How to Choose an ESG Assurance Provider: A Buyer's Guide

Most guidance on selecting an assurance provider starts with evaluation criteria. That is the wrong place to begin, because in several jurisdictions you do not get to choose.

If you report climate statements in Australia, the assurance sits with the auditor of your financial report. The decision is made for you. If you report in Singapore, the market is deliberately open to firms that are not accountants at all. If you report BRSR Core in India, the profession does not matter but the independence rules will disqualify the consultant who built your inventory.

So the first question is not who is best. It is who is permitted, in each place you report. Only then does the selection exercise begin.

This guide works through both, and it assumes you are buying assurance across more than one jurisdiction, because most companies of the size now caught by these rules are.

First, Establish Whether You Have A Choice

Eligibility rules vary more than the underlying standards do. A single provider relationship will not serve every market.

Australia. The auditor of the financial report provides the assurance over climate information. This maximises connectivity between financial and sustainability reporting and leans on existing auditor independence infrastructure. It also means your provider decision was effectively made when you appointed your statutory auditor.

Singapore. Assurance must come from a registered climate assurance provider, which can be either an audit firm registered with the regulator or a testing, inspection and certification firm accredited by the national accreditation body. That deliberately admits engineering and verification specialists alongside accountants.

India. BRSR Core assurance or assessment is profession-agnostic. Chartered accountants, company secretaries, cost accountants and other qualified firms are all eligible provided they meet the standards. What binds instead is a strict independence regime, discussed below.

Japan. Assurance providers must be registered, and both audit firms and other providers are eligible if they meet the requirements. The market is being opened deliberately to expand capacity.

European Union. The default is that your statutory auditor expresses the conclusion. Member States may also permit a different statutory auditor, or an independent assurance services provider, known as an IASP, which can sit outside the audit profession entirely. Two conditions attach to IASPs: accreditation for sustainability assurance under the EU accreditation regulation, and compliance with requirements equivalent to those the Audit Directive imposes on statutory auditors, covering education, quality management and ethics.

Whether the option has been exercised genuinely differs by country. Some Member States permit only the financial statement auditor. Others permit a different auditor, an IASP, or both. France is reported to allow IASPs and the Netherlands to allow both routes, but this is determined by national transposition and should be confirmed locally rather than assumed.

One provision worth diarising: from 6 January 2027, a Member State that allows IASPs on its territory must also allow IASPs established in other Member States to operate there. For a group reporting across several EU countries, that opens cross-border options that do not exist today.

United Kingdom. Assurance is not mandatory. What is required is disclosure of whether you obtained it and under which standard. That makes this a commercial decision rather than a compliance one, and it means the quality signal matters more than the box being ticked.

California. Limited assurance over Scope 1 and Scope 2 begins with reports submitted in 2027, with the regulator proposing a defined list of acceptable standards.

Carbon border adjustment. Verification of embedded emissions requires a verifier accredited under the relevant international accreditation standard for greenhouse gas validation and verification bodies. An assurance provider who signs your sustainability report is not automatically qualified for this.

The practical consequence is that a group reporting in Australia, Singapore and India cannot run a single procurement. It needs a mapped position by entity, and it should expect to appoint more than one firm.

Understand What You Are Actually Buying

Limited and reasonable assurance are not degrees of the same product. They are different engagements with different evidence requirements, different costs and different conclusions.

Limited assurance is a review. The provider performs enough work to state that nothing has come to its attention suggesting the information is materially misstated. The conclusion is negative in form. Procedures lean toward enquiry and analytical review rather than substantive testing.

Reasonable assurance is closer to a financial audit. The provider tests controls and underlying data sufficiently to express a positive opinion that the information is free from material misstatement. It costs considerably more, takes longer, and will expose weaknesses in your data architecture that limited assurance would not surface.

Where each applies varies, and the trajectory is not uniform. Australia escalates from limited to reasonable, reaching an end state of reasonable assurance over the whole report for financial years commencing on or after 1 July 2030. India requires reasonable assurance or an equivalent assessment on the BRSR Core attributes now. The European Union requires limited assurance and specifically dropped its planned escalation to reasonable. Singapore's published roadmap stops at limited assurance.

Two buying implications follow.

If you face reasonable assurance anywhere, that engagement sets your data quality bar globally, because it is easier to apply one standard of rigour than to maintain two. And if you are currently buying limited assurance in a jurisdiction that will escalate, ask prospective providers how they will phase the work, because a firm that treats year one as a light-touch review will make year four considerably more painful.

The Standard Matters As Much As The Firm

Buyers routinely select a provider and let the provider select the standard. That is backwards, because the standards differ in character and the choice has downstream consequences.

ISSA 5000 is the international standard for sustainability assurance, effective for periods beginning on or after 15 December 2026 and superseding the older greenhouse gas assurance standard. It is framework-neutral, applies to limited and reasonable engagements, and covers sustainability information broadly. Australia has adopted it domestically, and the United Kingdom has a domestic version effective for periods beginning on or after 15 December 2026.

ISO 14064-3 is the greenhouse gas verification standard. It is prescriptive rather than principles-based, offering specific procedures for verifying emissions. Singapore accepts it alongside an ISSA 5000 equivalent, and deliberately limited the list to two because accepting more would create inconsistency.

ISAE 3000 and 3410 remain in use during the transition. AICPA standards apply in the United States, with separate standards for limited and reasonable engagements. AA1000AS remains recognised in some regimes.

The selection logic is straightforward once framed properly. If you are assuring greenhouse gas emissions only, and expect to continue doing so, the ISO route is a close technical fit and may be cheaper. If you anticipate broader sustainability assurance later, covering social or governance disclosures, building under ISSA 5000 from the start avoids a migration. Ask candidates which standards they are qualified to work under, and make sure the answer covers where you will be in three years, not just where you are now.

The Independence Trap

This is the failure mode that costs companies the most, because it is usually discovered late.

The firm that helped you build your emissions inventory very likely cannot assure it. India's regime is the clearest illustration. The provider and its associates cannot sell products to the listed entity or its group, and cannot provide non-audit or non-assurance services including consulting, risk management, internal audit, project management or general management services. Some activities that are themselves audit or assurance in nature may be acceptable, but the line is fine, and the onus sits with the company and its audit committee to test it rather than with the provider to volunteer a conflict.

The principle generalises. Every credible assurance regime restricts self-review, and a provider assuring its own advisory work is the textbook case.

Three practical consequences.

Sequence your procurement so that readiness support and assurance go to different firms, or at minimum confirm in writing that your intended assurance provider is not conflicted by prior advisory work. Ask the question during the tender, not after appointment.

Remember that group relationships count. A conflict at network firm level in another country can disqualify the local entity you wanted to appoint.

There is also a provision most buyers do not know about. Under CSRD, shareholders holding more than 5 per cent of voting rights or capital can require an accredited third party to report on specified elements of the sustainability reporting, and that third party cannot belong to the same firm or network as the statutory auditor. If you have a concentrated or activist shareholder base, that is a live possibility rather than a theoretical one, and it is worth factoring into how you allocate work between firms.

And be aware of the trade-off you are making. There is a genuine argument that using your financial statement auditor improves connectivity between financial and sustainability information, which is why Australia mandates exactly that. There is an equally genuine argument that a separate provider brings independence and specialist technical depth. Neither is wrong. What matters is that the choice is deliberate.

Sector And Technical Expertise

Generic assurance capability is not the same as understanding your emissions profile.

Ask candidates what they have assured in your sector, and be specific about the parts of your inventory that are technically hard. Process emissions in cement, chemicals or steel behave differently from a services firm's electricity consumption. Financed emissions require methodology expertise most general providers lack. Land use, agriculture and forestry raise measurement questions that are genuinely contested. Product-level and installation-level footprinting, needed for carbon border adjustment, is a different discipline again.

Two more capability questions worth asking. Can the provider handle your organisational boundary, particularly joint ventures, minority stakes and recently acquired entities? And can it work across your geographies, or will it subcontract, and if so to whom and under what quality control?

Scope 3 deserves separate attention. Value chain emissions are the hardest thing to assure and the area where methodologies are still moving. Ask how the provider approaches estimated data, what it expects in terms of documentation for spend-based figures, and how it treats supplier-provided data of uncertain quality. A provider without a clear answer will improvise during the engagement, which is expensive.

Capacity Is The Constraint Nobody Prices In

Every jurisdiction that has introduced mandatory assurance has encountered the same bottleneck, and the timing is now converging. European reporters, Australian entities escalating toward reasonable assurance, Californian filers, Indian listed companies and Japanese first-cohort reporters are all in the market during overlapping periods.

Two responses are visible from regulators. Singapore and Japan have deliberately opened provider eligibility beyond audit firms. Singapore has also launched a body of knowledge setting out the competencies expected of sustainability assurance professionals and is working with training providers to build supply. Those are direct admissions that capacity is finite.

For a buyer, this means engaging early is not merely prudent, it is a pricing decision. Firms allocate scarce senior resource across a reporting season, and late arrivals get junior teams and compressed timelines. It also means checking that the provider's capacity commitment is contractual rather than aspirational, and asking who specifically will lead the engagement rather than accepting a firm-level assurance of availability.

Questions Worth Asking In A Tender

A workable shortlist, in rough order of decision weight.

Which jurisdictions can you sign in, and under what registration or accreditation. Which assurance standards are you qualified to apply. What comparable engagements have you completed in our sector, and can we speak to those clients. Are you conflicted by any advisory work performed for us or our group. Who will lead the engagement and what is their sustainability assurance experience specifically. How do you approach Scope 3 and estimated data. What will you need from us and by when. How will your scope and effort change as we move from limited to reasonable assurance. What is your view on the weaknesses you would expect to find in a company at our stage. And what is the fee, broken down by phase, with the assumptions that would change it.

That last one matters more than it looks. Assurance fees quoted against optimistic assumptions about data readiness are a common source of overruns.

Getting The Timing Right

The most common sequencing error is appointing a provider when the obligation starts rather than before it.

Engage informally a year ahead of your first mandatory engagement and run a dry run. Putting your own numbers through the questions an assurer will ask surfaces weaknesses while there is still time to fix them cheaply. Providers will generally do this as a readiness exercise, and the cost is trivial against the cost of failing a live engagement.

Where you have a deferral, use it for exactly this. Jurisdictions with several years between first reporting and first assurance have effectively given companies a rehearsal window. Companies that use it arrive at their first engagement with traceable data, documented methodology and labelled estimates. Companies that do not arrive with four years of accumulated practice that was never built to be examined.

The underlying point is that choosing an assurance provider is a procurement decision constrained by regulation, shaped by your own data maturity, and best made a year earlier than feels necessary. Get the eligibility mapping right first, treat the standard as a decision rather than a detail, take the independence question seriously before you shortlist, and buy on technical depth in the parts of your inventory that are actually difficult.

Buyer's Checklist

Map provider eligibility by jurisdiction before shortlisting, since Australia mandates your financial auditor while Singapore, India and Japan open the market more widely.
Confirm whether you need limited or reasonable assurance in each market, and identify the strictest requirement you face.
Choose the assurance standard deliberately, weighing a greenhouse gas verification standard against a broader sustainability assurance standard based on where you will be in three years.
Test independence early, including advisory work performed by network firms in other countries, and note the CSRD right of shareholders above 5 per cent to require a separate accredited third party report.
Decide consciously between your financial statement auditor and a separate provider, weighing connectivity against independence and technical depth.
Probe sector-specific capability on the hard parts of your inventory rather than general assurance experience.
Ask specifically how the provider handles Scope 3, estimated data and supplier-provided figures.
Confirm the provider can cover all your geographies, and ask about subcontracting and quality control.
Name the engagement lead in the contract rather than accepting firm-level capacity assurances.
Engage a year before your first mandatory engagement and run a dry run.
Obtain fees broken down by phase, with the assumptions that would change them.
Check accreditation separately for specialist verification such as carbon border adjustment, which your sustainability assurer may not hold.

Position as of August 2026. Assurance requirements, provider eligibility rules and acceptable standards differ by jurisdiction and several are still being finalised. Confirm current requirements with the relevant regulator in each market before appointing a provider, and take professional advice for your circumstances.

Sources

International Auditing and Assurance Standards Board, Auditing and Assurance Standards Board of Australia, Australian Securities and Investments Commission, Accounting and Corporate Regulatory Authority of Singapore, Singapore Exchange Regulation, Securities and Exchange Board of India, Financial Conduct Authority, California Air Resources Board, European Commission, Directive 2013/34/EU, Regulation (EC) No 765/2008 on accreditation, Committee of European Auditing Oversight Bodies, Accountancy Europe, ICAEW, PwC, RSM, TÜV-Verban, Financial Services Agency of Japan, ISO 14064-3 and ISO 14065, American Institute of Certified Public Accountants, AccountAbility, IFRS Foundation