Why 'reasonable assurance' is coming, and most sustainability reports aren't ready for it

Limited assurance, the level most sustainability reports are checked against today, mostly means analytical procedures and targeted testing: are the reported numbers consistent with the underlying data, applied consistently. Reasonable assurance is a different engagement entirely, the same standard financial audit is held to. It means assessing whether internal controls are designed properly and testing whether they actually operated as designed all year, not just sampling the output.

An organisation without documented controls over its sustainability data has nothing for the assurance provider to assess in terms of control design, which forces extensive substantive testing instead, more testing, on more data points, and it still can't produce the same level of assurance that controls-testing plus substantive testing gives you together. A sustainability report assured at reasonable assurance level from an organisation with no certified management system is a thoroughly verified output of an unverified system. The report may well be accurate. The system that produced it was never independently evaluated. Those are two different claims, and sophisticated stakeholders know the difference.

The practical sequencing matters: build the management system, the documented data controls, the governance, the review cadence, before or alongside the push for reasonable assurance, not after. Starting a reasonable assurance engagement without that infrastructure is like auditing financial statements at a company with no internal controls. Certification and assurance answer different questions, and they're far more effective run together than either is run alone.