Limited assurance and reasonable assurance are two levels of an independent practitioner's check on sustainability information. Under ISSA 5000, the international standard for sustainability assurance, a limited assurance engagement ends with a conclusion that nothing has come to the practitioner's attention suggesting the information is materially misstated, and "the level of assurance obtained in a limited assurance engagement is substantially lower than in a reasonable assurance engagement", which ends with a positive opinion. In the EU, sustainability reporting stays at limited assurance: the 2026 Omnibus directive removed the plan to move to reasonable assurance. For an investor using an issuer's ESG figures the more important line of an assurance statement is its scope, because a statement can cover Scope 1 and 2 and leave Scope 3 out, or cover some sites and not others. Botminds' ESG Data Extraction has an assurance agent that reads that scope figure by figure before any figure is treated as verified.
The rules come from the IAASB, the EU and the Japanese, Korean and US regulators, linked where they apply. Product examples come from sample data on a fictional asset manager, Quillfield Capital, and its issuers.
Limited vs reasonable assurance under ISSA 5000
Limited assurance: Reduced "to a level that is acceptable in the circumstances" but greater than for reasonable assurance.
Reasonable assurance: Reduced "to an acceptably low level in the circumstances of the engagement".
Limited assurance: Vary in nature and timing from, and are less in extent than, a reasonable assurance engagement.
Reasonable assurance: The fuller set: more testing, more evidence.
Limited assurance: Negative: whether anything has come to the practitioner's attention to suggest a material misstatement.
Reasonable assurance: Positive: the information is prepared or fairly presented, in all material respects.
Limited assurance: "Limited Assurance Conclusion"
Reasonable assurance: "Reasonable Assurance Opinion"
Limited assurance: Must be "meaningful": likely to enhance users' confidence to a degree "clearly more than inconsequential".
Reasonable assurance: An opinion on the information measured against the applicable criteria.
Limited assurance vs reasonable assurance: what each one says
A limited assurance conclusion says the practitioner looked and found nothing wrong; a reasonable assurance opinion says the practitioner tested enough to state that the information is right in all material respects. ISSA 5000 requires a limited assurance report to say so in plain terms: the procedures "vary in nature and timing from, and are less in extent than for, a reasonable assurance engagement", and "Consequently, the level of assurance obtained in a limited assurance engagement is substantially lower" (ISSA 5000, paragraph 190(d)).
The difference shows in the wording an investor reads. A limited conclusion is phrased as whether "a matter(s) has come to the practitioner's attention to cause the practitioner to believe that the sustainability information is not prepared or not fairly presented"; a reasonable opinion is "expressed in a positive form". When a statement mixes the two, as some do, the standard requires it to say which level applies to which part.
What is a limited assurance engagement?
It is an engagement in which the practitioner reduces engagement risk to a level acceptable in the circumstances, higher than in a reasonable assurance engagement, and reports in negative form. ISSA 5000 adds a floor: the procedures are "planned to obtain a level of assurance that is, in the practitioner's professional judgment, meaningful", and to be meaningful the assurance must enhance users' confidence "to a degree that is clearly more than inconsequential" (ISSA 5000, definitions).
For a data steward, "clearly more than inconsequential" is the honest description of what limited assurance adds: an independent professional has looked at the process and the numbers and raised nothing. It is evidence, not proof. The EU's sustainability reporting directive describes the trade the same way: "In a limited assurance engagement, the auditor performs fewer tests than in a reasonable assurance engagement" (Directive (EU) 2022/2464, recital 60).
What is limited assurance in CSRD, after the 2026 Omnibus?
It is the only level the EU now plans for sustainability reporting. The Corporate Sustainability Reporting Directive set limited assurance first, with a power to move to reasonable assurance later. The Omnibus directive of February 24, 2026 removed that step: "To avoid an increase in the costs of assurance for undertakings, the requirement to adopt reasonable assurance standards should be removed" (Directive (EU) 2026/470, recital 5).
To allow adequate time to develop the limited assurance standards, the deadline for their adoption should be postponed to 1 July 2027.
Directive (EU) 2026/470, recital 4
So the EU's own limited assurance standard is still to come. The directive entered into force on March 18, 2026, and member states must transpose the parts relating to sustainability reporting by March 19, 2027 (ESMA, sustainability reporting). The IAASB lists the EU's adoption of ISSA 5000 as under consideration "subject to the outcome of the European Commission's development of a Delegated Act to adopt standards for mandatory limited assurance on sustainability reporting, based on ISSA 5000" (IAASB, ISSA 5000 adoption). In the meantime, EU issuers' statements are limited-assurance conclusions under the standards each member state applies.
Reasonable vs limited assurance for GHG figures, market by market
For greenhouse gas figures, the level an investor will see depends on where the issuer reports, and in most markets the answer is limited assurance, phased in, over a narrow scope. The table sets out what the regulators have said.
Where mandatory assurance of sustainability figures stands, by market
| Market | Level and scope | Status, as published |
|---|---|---|
| European Union | Limited assurance; the requirement to adopt reasonable assurance standards removed | Omnibus directive in force March 18, 2026; EU limited assurance standards due by July 1, 2027 |
| Japan | Mandatory assurance one year after mandatory SSBJ reporting; "limited to some specific information for the first two years" | FSA roadmap released January 8, 2026; largest Prime companies report from the fiscal year ending March 2027 |
| Korea | Third-party verification from 2030, two years after disclosure starts | FSC roadmap of July 8, 2026; requires a change to the capital markets law |
| United States | The SEC's 2024 climate rules required an attestation report for Scope 1 and 2 emissions, phased in | Stayed in April 2024; the SEC voted to end its defence on March 27, 2025; rescission proposed May 29, 2026, published June 3, 2026 |
The US line deserves precision because the rules' status has changed several times since 2024. The SEC's 2024 rules would have required registrants disclosing Scope 1 or 2 emissions to "file an attestation report of those emissions subject to phased-in compliance dates". The Commission stayed the rules pending litigation, and on March 27, 2025 "voted to end its defense of the rules" (SEC press release 2025-58). Its rescission proposal, published on June 3, 2026, states that the rules "were never codified in the Code of Federal Regulations" because of the stay, and proposes to rescind them (91 FR 33296). US issuers' GHG assurance, where it exists, is therefore voluntary, and its scope is whatever the issuer bought.
Does ESG assurance cover Scope 3? Read the scope paragraph
Often not, and the statement will say so if you read the right paragraph. ISSA 5000 requires the conclusion to identify "the sustainability information subject to the assurance engagement" and the level of assurance, "either reasonable or limited or different levels of assurance for different parts of the sustainability information" (ISSA 5000, paragraph 190(c)). Whatever is not named there was not assured.
Identifies or describes the sustainability information subject to the assurance engagement, including, if appropriate, the sustainability matters and how that information is reported.
ISSA 5000, paragraph 190(c)(iv)
The fictional sample shows how much depends on it. The Korean issuer's limited assurance statement, on page 148 of its report, covers Scope 1, Scope 2 and energy; its Scope 3, 9.86 million tonnes across five categories, sits outside. Another sample issuer's statement covers its UAE sites only, 71% of its Scope 1. Treated as "assured" at the issuer level, both would overstate what was checked.
One season's assurance questions in the fictional sample
38
open exceptions about assurance scope on one day of the season
71%
of one issuer's Scope 1 inside its assurance scope (UAE sites only)
9.86Mt
of one issuer's Scope 3 outside an otherwise assured report
How to read an ESG assurance statement in five minutes
Read it in the order ISSA 5000 makes practitioners write it: the conclusion section first, because it carries the level, the subject matter, the period and the criteria. Then look for anything that modifies the conclusion.
Seven things to take from an assurance statement before you trust a figure
- The heading
"Limited Assurance Conclusion" or "Reasonable Assurance Opinion"; a prefix of "Qualified", "Adverse" or "Disclaimer of" changes everything.
- The level, part by part
Reasonable for some figures and limited for others is allowed; note which is which.
- The information covered
The exact metrics, scopes, sites and categories named. Anything not named was not assured.
- The period
The reporting year assured, which should match the year of the figure you take.
- The criteria
The framework or the company's own criteria the information was measured against, such as the GHG Protocol or ESRS.
- The entity
The group or the parent: an assurance on the parent alone does not cover a consolidated figure.
- The standard and the practitioner
ISSA 5000, ISAE 3000 or 3410, or a national standard, and who signed.
The entity line catches a quiet error. If an issuer's consolidated Scope 2 comes from its sustainability report but the assurance statement covers only the parent company's filing, the consolidated figure is unassured. Matching the boundary of the figure to the boundary of the statement takes a minute and changes the score.
What assurance does to the data-quality score
In the financial industry's data-quality scale, the difference between a score of 1 and a score of 2 is verification: "Verified emissions of the company are available" against "Unverified emissions calculated by the company are available" (ECB Banking Supervision, Table A, reproducing PCAF). The scale does not say whether limited assurance counts as verification, so a firm must write its own rule. IFRS S2 points the same way for value-chain data: a company "shall prioritise Scope 3 greenhouse gas emissions data that is verified" (IFRS S2, B53).
The sample template's rule is short and testable: score 1 for "signed limited or reasonable assurance that covers the figure"; a reported figure outside that scope scores 2. The rule puts the weight on coverage rather than level, which is the right emphasis while limited assurance is the norm. What each score means, and how holdings move up the scale, is covered in its own guide.
What ESG assurance is worth to an investor, and what it is not
Assurance tells an investor that the issuer's figure survived an independent check of the kind and scope described. It does not tell the investor that the investor's own reading of that figure is right. A wrong unit, a parent-only figure taken for a consolidated one, or a figure from the wrong year are the investor's errors, and no issuer-side assurance catches them.
That is why the two checks belong together. The issuer's assurance covers the figure as published; the investor's own controls, a second reading, a units step, a plausibility check and a second signature, cover the figure as used. A statement that publishes a correctly assured number in the wrong unit has the worst of both. For companies preparing their own figures for assurance, the relevant solution is ESG Data Assurance Readiness; this page is about reading other companies' statements.
How ESG Data Extraction reads the scope, figure by figure
In ESG Data Extraction, an assurance agent reads the assurance statement and its scope, page by page, and proposes a data-quality score for each scope. It never moves a score; the score changes when a steward approves the issuer. Where a statement's scope is partial, by site, by scope or by entity, the agent raises an exception for an analyst rather than generalising.
The issuer review in ESG Data Extraction: assured figures scored 1, the rest scored as reported
Partial assurance scopes go to an analyst as exceptions
The rest of the reading, the units, the boundaries and the second reader, is set out in two readers, one table; the solution is at ESG Data Extraction.
Questions people ask
What is ISSA 5000?
It is the IAASB's International Standard on Sustainability Assurance 5000, General Requirements for Sustainability Assurance Engagements, issued in November 2024. It covers both limited and reasonable assurance on any sustainability information and is effective for periods beginning on or after December 15, 2026, with earlier application permitted.
Is limited assurance the same as an audit?
No. An audit of financial statements gives reasonable assurance. Limited assurance involves fewer procedures and a negative-form conclusion; ISSA 5000 requires the report to state that the assurance obtained is substantially lower than in a reasonable assurance engagement.
Who can provide ESG assurance?
That depends on the jurisdiction. Japan's roadmap says assurance providers must be registered, with both audit firms and other providers eligible if they meet the requirements. Under ISSA 5000, the report must state that the practitioner complies with independence and other ethical requirements, and name them.
Does limited assurance cover the whole sustainability report?
Only if the statement says so. ISSA 5000 requires the conclusion to identify the information subject to the engagement, and many statements name specific metrics, scopes or sites. Anything not named was not assured.
Will EU companies ever need reasonable assurance?
Not under the law as amended in 2026. The Omnibus directive removed the requirement for the Commission to adopt reasonable assurance standards, and postponed the limited assurance standards to July 1, 2027. A company can still choose reasonable assurance voluntarily.