Preparing for CSRD Assurance: An Auditor's Perspective on Double Materiality, Scope 3, and ESRS Readiness
As organizations advance their CSRD reporting efforts, understanding assurance expectations is essential. During a recent webinar, Danielle Stapleton, Program Manager for ESG Assurance, shared an auditor’s perspective on what assurance providers will be looking for, including governance structures, internal controls, documentation practices, data quality, and the evidence needed to support reported disclosures. As a follow-up to our webinar, Danielle is answering an additional series of questions relative to CSRD and the broader European Sustainability Reporting Standards (ESRS).
What are the biggest challenges companies face in preparing for CSRD assurance?
One of the biggest challenges organizations face in preparing for CSRD assurance is data collection. Many companies are being asked to report on sustainability topics that extend far beyond what they have historically measured, monitored, or disclosed. This often includes environmental, social, governance, and value-chain information that may reside in different functions across the organization.
The challenge is not simply obtaining the data. Organizations must also maintain a complete audit trail demonstrating where the information came from, who owns it, how it was calculated, and what supporting evidence exists. For companies that are new to sustainability reporting, these requirements can feel overwhelming because they often involve assembling information from operations, human resources, procurement, finance, legal, and external suppliers.
From an assurance perspective, one of the most common gaps is not necessarily incorrect data, but insufficient documentation. Teams may have performed the work and reached reasonable conclusions, but they cannot clearly demonstrate how those conclusions were reached. Auditors will consistently look for evidence that supports reported information and allows them to retrace management's decisions.
How can organizations improve the quality and reliability of their ESG data before seeking assurance?
Auditors cannot prescribe how companies should improve their reporting processes, but they can explain what they look for. The key attribute is traceability. Auditors want to connect reported information directly back to supporting evidence. For worker health and safety disclosures, this may include incident reports, safety management systems, and corrective action records. For greenhouse gas (GHG) emissions, auditors may review invoices, utility records, calculation files, and emission-factor documentation. Strong ESG reporting is built on repeatable, documented processes rather than standalone calculations.
For non-traditional metrics, data can often live with supply chain owners, other departments, like HR and Payroll, for example. These are not typical sources for a GHG emissions audit and require some work on the organization’s side to bring other teams up to speed on the timing and traceability demanded by an audit. Strong ESG reporting is built on repeatable, documented processes rather than standalone calculations.
What Role Do Internal Controls and Governance Play in Achieving Successful CSRD Assurance?
Internal controls are an important factor in auditor confidence. Auditors assess how data enters reporting systems, who reviews it, how changes are approved, and whether governance structures support data integrity. Organizations with well-defined roles, documented controls, and management oversight typically have a stronger foundation for assurance. While auditors cannot advise on specific implementation approaches, governance and controls are often among the first areas evaluated during assurance procedures.
How can companies turn CSRD compliance into a strategic advantage rather than just a regulatory obligation?
Many organizations initially approach CSRD as a reporting requirement, but CSRD can create value beyond compliance. In addition to the mandatory requirements, the CSRD framework also includes voluntary reporting standards that can help organizations communicate sustainability performance in a way that is proportionate to their size and maturity.
Sustainability reporting often uncovers opportunities for energy reduction, operational efficiencies, supplier-risk management, and resource optimization. The Double Materiality Assessment can identify emerging business risks and opportunities, helping management make more informed decisions and align sustainability initiatives with corporate strategy. Organizations also increasingly pursue voluntary reporting because market expectations and competitor disclosures are raising the bar across industries.
How can organizations improve the quality and reliability of ESG data before seeking assurance?
The most important characteristic of high-quality ESG data is traceability. Auditors want to understand exactly how reported metrics connect back to supporting evidence.
If a company reports worker safety metrics, auditors may review incident reports, safety management systems, corrective action records, training logs, and supporting documentation. If a company reports GHG emissions, auditors may review utility invoices, fuel consumption records, calculation files, emission factors, and management review procedures.
Regardless of the topic, the key question remains the same: can the organization demonstrate how the information was generated and show evidence supporting its accuracy? Strong ESG reporting is built on repeatable processes rather than isolated calculations.
What role do internal controls and governance play in achieving successful CSRD assurance?
Internal controls and governance are foundational to successful assurance outcomes because they help establish confidence in the integrity, completeness, and reliability of reported information. Auditors evaluate not only the disclosure itself but also the process used to collect, review, approve, and maintain the underlying data.
Organizations should be able to explain ownership, review procedures, management oversight, and accountability structures. Governance is frequently one of the first areas examined during assurance because it influences confidence in every reported metric.
How can companies turn CSRD compliance into a strategic advantage rather than just a regulatory obligation?
CSRD can create value beyond compliance. The reporting process often uncovers opportunities for efficiency gains, cost reductions, supplier risk management, and improved operational performance.
The Double Materiality Assessment can provide insights into emerging risks and opportunities that may not have been identified through traditional risk management processes. Organizations that use CSRD as a management framework rather than a reporting exercise often find opportunities for stronger decision-making and long-term value creation.
Double materiality: Focus on process, not just outcomes.
Auditors are generally less concerned with the outcome of a double materiality assessment than with the process used to reach conclusions. Organizations should clearly document stakeholder engagement, evidence reviewed, value-chain impacts considered, and how decisions were made. Throughout the process, teams should be asking how they will demonstrate and defend their conclusions during assurance.
What evidence is needed for ESRS E1 disclosures?
Data perfection is not required, particularly for Scope 3 emissions where estimates are often necessary. However, organizations should maintain thorough documentation of data sources, assumptions, emission factors, methodologies, and calculation approaches. The most effective defense of a reported figure is a complete and transparent audit trail.
Build the internal controls auditors expect.
Key controls include data traceability, methodology consistency, documented double materiality assessments, formal risk assessments, and review procedures. Auditors want to see that organizations can consistently reproduce their disclosures and explain any changes in methodology over time.
Transition plans require more than narratives.
Transition-plan disclosures should be supported by documented approval processes, governance oversight, climate targets, baseline years, methodologies, recalculation policies, scenario analyses, implementation actions, and monitoring activities. Organizations should also maintain evidence for claims involving carbon credits, removals, and net-zero roadmaps.
Assurance Readiness vs. Independent Assurance
Assurance-readiness support is designed to help management identify weaknesses and prepare for future assurance. Independent assurance evaluates the information management has prepared and results in a formal conclusion. Readiness helps identify gaps, while assurance assesses whether reporting is supportable.
Scope 3 Reporting and Supplier Data
Organizations are moving beyond spend-based estimates and increasingly engaging suppliers directly. ESRS recognizes that estimates will remain necessary, but companies should be able to explain methodologies, assumptions, and data sources. CSRD does not require data from every supplier. Instead, reporting should focus on obtaining sufficient information to understand and disclose material impacts, risks, and opportunities.
AI Ethics and Data Privacy
As sustainability reporting expands beyond environmental metrics, AI governance and data privacy may become increasingly relevant. Auditors may evaluate governance structures, policies, controls, oversight mechanisms, and monitoring processes where AI use or data management creates material sustainability impacts or risks.
Is your sustainability data mature enough for assurance?
Many first-time reporters worry their data is not mature enough. In practice, governance and documentation often matter more than perfect metrics. A company with imperfect data and strong controls may perform better during assurance than one with precise metrics but limited supporting documentation. Voluntary reporting and practice assurance exercises can help identify weaknesses before mandatory filing.
Final Takeaway
Companies do not need perfect sustainability data on day one, but they do need clear ownership, documented methodologies, traceable evidence, and defensible processes. Organizations that start early and focus on governance and documentation will be better positioned for successful CSRD compliance and assurance.
Have more questions about CSRD, ESRS, or ESG assurance?
SCS Global Services is here to support companies wherever they happen to be along their CSRD compliance and ESG assurance journeys. For more information and additional support, be sure to watch our webinar replay, peruse our in-depth discussion of ESG assurance, and feel free to get in touch with us directly.