The International Auditing and Assurance Standards Board (IAASB) issued it in November 2024. It is a stand-alone, principles-based standard: it does not need any other IAASB auditing or assurance standard to be applied alongside it, apart from the quality management standard ISQM 1.
It covers the engagement end to end:
| Stage | What ISSA 5000 sets out |
|---|---|
| Acceptance | Preconditions the engagement must meet before it is accepted, including suitable criteria and a rational purpose |
| Planning | Overall strategy, grouping of disclosures, and materiality for qualitative and quantitative disclosures |
| Risk assessment | Understanding the entity, its reporting process and its internal control, and identifying risks of material misstatement |
| Responding to risk | Further procedures, evidence from groups and the value chain, estimates and forward-looking information |
| Concluding | Evaluating misstatements and the sufficiency of evidence |
| Reporting | Minimum content of the assurance report, with illustrative reports published in November 2025 |
The IAASB’s own summary of what is new lists issues specific to sustainability: double materiality, the entity’s process for identifying what to report, evidence from the value chain, estimates and forward-looking information, and how the sustainability assurer communicates with the financial statement auditor.
When it takes effect
ISSA 5000 is effective for assurance engagements on sustainability information reported:
- for periods beginning on or after 15 December 2026, or
- as at a specific date on or after 15 December 2026.
Earlier application is permitted. The date is tied to the start of the reporting period, not to the date the assurance report is signed, and that trips people up.
| Reporting period | Does ISSA 5000 apply? |
|---|---|
| Calendar year 2026 | No. The period begins before 15 December 2026. An assurer may apply it early |
| Calendar year 2027 | Yes. This is the first year for a calendar-year company, assured in 2028 |
| 1 April 2026 to 31 March 2027 | No. The period begins before the effective date |
| 1 April 2027 to 31 March 2028 | Yes |
What happens to ISAE 3000 and ISAE 3410
This is the change most companies have not yet registered. The IAASB’s August 2025 FAQ on applicability is direct:
- ISAE 3000 (Revised) will no longer be applicable for assurance engagements on sustainability information after ISSA 5000’s effective date. It continues for other subject matter outside sustainability.
- ISAE 3410, the standard for greenhouse gas statements, has been absorbed into ISSA 5000. In March 2025 the IAASB approved its withdrawal from ISSA 5000’s effective date.
There is one transitional route. Where a jurisdiction has not yet adopted ISSA 5000 but has adopted ISAE 3000, practitioners there may keep applying ISAE 3000 until adoption. They cannot then claim compliance with IAASB standards for that sustainability engagement. A FY2027 assurance report on sustainability information that cites ISAE 3000 cannot claim to comply with IAASB standards, whatever the work behind it.
ISO 14064-3 is an ISO standard, not an IAASB one, and is unaffected. Accredited verification bodies continue to use it for greenhouse gas verification, including for regimes such as CBAM. Our comparison of ISO 14064-3, ISAE 3000 and ISSA 5000 sets out when each applies.
Who can use it
ISSA 5000 is designed to be profession agnostic. A sustainability consultancy, an engineering firm or an accounting firm can all perform an ISSA 5000 engagement, with two conditions:
- The practitioner complies with the IESBA Code, including the International Ethics Standards for Sustainability Assurance (IESSA), which contain the independence rules for sustainability assurance; and
- The practitioner is a member of a firm that applies ISQM 1, the quality management standard, or follows professional, legal or regulatory requirements that an appropriate authority has determined to be at least as demanding as both.
The assurance report must state which of these the practitioner complies with. The IESSA has the same effective date as ISSA 5000, except for certain provisions on value chain components, which take effect from 1 July 2028.
Local law can narrow the field. A regulator may require the external auditor to perform the engagement, as Qatar’s securities regulator does for listed companies. The GCC article covers this.
What ISSA 5000 covers
ISSA 5000 applies to all assurance engagements on sustainability information:
- Any topic: climate, greenhouse gas emissions, water, biodiversity, human rights, labour practices, governance.
- Any presentation: a stand-alone sustainability report, a section of the annual report, a GHG statement, selected KPIs.
- Any suitable framework: IFRS S1 and S2, GRI, ESRS, integrated reporting, exchange ESG guidance, or criteria the entity develops itself, provided they are relevant, complete, reliable, neutral and understandable.
- Mandatory or voluntary: the standard applies whether the reporting or the assurance is required by law or chosen.
- Single entities and groups, including value chain entities inside the reporting boundary.
- Limited or reasonable assurance, or a combination with different levels for different parts of the report.
What it does not do is tell a company what to report. Management decides that under its reporting framework. ISSA 5000 governs how the assurer tests what is reported.
ISSA 5000 does not change what a company reports. It changes what the assurer must test, and that exposes every weak data process behind the report.
What changes for companies being assured
The standard is addressed to assurers, but its requirements fall on the company’s processes:
- The materiality assessment becomes evidence. The assurer must understand the entity’s process to identify the information to be reported and evaluate whether the information system supports it.
- Criteria must be written down and available. Every KPI needs a definition that intended users can see, whether from the framework or developed by the entity.
- Value chain data is tested. The assurer must understand how information from suppliers, service organisations and other value chain entities is recorded and corrected before it enters the report.
- Estimates need a method. For estimates and forward-looking information, the entity must show how it chose its methods, assumptions and data sources.
- Misstatements are reported plainly. If one material disclosure stays misstated, the conclusion is qualified, even when the rest of a long report is correct.
Supporting material from the IAASB
The IAASB has published non-authoritative material alongside the standard: an Implementation Guide (January 2025), illustrative assurance reports (November 2025), a Basis for Conclusions (November 2024), FAQs on applicability (August 2025) and on materiality (June 2026), and a joint FAQ with the IESBA (June 2025). An Arabic translation of the standard is underway. The International Organization of Securities Commissions (IOSCO) has issued a statement of support for ISSA 5000.
How ESGweise helps
ESGweise performs sustainability assurance and assurance readiness reviews against ISSA 5000, and verifies GHG statements under ISO 14064-3. For companies whose report will be assured by their financial auditor or another firm, we run a pre-assurance review on the current year’s data so the first ISSA 5000 engagement finds nothing new. See our assurance service and the free pre-assurance checklist.
Sources
- IAASB, ISSA 5000, General Requirements for Sustainability Assurance Engagements, issued November 2024, paragraph 15 (effective date).
- IAASB, Understanding ISSA 5000, including Jurisdictional Adoption Details updated September 2026, checked 24 October 2026.
- IAASB, ISSA 5000 Fact Sheet, January 2025.
- IAASB staff, FAQ: Applicability of ISSA 5000, ISAE 3000 (Revised) and ISAE 3410, August 2025.
- IAASB and IESBA, Fact Sheet: ISSA 5000 and IESSA, Global Baseline Standards for Sustainability Assurance, January 2025.
- IAASB, ISSA 5000 Frequently Asked Questions, January 2025.
Frequently asked questions
What is ISSA 5000?
ISSA 5000, General Requirements for Sustainability Assurance Engagements, is the International Auditing and Assurance Standards Board's standard for assurance engagements on sustainability information. It was issued in November 2024 and covers the whole engagement, from acceptance through planning, risk assessment and evidence to the assurance report, for both limited and reasonable assurance.
When does ISSA 5000 become effective?
For assurance engagements on sustainability information reported for periods beginning on or after 15 December 2026, or as at a specific date on or after 15 December 2026. Earlier application is permitted. A company with a calendar financial year first falls in scope for its 2027 report, which is assured in 2028.
Does ISSA 5000 replace ISAE 3000?
For sustainability information, yes. The IAASB's August 2025 FAQ states that ISAE 3000 (Revised) will no longer be applicable for sustainability assurance engagements after the effective date of ISSA 5000. ISAE 3000 continues for other non-financial subject matter. The IAASB also approved the withdrawal of ISAE 3410, the greenhouse gas statement standard, from the same date.
Is ISSA 5000 mandatory?
The IAASB does not decide that. Each jurisdiction adopts the standard and decides whether sustainability reporting and assurance are required. In its September 2026 update the IAASB listed 24 jurisdictions as having adopted ISSA 5000 or a local equivalent, including Saudi Arabia (SOCPA, for voluntary engagements by its members) and Oman (OACPA).
Can a non-accountant firm use ISSA 5000?
Yes. The standard is designed to be profession agnostic. The conditions are that the practitioner complies with the IESBA Code, including the International Ethics Standards for Sustainability Assurance, and is a member of a firm that applies ISQM 1, or follows requirements that an appropriate authority has determined to be at least as demanding. Local law may add further conditions on who can perform the work.