CSRD Pre-Assurance vs Assurance: How to Prepare for Both

The EU Corporate Sustainability Reporting Directive (CSRD) represents the most significant shift in corporate sustainability disclosure in history. For the first time, sustainability reports will be subject to mandatory independent assurance — bringing ESG data under the same kind of external scrutiny that has long applied to financial statements.

But many organisations are approaching their first CSRD assurance engagement without adequate preparation. This article explains why pre-assurance is essential, what it covers, how it differs from formal assurance, and how to build a practical timeline for compliance.

What Does the CSRD Require for Assurance?

The CSRD introduces mandatory assurance of sustainability reports for all companies within its scope. The key requirements are:

Assurance Level

• Initial requirement: Limited assurance on the sustainability report, effective from the first year of mandatory reporting for each wave of companies
• Planned evolution: Transition to reasonable assurance by 2028, subject to a feasibility assessment by the European Commission (expected to be adopted via delegated act)
• The gap: Limited assurance provides moderate confidence; reasonable assurance provides high confidence (equivalent to a financial audit). Most companies will have 3-4 years at limited assurance before the transition

What Must Be Assured

The assurance engagement under CSRD covers:

• Compliance of the sustainability report with ESRS (European Sustainability Reporting Standards)
• The process the company used to identify material sustainability matters (double materiality assessment)
• Compliance with the reporting requirements of Article 8 of the EU Taxonomy Regulation
• The digital tagging of sustainability information (XBRL taxonomy)

Who Can Provide Assurance

Under the CSRD, assurance can be provided by:

• Statutory auditors — the company's financial auditor or a different statutory auditor, provided they have the required sustainability assurance qualifications
• Independent Assurance Services Providers (IASPs) — non-audit firms accredited by national accreditation bodies specifically for sustainability assurance under CSRD requirements

Member states choose whether to allow IASPs alongside statutory auditors. This creates variation across the EU in who can provide CSRD assurance.

CSRD Applicability Waves

ESRS Reporting Standards and Assurance Scope

The European Sustainability Reporting Standards (ESRS) define what must be reported — and consequently, what the assurance provider must evaluate. Understanding ESRS structure is essential for both pre-assurance and formal assurance planning.

ESRS Structure

• Cross-cutting standards: ESRS 1 (General requirements) and ESRS 2 (General disclosures) — mandatory for all in-scope companies
• Environmental standards: ESRS E1 (Climate), E2 (Pollution), E3 (Water), E4 (Biodiversity), E5 (Circular economy) — applicable if material
• Social standards: ESRS S1 (Own workforce), S2 (Value chain workers), S3 (Affected communities), S4 (Consumers) — applicable if material
• Governance standards: ESRS G1 (Business conduct) — applicable if material

The assurance engagement must cover all ESRS disclosures included in the sustainability report. This means the scope of assurance is directly determined by the company's double materiality assessment — which identifies which topical standards are material.

Assurance Implications of ESRS

ESRS creates specific challenges for assurance that companies must understand:

• Quantitative and qualitative data: ESRS requires both numerical metrics and narrative disclosures — both must be assured
• Value chain data: Several ESRS standards require data from the value chain (suppliers, customers, communities), which is harder to verify
• Forward-looking information: ESRS requires targets, transition plans, and expected financial effects — the assurance provider must evaluate the basis for these forward-looking statements
• Connectivity: ESRS requires connectivity between sustainability information and financial statements — the assurance provider must evaluate this coherence

Why Pre-Assurance Is Critical for CSRD Success

Most organisations approaching CSRD for the first time significantly underestimate the data quality and process maturity required for assurance. Sustainability reporting systems are typically less mature than financial reporting systems, with weaker internal controls, less documented processes, and more reliance on manual data collection.

Common First-Year Assurance Challenges

Without pre-assurance preparation, organisations commonly face:

• Data quality issues: Incomplete data, estimation gaps, inconsistent methodologies across sites, missing source documentation
• ESRS compliance gaps: Missing mandatory disclosures, incomplete materiality assessments, insufficient narrative on policies and targets
• Control weaknesses: No formal review processes, no segregation of data preparation and review, no change management for reporting methodology
• Documentation deficiencies: Undocumented data collection processes, no audit trail from source to report, missing basis for estimates
• Scope and boundary confusion: Unclear consolidation rules for sustainability data, inconsistent inclusion of subsidiaries, joint ventures, or franchises

Pre-assurance identifies these issues when there is still time to fix them. Formal assurance, by contrast, identifies the same issues but reports them as findings — potentially leading to qualified conclusions.

What Pre-Assurance Covers

A comprehensive CSRD pre-assurance engagement typically includes five core work streams:

1. Gap Analysis Against ESRS Requirements

The pre-assurance team maps the organisation's current sustainability disclosures against all applicable ESRS requirements — identifying what is already covered, what needs to be developed, and what data needs to be collected. This produces a detailed gap register with prioritised remediation actions.

2. Data Quality Review

The team tests the accuracy, completeness, and consistency of sustainability data across key indicators. This includes:

• Tracing reported figures back to source records (utility bills, HR systems, procurement records)
• Testing calculations and aggregation logic
• Checking boundary consistency (are all entities included?)
• Evaluating estimation methodologies (emission factors, extrapolation methods)
• Identifying data gaps where records are missing or incomplete

3. Controls Assessment

The team evaluates the internal controls governing sustainability data:

• Who collects the data and how?
• Is there a review and approval process?
• Are responsibilities clearly assigned?
• Is there segregation between data preparation and reporting?
• How are errors identified and corrected?
• Is there a change management process for methodology changes?

4. Process Mapping

The team documents the end-to-end data flow from source systems to the sustainability report. This process map becomes the foundation for both internal control design and the formal assurance engagement, where the assurance provider will follow the same data trails.

5. Dry-Run Assurance

The most valuable element of pre-assurance is a dry-run simulation of the formal assurance procedures. The pre-assurance team performs the same types of inquiries, analytical procedures, and data testing that the formal assurance provider would perform — identifying likely findings and giving the organisation time to address them.

How Pre-Assurance Differs from Formal Assurance

Double Materiality Assessment Connection

The double materiality assessment is the foundation of CSRD reporting — and a critical focus of both pre-assurance and formal assurance.

What Assurance Providers Examine

The formal assurance provider must evaluate whether the company's double materiality assessment process was robust and its conclusions reasonable. This includes:

• Was the assessment process documented and systematic?
• Were appropriate stakeholders consulted?
• Were both impact materiality and financial materiality assessed?
• Are the materiality thresholds documented and defensible?
• Do the identified material topics align with the company's business model, sector, and value chain?
• Are there obviously material topics that were not identified (omission risk)?

Pre-Assurance Focus

In pre-assurance, the double materiality assessment receives particular attention because errors at this stage cascade through the entire report. If a material topic is missed, the corresponding ESRS disclosures will be absent — and the formal assurance provider will flag this. Pre-assurance reviews the materiality process and challenges the conclusions before the report is finalised.

For more on why independent verification is critical at this stage, see our article on why independent sustainability assurance matters.

Timeline: When to Start Pre-Assurance vs Formal Assurance

Timing is one of the most common planning failures in CSRD assurance preparation. Here is a recommended timeline:

Recommended CSRD Assurance Timeline

Cost Considerations and Budget Planning

CSRD assurance represents a new and significant cost for most organisations. Understanding cost drivers helps in budget planning and provider selection.

Pre-Assurance Cost Drivers

• Scope complexity: Number of entities, geographies, and ESRS topics in scope
• Current maturity: Organisations with less mature sustainability reporting need more extensive gap analysis
• Data landscape: Number and complexity of data sources, systems, and manual processes
• Sector specifics: High-impact sectors (energy, mining, chemicals) typically require more detailed pre-assurance

Formal Assurance Cost Drivers

• Level of assurance: Reasonable assurance costs 2-3x more than limited assurance
• Number of indicators: More indicators in scope means more testing
• Site visits: Multi-site organisations incur travel and on-site time
• Data quality: Poor data quality increases the time the assurance provider spends resolving queries — and can result in scope limitations or qualifications
• First-year premium: The first assurance engagement is always more expensive as the provider must understand the organisation from scratch

The Economics of Pre-Assurance

Pre-assurance typically costs 20-40% of the formal assurance fee. However, it can reduce the formal assurance fee by 15-25% by improving data quality and reducing the time the formal assurance provider spends on queries and issue resolution. More importantly, it dramatically reduces the risk of a qualified conclusion — which can damage stakeholder confidence and trigger additional remediation costs.

How Pre-Assurance Reduces Formal Assurance Risk

The primary value proposition of pre-assurance is risk reduction. Here is how it works in practice:

Finding Issues Early vs Finding Issues Late

• During pre-assurance (12+ months before): A missing Scope 3 category is identified → the organisation has time to establish data collection, select emission factors, and build a full year of data
• During formal assurance (2 months before publication): The same missing Scope 3 category is identified → it is too late to collect a full year of data → the assurance provider may scope-limit or qualify the conclusion

Common Pre-Assurance Findings That Prevent Qualifications

• GHG emissions data that does not reconcile to source records → fixed through improved data collection processes
• Double materiality assessment that omits stakeholder engagement → remediated by conducting proper stakeholder consultation
• Missing ESRS mandatory disclosures → drafted and integrated into the report
• Inconsistent reporting boundaries between environmental and social data → aligned through clear consolidation rules
• Undocumented estimation methodologies → documented, justified, and approved

Preparing for the Transition to Reasonable Assurance

The CSRD's planned transition from limited to reasonable assurance by 2028 means companies should not treat limited assurance as the end state. Reasonable assurance requires fundamentally stronger controls and data quality.

What Changes with Reasonable Assurance

• More extensive testing: The assurance provider tests a larger sample of data, including site visits to multiple locations
• Controls testing: Internal controls over sustainability data must be tested for operating effectiveness — not just existence
• Corroborative evidence: The provider seeks corroborating evidence from independent sources, not just management representations
• Positive conclusion: The conclusion changes from "nothing has come to our attention" to "in our opinion, the information is fairly stated" — a higher bar

How to Prepare

1. Invest in controls now: Build sustainability data controls that mirror financial reporting controls — formal review, segregation of duties, documented approval
2. Create audit trails: Ensure every reported figure can be traced from the sustainability report to source documentation
3. Automate where possible: Replace manual spreadsheet-based data collection with automated systems that reduce error risk
4. Build internal audit capability: Include sustainability data in your internal audit plan
5. Progressive scope expansion: Each year, bring more indicators to reasonable-assurance readiness

Your CSRD Assurance Action Plan

Regardless of which CSRD wave applies to your organisation, the following steps will help you prepare effectively:

1. Determine your wave and deadline: Confirm which CSRD wave applies and your first mandatory reporting year
2. Complete your double materiality assessment: This determines the scope of both your report and the assurance engagement
3. Commission a pre-assurance engagement: Engage a qualified provider for ESRS gap analysis, data quality review, and controls assessment
4. Remediate findings: Address pre-assurance findings systematically, prioritising issues most likely to result in assurance qualifications
5. Select your formal assurance provider: Begin the selection process 9-12 months before the formal engagement — see our guide on how to choose a sustainability assurance provider
6. Build toward reasonable assurance: Even in the limited assurance phase, invest in the controls and data quality that reasonable assurance will require