Companies are under growing pressure to prove their sustainability disclosures hold up, and assurance is supposed to be the mechanism that does that proving. The firms delivering that assurance are not always held to the same rigor themselves. Providers span accounting firms, engineering consultancies, certification bodies and specialist ESG shops, and their qualifications, independence rules, quality controls and regulatory oversight can differ substantially from one to the next. That leaves compliance leaders facing an old audit question in new form. Who checks the checker.
The answer is improving, slowly. A global sustainability assurance standard and a companion set of ethics requirements take effect in December 2026, and several countries have already adopted versions of it. Adoption, supervision and enforcement still depend heavily on individual jurisdictions and professional bodies, though, which means a company cannot treat an assurance statement as the end of its own due diligence.
ISSA 5000 Sets a Global Baseline, Not Global Oversight
The International Auditing and Assurance Standards Board built the International Standard on Sustainability Assurance 5000 to give the market a common baseline, one that works across reporting frameworks, sustainability topics and industries, and applies to accountants and non-accountant practitioners alike. ISSA 5000 takes effect for reporting periods beginning on or after December 15, 2026, with early adoption allowed. Australia, Brazil and several other markets have already adopted the standard or a national equivalent, while adoption in the United States remains under consideration, according to the IAASB's own implementation tracking.
The International Ethics Standards Board for Accountants issued a companion set of sustainability-specific ethics and independence rules that also take effect in December 2026, addressing conflicts of interest, client pressure and threats to assurance integrity such as greenwashing. What neither standard does is settle who is allowed to offer assurance in the first place, which regulator inspects that provider, or what happens when the work turns out to be deficient. That gap between how an engagement should run and who is actually watching the people running it is the accountability problem landing on compliance teams next.
UK Regulators Found the Market Consolidating Around Four Firms
Financial audit firms typically operate inside established systems covering licensing, independence, quality management, inspection and discipline. A sustainability consultant or certification body may bring deeper technical expertise in greenhouse gas accounting, water or occupational safety, but often sits outside that same structure. Neither type of provider is inherently more reliable, and sustainability assurance frequently needs expertise traditional financial auditors don't have. The risk is that two providers can issue similarly worded conclusions while facing very different qualification requirements, inspection regimes and consequences for weak work.
The UK's Financial Reporting Council put numbers to that risk in its sustainability assurance market study. Big Four firms increased their share of FTSE 350 sustainability assurance work from 33% in 2019 to 40% in 2023, and the FRC warned that trend could narrow choice for companies even as demand for specialized environmental expertise keeps growing. The regulator's final report called for a unified regime covering standard-setting, oversight, enforcement and market monitoring, warning that without one, the market might not consistently produce information investors and boards can actually rely on. Similar strain is already visible in faster-moving markets, where disclosure rules in Southeast Asia have outrun the region's supply of qualified assurance providers entirely.
Most Sustainability Assurance Today Is Limited, Not Reasonable
Part of the accountability problem is that buyers often misunderstand what they have purchased. Limited assurance does not mean a provider confirmed every disclosed figure. It involves less evidence-gathering than reasonable assurance and produces a conclusion framed around whether the practitioner found anything suggesting the information was materially misstated. Reasonable assurance requires more extensive testing and supports a stronger, positive-form conclusion, though even that stops short of an absolute guarantee.
Most assurance engagements among the FTSE 350 use the limited form, the FRC found, and that is not automatically a quality failure. It can be the right fit for an immature reporting system or a narrowly defined set of metrics. The trouble starts when a company, investor or customer reads a narrowly scoped limited-assurance opinion as validation of an entire sustainability report. A global benchmarking study from IFAC, AICPA and CIMA published in June 2026 found the sustainability reporting and assurance landscape is still converging toward common frameworks rather than having reached one, which is the same immaturity showing up a layer down in assurance itself.
Providers Grading Their Own Work Create a Self-Review Risk
A provider may help a company design its reporting controls, calculate emissions or select metrics, then later be asked to assure the same information it helped produce. Those combined services can improve reporting quality, but they can also create a self-review threat that undercuts the independence the assurance opinion is supposed to represent. The new international ethics rules address that risk directly, covering bias, conflicts of interest and client pressure. How much force those rules carry in practice depends on whether the provider has actually adopted them, how independence gets monitored, and whether an outside authority can investigate a violation.
Compliance teams should look past the word "independent" in a contract and examine the provider's broader commercial relationship with the company. A firm that also designed the methodology or systems it is now evaluating sits in a materially different position than one coming to the engagement cold, even if both sign the same assurance language.
What to Ask Before Signing an Assurance Engagement
Before appointing a provider, management and the audit committee should be clear on which assurance and ethics standards will actually govern the engagement, and whether the provider is independently licensed, accredited or inspected by anyone outside its own firm. It is worth knowing who can investigate a complaint or deficient work, which entities, disclosures and reporting periods the engagement actually covers, and whether it delivers limited or reasonable assurance. The materiality threshold and reporting criteria matter too, along with how technical specialists get selected and supervised and what consulting or implementation work the provider already performed for the company before this engagement began. The provider should also be willing to disclose its own qualifications, the exclusions in its scope and any control weaknesses it identified along the way.
A provider that cannot explain how it tests estimates, supplier data, emissions factors and forward-looking claims is not offering much beyond a signature. A clean conclusion over a narrow set of historical metrics does not validate a transition plan, a net-zero target or the broader story built around them.
ISSA 5000 and its companion ethics rules are a real step toward a more credible market, arriving after years of ad hoc practice piling up underneath an increasingly crowded corporate disclosure landscape. They do not remove the need to evaluate the provider behind the opinion. Sustainability assurance transfers verification work to an outside firm. It does not transfer management's responsibility for the accuracy of what gets disclosed, or the board's responsibility for overseeing it.
