The Assurance Gap in Sustainability Reporting

Independent assurance is what is supposed to turn sustainability claims into something an outside reader can rely on. Across a sample of 50,000+ sustainability reports in our database, we find that fewer than half (42.9%) carry any assurance at all. And of the reports that do, nearly nine in ten receive only the lighter "limited" grade rather than audit-strength "reasonable" assurance. The assurance gap is wide, uneven, and closing only slowly.

Why assurance exists

In sustainability reporting, companies choose their own indicators, draw their own reporting boundaries, and decide what to highlight. Similar to financial reporting, assurance exists to give stakeholders a reason to trust the result without re-performing the work.

Assurance in sustainability reporting is also young. For instance, the dominant standards (ISAE 3000 and AA1000AS) only matured in the late 2000s, and the first purpose-built international standard, the IAASB's ISSA 5000, was approved only in September 2024 and takes effect for periods beginning after 15 December 2026.¹ The trajectory, as IFAC frames it, is "a future where sustainability information earns the same level of trust as financial reporting."²

Our data shows how far off that future still is.

Fewer than half of reports are assured

To measure the gap cleanly, we take every report in our database classified as a sustainability report (report_type = SR), written in English, and at least 25 pages long (keeping only substantial disclosures). That leaves 56,565 reports from 14,512 companies across 122 countries. We focus on the period between 2014 and 2025. Across this sample we ran our in-house data extraction tool across different dimensions of assurance.

We find that just 42.9% carry an assurance statement of any kind. That is far below the numbers usually quoted. For instance, IFAC reports that 73% of G20 large caps assured something in 2023². However, our sample is based on a much more diverse population (not just the large caps). Most of the world's sustainability reporters are mid-size and smaller firms that have started publishing but have not yet started paying for assurance.

The trend has an interesting shape. The assurance rate actually fell through the late 2010s, from 53% in 2014 to 38% in 2020. We believe that this is not because companies stopped assuring but because first-time reporters flooded in faster than assurance could spread to them. Since 2020 it has climbed back to 43%, probably because of CSRD preparation and a wave of national mandates that pulled assurance up the maturity curve.

We also find noticeable geographical variations. Companies in Africa (59%) and Europe (53%) assure far more often than their counterparts in North America (37%) or the Middle East (26%). At the country level, companies in South Korea (95%), Taiwan (77%) and Italy (67%) frequently engage in assurance, while Hong Kong (23%), Singapore (22%) and Indonesia (19%) rarely do.

Most assurance is only limited

Not all assurance is equal, and providers usually offer two levels. Reasonable assurance is a positive opinion, that the information is fairly stated, and it requires substantive testing (the same standard applied to financial statements). Instead, limited assurance is a double negative: nothing came to the assurer's attention to suggest the numbers are wrong, based mainly on inquiry and analytical review. There are clear cost reasons why companies prefer opting for limited assurance: EFRAG put first-year limited assurance at roughly €108,000–162,000 per reporter, against €246,000–394,000 for reasonable.³

Among the 18,088 reports where we could read the assurance level, 88.6% are limited, just 8.7% reasonable, and 2.4% a hybrid of the two. Reasonable assurance is not spreading quickly either: its share dipped below 8% around 2020 and has only recovered toward 12% as a handful of European leaders upgraded ahead of CSRD. So the true coverage of audit-strength assurance across the whole sample is not 43%, but is actually closer to 4% (!).

That looked set to change by regulation, but unfortunately the push has softened recently. The EU's Omnibus I directive (in force February 2026) dropped the planned escalation from limited to reasonable assurance and cut roughly 90% of in-scope entities.⁴ The reasonable-assurance trajectory now survives mainly outside Europe. California's SB 253 requires reasonable assurance on Scope 1 and 2 from 2030, and Australia's regime phases up to full reasonable assurance from mid-2030.⁵

Other findings

For the reports that are assured, we further find two patterns that stand out.

Who signs. Roughly a third of named providers are the Big 4 accounting firms (PwC, KPMG, EY, Deloitte), about a quarter are testing-and-certification specialists (SGS, Bureau Veritas, DNV, BSI, LRQA), and the rest are regional or boutique assurers. The accountants bring data-integrity discipline; the specialists bring stakeholder and operational depth. When an audit firm is engaged, 99% apply ISAE 3000 or a national equivalent.²

Which standard. ISAE 3000 and its national cousins dominate (47%), AA1000AS holds a quarter, ISO 14064 covers GHG-only work, and ISSA 5000, the standard meant to unify the field, appears in just 42 reports so far. That number is the single clearest sign of how early this all still is.

Closing the assurance gap

We find an assurance gap in sustainability reporting. Most sustainability reports are not assured at all, and of those that are, most carry only limited assurance. The consequence is that a large share of the sustainability data companies publish, and that investors, regulators and researchers increasingly rely on, has never been independently verified. In financial reporting, where an audit is the baseline expectation for any listed company, that would be unthinkable.

The gap should narrow as ISSA 5000 takes effect and mandates take hold. Until then, sustainability data is best read with that caveat in mind.

References

1. International Auditing and Assurance Standards Board (IAASB). (2024). International Standard on Sustainability Assurance (ISSA) 5000: General Requirements for Sustainability Assurance Engagements. Approved 20 September 2024; effective for periods beginning on or after 15 December 2026.

2. IFAC, AICPA & CIMA. (2025). The State of Play in Sustainability Assurance: Benchmarking Global Practice 2019-2023. IFAC, May 2025.

3. EFRAG. (2022). Cost-Benefit Analysis of the First Set of Draft European Sustainability Reporting Standards. EFRAG, November 2022.

4. European Parliament and Council. (2026). Directive (EU) 2026/470 ("Omnibus I") amending Directives 2013/34/EU, 2022/2464/EU and 2024/1760/EU. Official Journal of the European Union, 26 February 2026.

5. California Air Resources Board (CARB). (2026). Climate Corporate Data Accountability Act (SB 253) Implementing Regulation. Finalised 26 February 2026; AUASB, ASSA 5000 and ASSA 5010 Assurance Standards, January 2025.