ISSA 5000

General Requirements for Sustainability Assurance Engagements

1Objective and scope

ISSA 5000 establishes the general requirements for assurance engagements on sustainability information reported by an entity, whether prepared under IFRS S1 and S2 (the ISSB standards), the GRI Standards, the European Sustainability Reporting Standards, a regulator's framework or the entity's own criteria, and whether the information is a stand-alone sustainability report, part of an annual or integrated report, or a set of selected metrics. It is a principles-based, framework-neutral, profession-agnostic standard (any competent assurance practitioner, not only accountants, may apply it, subject to ethical and quality management requirements at least as demanding as the IESBA Code and ISQM 1), and it covers both limited and reasonable assurance in a single standard, with the requirements for each set out separately where they differ. It supersedes the use of ISAE 3000 (Revised) for sustainability engagements and is applied together with ISAE 3410 where a GHG statement is within scope. It is effective for assurance reports on sustainability information for periods beginning on or after 15 December 2026, with early application permitted. Kenyan relevance: the NSE ESG disclosures guidance manual, the CMA's expectations for listed companies, the CBK's climate risk guidance for banks, and the growing demand from export customers and lenders for assured sustainability data.

The objectives are to obtain either limited or reasonable assurance, as appropriate, about whether the sustainability information is free from material misstatement, whether due to fraud or error; to express a conclusion through a written report that conveys the assurance obtained and describes the basis for the conclusion; and to communicate further as required by the standard.

2Key definitions

3Requirements

Ethics, quality, competence and acceptance

• Comply with ethical requirements at least as demanding as the IESBA Code including its International Independence Standards (and the IESBA's sustainability-specific ethics provisions), and apply a system of quality management at least as demanding as ISQM 1; the engagement partner takes overall responsibility for quality and for the engagement.
• Ensure the engagement team collectively has the competence and capabilities, including in assurance skills, in the sustainability matters reported, in the criteria, and in the measurement and evaluation methods; use of experts (climate scientists, engineers, human rights specialists) follows the ISA 620 model, and other practitioners (a component's sustainability assurer) are directed, supervised and reviewed.
• Accept only where the preconditions are present: the roles of the parties are appropriate, the criteria are suitable and will be available to users, the practitioner expects to have access to evidence, the conclusion will be in a written report, the engagement has a rational purpose, and the scope (which topics, which metrics, which boundary, which level of assurance for each) is clearly defined and not so limited as to be misleading. Agree the terms, including the scope, the criteria, the level(s) of assurance and any restriction on use.

Planning, understanding and materiality

• Plan the engagement with an overall strategy and plan, involving the engagement partner and key team members, and with professional scepticism throughout, alert to the risk of greenwashing (overstating positive impacts, omitting negatives, vague or unverifiable claims).
• Obtain an understanding of the entity and its environment, the sustainability matters reported, the reporting boundary and value chain, the criteria, the entity's process for identifying material sustainability matters (and evaluate whether it is appropriate under the criteria), and the entity's system of internal control over the preparation of the sustainability information, including the information systems, the sources of data (often operational systems, spreadsheets and third-party data rather than the general ledger), and the use of estimates, proxies and forward-looking information.
• Determine materiality for the sustainability information, considering both quantitative thresholds for metrics (in their own units: tonnes, cubic metres, injury rates) and qualitative considerations for narrative and for disclosures where a misstatement could reasonably be expected to influence users' decisions; consider it for each material topic where the information is disaggregated.
• For reasonable assurance, identify and assess the risks of material misstatement at the level of the sustainability information as a whole and at the assertion level for each disclosure, considering inherent risk factors (complexity, subjectivity, uncertainty, change, susceptibility to management bias), and evaluate the design and implementation of relevant controls. For limited assurance, identify disclosures where material misstatements are likely to arise, based on the understanding obtained, with consideration of controls limited to inquiry about the process.

Evidence

• Consider the risk of fraud, including greenwashing and the manipulation of data to meet targets linked to remuneration or financing terms (sustainability-linked loans), and respond with heightened scepticism and unpredictable procedures.
• Consider laws and regulations relevant to the sustainability information (environmental permits, labour law, anti-corruption law) where non-compliance could cause a material misstatement, in the manner of ISA 250.
• Where component practitioners or other practitioners are involved, direct, supervise and review their work in the manner of ISA 600; where an internal audit or sustainability function's work is used, evaluate it in the manner of ISA 610.
• Obtain written representations from the appropriate parties covering their responsibilities, the completeness of the information provided, the materiality process, uncorrected misstatements, subsequent events and forward-looking assumptions; consider subsequent events up to the report date; read other information in the document for material inconsistency with the sustainability information; evaluate uncorrected misstatements against materiality; and evaluate the sufficiency and appropriateness of the evidence obtained before concluding.

Forming the conclusion

The practitioner evaluates whether the sustainability information is prepared, in all material respects, in accordance with the criteria, including whether the criteria are adequately described and the information is fairly and clearly presented and not misleading (balanced, not selectively positive), and forms an unmodified conclusion or modifies it (qualified, adverse or disclaimer) following the ISAE 3000 pattern, on the basis of the materiality and pervasiveness of misstatements or limitations. Where a single report covers some disclosures with reasonable assurance and others with limited assurance, the conclusions are stated separately and the report identifies which disclosures carry which level.

4Documentation and reporting

The assurance report is in writing and contains: a title indicating an independent assurance report; an addressee; identification of the sustainability information, the period, the reporting boundary and the criteria, and, where applicable, the parts of the report not covered; a statement of the level or levels of assurance, and which disclosures each applies to; a description of the entity's responsibilities (including for the materiality process, the criteria, the controls, and the underlying data) and the practitioner's responsibilities; a statement that the engagement was performed in accordance with ISSA 5000 and, where relevant, ISAE 3410; statements on independence and ethics and on the firm's system of quality management; a description of the inherent limitations of the engagement and of sustainability measurement where relevant (scientific uncertainty in emission factors, the estimation of value chain data, the nature of forward-looking information); an informative summary of the work performed, which for limited assurance states that the procedures are less in extent than for reasonable assurance and that the assurance obtained is substantially lower; the conclusion or conclusions, in the appropriate form, with a basis section where modified; any Emphasis of Matter or Other Matter paragraph, and where the criteria are designed for a specific purpose, an alert and a restriction on use; the signature, date and location. The practitioner documents the engagement in the manner of ISA 230: the understanding, the materiality process evaluation, the risk assessment or identification of likely misstatement areas, the procedures and evidence for each material topic, the work of experts and other practitioners, the misstatements, the representations, and the basis for the conclusion; and communicates with those charged with governance the planned scope and timing, significant findings, control deficiencies, fraud or suspected fraud, and matters affecting the report.

5Examinable focus