Would Your ESG Evidence Survive Independent Assurance Tomorrow?

85% of the FTSE 100 already obtain third-party ESG assurance. The real question is whether your evidence would survive the same scrutiny 

ESG assurance is moving from a specialist sustainability exercise towards a mainstream governance and control issue. 

KPMG’s ESG Assurance Maturity Index 2025 found that 85% of FTSE 100 companies obtained third-party assurance over ESG information, with 98% of those companies including Scope 1 and Scope 2 greenhouse gas emissions within the assurance scope. Yet the same research found that 54% of UK businesses still struggled with inadequate access to ESG data. 

That gap matters. 

An organisation may publish detailed sustainability information while lacking the evidence, controls and audit trail needed to demonstrate where the numbers came from. For regulated entities, the consequences can extend beyond a difficult assurance process because unreliable ESG information may affect regulatory disclosure, investor communication, product claims, capital decisions and board accountability. 

The assurance landscape is also becoming more formal. The International Auditing and Assurance Standards Board developed ISSA 5000 as a global baseline for sustainability assurance across frameworks and sustainability topics. It becomes effective for periods beginning on or after 15 December 2026, with early application permitted. The UK Financial Reporting Council has already issued ISSA (UK) 5000 to provide an internationally aligned framework for sustainability assurance in the UK. 

Consequently, regulated organisations should not wait until the assurance provider asks for evidence. 

ESG audit preparation needs to begin with the systems, controls and governance that create the evidence in the first place. 

Read More: ESG Reporting and Disclosure 

Executive Takeaway 

The best ESG audit preparation services help regulated entities become assurance ready, rather than simply helping teams organise files shortly before an external review. 

A strong preparation programme should address: 

• ESG regulatory and reporting requirements 

• Materiality and reporting scope 

• Data ownership and source evidence 

• Reporting methodologies and definitions 

• Internal controls over ESG information 

• Board and executive accountability 

• Value-chain and third-party data 

• Narrative disclosures as well as quantitative metrics 

• Assurance documentation and audit trails 

• Dry runs and readiness testing 

• Remediation of control and evidence gaps 

• Integration between sustainability and financial reporting 

For boards and audit committees, one question cuts through the complexity: 

Could an independent assurance practitioner trace every material ESG claim back to reliable evidence, understand how it was prepared and see who reviewed and approved it? 

If the answer is uncertain, the organisation is not yet fully assurance ready. 

ESG audit preparation is not the same as ESG assurance 

The distinction matters. 

An independent assurance provider examines sustainability information and provides a conclusion about it. Audit preparation or assurance readiness happens beforehand and is designed to make sure the organisation has the evidence, methodologies, controls and governance required to undergo that scrutiny successfully. 

KPMG’s guidance on ESG assurance readiness describes readiness engagements as detailed assessments that identify issues before formal assurance begins. Meanwhile, Deloitte offers gap analysis and readiness assessments covering reporting frameworks, materiality and ESG metrics before organisations move into assurance. 

A useful readiness engagement should therefore identify questions such as: 

• Are reporting criteria sufficiently clear? 

• Can data be traced back to source? 

• Are calculation methodologies documented? 

• Are reporting boundaries applied consistently? 

• Do review controls operate effectively? 

• Is supporting evidence retained? 

• Can narrative claims be substantiated? 

• Are material judgements documented? 

This distinction becomes particularly important where independence requirements limit the work an organisation’s statutory auditor can perform. 

The organisation may need one adviser to strengthen the reporting environment and another independent practitioner to provide assurance over it. 

Why regulated entities face a higher ESG assurance challenge 

Every organisation wants credible information, but regulated entities operate in an environment where weak reporting can have broader consequences. 

Banks, insurers, asset managers, payment businesses, listed companies and other regulated firms increasingly use sustainability information in regulatory submissions, financial products, investor communications, climate assessments and strategic decisions. 

PwC’s non-financial assurance practice explicitly connects ESG assurance with regulatory assurance, sustainable financing, supply-chain reporting and financial services controls. It notes that assurance can extend to areas such as sustainability and carbon information, social impact, green and sustainable financing, and governance controls. 

Therefore, ESG data may influence far more than the annual sustainability report. 

For a regulated entity, the same information could affect: 

• Regulatory disclosures 

• Annual reporting 

• Product descriptions 

• Sustainability-linked finance 

• Investor decisions 

• Risk assessments 

• Remuneration targets 

• Climate transition plans 

• Board reporting 

• Customer and stakeholder claims 

As a result, an ESG reporting weakness can quickly become a governance, conduct or regulatory weakness. 

Explore More: ESG Materiality & Risk Assessment 

ISSA 5000 raises the global assurance benchmark 

The introduction of ISSA 5000 is an important development because sustainability assurance has historically been fragmented across frameworks, topics and jurisdictions. 

The standard applies across sustainability topics and suitable reporting frameworks and can be used for both limited and reasonable assurance engagements. Moreover, it is designed for use by professional accountants and other competent assurance practitioners rather than being restricted to one profession. 

The IAASB has also issued specific 2026 guidance on materiality, recognising that sustainability assurance must deal with both quantitative and qualitative information and, where relevant, double materiality. 

For reporting entities, this has a practical consequence. 

Preparation cannot focus solely on the numbers. 

Organisations need evidence supporting: 

• Materiality decisions 

• Narrative disclosures 

• Management assumptions 

• Reporting methodologies 

• Targets 

• Governance statements 

• Estimates 

• Value-chain information 

In other words, the assurance trail extends beyond the spreadsheet. 

The first audit-readiness test is traceability 

KPMG’s analysis of assurance and verifiability under UK Sustainability Reporting Standards proposes a useful three-part framework built around traceability, controls and criteria. 

Traceability asks whether reported information can be connected directly to evidence. 

For example, if an organisation reports a workforce diversity percentage, can it identify: 

1. The system containing the underlying employee records. 

2. The population included in the calculation. 

3. The reporting date. 

4. Relevant exclusions. 

5. The calculation methodology. 

6. The person responsible for preparing the metric. 

7. The person who reviewed it. 

8. Evidence that the review occurred. 

The same principle applies to emissions, social impact, water, waste, customer outcomes and other sustainability information. 

If a reported figure exists only in the final ESG spreadsheet and cannot be traced reliably to source, the organisation has an assurance problem. 

The second test is whether ESG controls actually work 

Many organisations have extensive control environments around financial reporting while ESG information relies on email, spreadsheets and manual checking. 

That gap is becoming difficult to defend. 

The FRC’s ISSA (UK) 5000 establishes a formal UK sustainability assurance framework, while the 2024 UK Corporate Governance Code has also increased board attention on material financial and non-financial controls. 

KPMG’s UK SRS analysis argues that organisations need both preventative and detective controls over sustainability reporting, alongside clear approval processes. 

Typical ESG reporting controls 

A control that exists only in a policy is not enough. 

The organisation also needs evidence that it operated. 

Third-party ESG data creates an additional assurance risk 

Regulated firms increasingly depend on information they do not generate themselves. 

This might include Scope 3 emissions, financed emissions, supplier information, carbon credits, sustainability ratings, scenario analysis or certification data. 

Deloitte’s 2026 analysis of third-party sustainability data warns that organisations often have less visibility over the controls surrounding externally sourced ESG information than they have over their own data. As a result, errors in third-party information can compromise regulatory reporting and expose organisations to legal, financial and reputational consequences. 

A readiness exercise should therefore ask: 

• Who provided the information? 

• What methodology did they use? 

• What contractual assurance exists over data quality? 

• Can the data be independently verified? 

• Does management understand significant assumptions? 

• What happens if the information cannot be obtained? 

• Are estimates being presented transparently? 

This becomes particularly important for financial institutions relying on financed-emissions data or companies with complex global supply chains. 

What should an ESG audit preparation service actually deliver? 

A credible preparation engagement should leave management with more than a list of observations. 

ESG Audit Preparation Framework 

For regulated entities, this structure helps turn audit preparation into a repeatable governance capability rather than an annual scramble. 

What the market data tells us about ESG assurance readiness 

The market has made significant progress, although the underlying infrastructure remains uneven. 

KPMG’s 2024 ESG Assurance Maturity Index surveyed senior executives and board members across 1,000 companies and found that only 29% had a clear audit trail supporting non-financial information. The same proportion had the ESG policies, skills and systems they considered necessary for assurance readiness. 

More recent KPMG UK research indicates that organisations are progressing, but access to reliable ESG data remains a significant obstacle. In 2025, 54% of surveyed UK organisations cited inadequate ESG data access as a challenge. 

Deloitte’s 2025 corporate reporting review also found that 90% of companies in its sample obtained external assurance over selected sustainability metrics. However, 77% reported challenges obtaining Scope 3 information. 

What the Data Suggests 

The implication is clear. 

The market is moving towards assurance faster than many organisations are improving the infrastructure beneath their ESG reporting. 

Leading ESG audit preparation and assurance-readiness providers 

There is no objective global ranking of ESG audit preparation providers. The right adviser depends on sector, regulatory exposure, geography, reporting framework, assurance provider and the maturity of the organisation’s current ESG reporting environment. 

However, several providers illustrate the principal models available. 

1. Lumorus: governance-led ESG audit preparation and reporting readiness 

Lumorus approaches ESG readiness through governance, materiality, reporting discipline and evidence rather than treating assurance as a final-stage verification exercise. 

Through ESG Reporting and Disclosure, organisations can strengthen the systems behind sustainability reporting, including reporting frameworks, ESG data, stakeholder information, regulatory alignment and assurance readiness. 

The approach can also connect ESG audit preparation with: 

• ESG Materiality & Risk Assessment 

• ESG Strategy Development 

• ESG Integration in Investment Decisions 

• Stakeholder Engagement 

• Social Impact Measurement and Management 

For regulated entities, this governance-led model can be useful because reporting readiness frequently fails at the points where sustainability, risk, finance and board accountability intersect. 

Best suited to: organisations seeking practical ESG audit preparation that connects data and disclosure with governance, materiality and management accountability. 

2. Deloitte: strong sustainability and controls assurance-readiness capability 

Deloitte UK offers sustainability assurance readiness covering CSRD, ISSB standards, greenhouse gas reporting and materiality assessments. 

Its broader controls assurance practice also covers internal control development, testing and remediation over financial and non-financial reporting. (deloitte.com) 

This combination makes Deloitte particularly relevant where the principal challenge involves reporting controls, complex data systems or third-party information. 

Best suited to: large and complex organisations requiring combined sustainability reporting, controls and assurance expertise. 

3. KPMG: strong ESG assurance maturity and readiness methodology 

KPMG UK offers dedicated assurance-readiness engagements that can focus on particular metrics or wider sustainability disclosures. 

Its published work provides a clear view of what readiness entails: documented policies, reporting methodologies, robust processes, internal controls and clear audit trails. In addition, KPMG’s annual Assurance Maturity Index provides useful benchmarking on the readiness challenges facing large organisations. (kpmg.com) 

Best suited to: organisations seeking detailed readiness benchmarking and a pathway towards independent sustainability assurance. 

4. PwC: strong connection between ESG, regulatory and non-financial assurance 

PwC UK combines ESG assurance with regulatory assurance, third-party assurance and controls work. 

Its offering covers sustainability reporting, social impact, supply-chain information, sustainable financing and corporate governance controls, which can be particularly relevant for financial institutions and other regulated organisations where ESG information interacts with broader regulatory obligations. 

PwC also emphasises that non-financial information should withstand a similar level of scrutiny to financial reporting. 

Best suited to: regulated and large multinational organisations needing sustainability assurance within a broader regulatory and controls environment. 

5. EY: strong multi-framework ESG readiness and assurance infrastructure 

EY provides sustainability reporting and assurance services alongside its technology-supported ESG Suite. 

The Suite includes maturity assessment, materiality assessment, gap assessment and improvement modules, allowing organisations to evaluate readiness across multiple sustainability frameworks before moving towards external assurance. 

Best suited to: global organisations seeking technology-enabled readiness across several ESG reporting regimes. 

How the provider models compare 

The best provider is not necessarily the organisation that will ultimately issue the assurance conclusion. 

Indeed, independence considerations may make separation between preparation and formal assurance desirable or necessary. 

A good readiness adviser should try to find problems 

This sounds obvious, yet poor audit preparation can become an exercise in reassurance. 

Management wants confirmation that reporting is ready, while teams naturally defend the processes they have built. 

A credible adviser should take the opposite approach. 

The purpose of a readiness review is to discover weaknesses while there is still time to correct them. 

That means testing: 

• Whether metrics can be recalculated independently 

• Whether evidence supports narrative claims 

• Whether methodologies are applied consistently 

• Whether approvals are documented 

• Whether controls really operated 

• Whether assumptions are transparent 

• Whether reporting boundaries are defensible 

• Whether previous-year comparatives remain valid 

The most valuable readiness finding is often the problem identified before the external assurer finds it. 

The Lumorus View 

ESG audit readiness is not about preparing a better evidence folder. It is about building a reporting system that naturally produces reliable evidence. 

An organisation can temporarily organise its way through an assurance exercise by chasing missing documentation, rebuilding calculations and obtaining retrospective approvals. 

However, that is not mature ESG governance. 

A stronger operating model embeds evidence into the process. Data owners understand what they are responsible for, methodologies are documented before reporting begins, controls operate throughout the year and the board receives enough information to challenge significant assumptions. 

As a result, assurance becomes a test of an existing system rather than an annual reconstruction project. 

Six signs your ESG reporting is not audit ready 

Regulated entities should take notice when any of the following appear: 

1. Different teams cannot agree on the definitive ESG number 

This usually indicates unclear ownership, methodology or reporting boundaries. 

2. Calculations cannot be reproduced without the original preparer 

That is a key-person dependency and an evidence problem. 

3. ESG controls exist but there is little proof they operated 

Policies do not provide assurance by themselves. 

4. Narrative claims receive less scrutiny than metrics 

Qualitative statements can create regulatory and reputational exposure too. 

5. Third-party data is accepted without meaningful challenge 

Supplier and value-chain information requires governance as well. 

6. The organisation becomes significantly busier immediately before assurance 

A mature reporting environment should reduce the need for year-end reconstruction. 

What should the audit committee ask? 

Audit committees do not need to reproduce the assurance practitioner’s work. However, they should understand whether management has built a credible reporting environment. 

Useful questions include: 

1. Which ESG disclosures are currently subject to assurance, and which should enter scope next? 

2. Where are our largest evidence and control weaknesses? 

3. Which metrics depend most heavily on third-party information or estimates? 

4. Can management demonstrate that material ESG controls operated effectively? 

5. What were the findings from the most recent readiness or dry-run assessment? 

6. How are ESG reporting timelines being aligned with financial reporting and board approval? 

7. Are there independence restrictions affecting who can prepare and who can assure the information? 

These questions move ESG assurance from the sustainability function into the wider governance environment where it increasingly belongs. 

The Bottom Line 

ESG assurance is becoming harder to dismiss as a voluntary exercise undertaken by a small number of sustainability leaders. 

Large listed companies are already obtaining significant levels of independent assurance, global standards such as ISSA 5000 are creating a more consistent assurance baseline and regulators increasingly expect sustainability information to be capable of verification. 

For regulated entities, the implications go further because ESG information may influence regulatory disclosure, products, finance, investment decisions and board oversight. 

The strongest response is not to wait for the external assurance provider. 

It is to build readiness beforehand by strengthening data ownership, methodologies, evidence, internal controls and governance. 

The ultimate test is not whether the sustainability report looks credible. 

It is whether the organisation can prove that the information inside it deserves to be trusted. 

How Lumorus can help prepare for ESG scrutiny 

Lumorus helps organisations strengthen the governance, materiality, data and reporting foundations behind credible ESG disclosure. 

Depending on the organisation’s current maturity, support can include: 

• Materiality, risk and regulatory exposure: ESG Materiality & Risk Assessment 

• Reporting frameworks, disclosure and assurance preparation: ESG Reporting and Disclosure 

• Strategy and management accountability: ESG Strategy Development 

• Investment and capital-allocation integration: ESG Integration in Investment Decisions 

• Stakeholder evidence: Stakeholder Engagement 

• Social outcomes and impact evidence: Social Impact Measurement and Management 

A practical starting point is an ESG audit-readiness assessment that identifies where evidence, controls and governance need strengthening before independent scrutiny begins. 

About Lumorus 

Lumorus is a UK headquartered global governance, ESG, company secretary and advisory firm supporting organisations across Europe, Africa, Asia, the Caribbean, Canada, the Middle East and international markets. 

For more than 10 years, we have helped boards, investors and leadership teams strengthen governance, accountability, sustainability and organisational resilience. 

For regulated organisations, credible ESG reporting depends on more than disclosure. It requires reliable evidence, clear accountability and governance systems capable of standing up to scrutiny. 

Would your ESG information survive an assurance dry run if it started tomorrow? 

Contact Lumorus to discuss ESG audit preparation, reporting readiness and the controls needed to support credible sustainability disclosure. 

Email: [email protected] 

Lumorus: Better Business, Built on Purpose. 

Sources 

• International Auditing and Assurance Standards Board – ISSA 5000 and global sustainability assurance implementation guidance. 

• IAASB – 2026 guidance on materiality in sustainability assurance engagements. 

• Financial Reporting Council – ISSA (UK) 5000 and the UK sustainability assurance framework. 

• KPMG UK – ESG Assurance Maturity Index 2025, including UK assurance, data and regulatory findings. 

• KPMG UK – ESG assurance readiness, audit trails and reporting infrastructure. 

• KPMG UK – Traceability, controls and reporting criteria for verifiable sustainability information. 

• Deloitte UK – Sustainability gap analysis, assurance readiness and materiality support. 

• Deloitte UK – Third-party sustainability data, controls and assurance considerations. 

• Deloitte UK – Corporate reporting research covering ESG assurance and Scope 3 data challenges. 

• PwC UK – ESG, regulatory, third-party and non-financial assurance services. 

• EY – Sustainability reporting readiness, gap assessment and assurance services.