Sooner or later, someone independent will ask to check your sustainability numbers. It may be a bank, a development partner or, as mandatory reporting arrives, an assurance provider appointed by your board. Organisations that wait until that request lands usually discover that their figures are scattered across spreadsheets, their methods live in one person’s head and their claims cannot be traced to evidence.
Assurance readiness is the work you do before the assurer arrives. It is less about producing more information and more about making what you already report verifiable.
What assurance means
Assurance is an independent practitioner’s conclusion on whether sustainability information is reliably presented. There are two levels. Limited assurance gives a moderate level of comfort, with procedures focused largely on enquiry and analysis. Reasonable assurance gives a higher level, with more extensive testing of evidence and controls. Many reporters begin with limited assurance and move towards reasonable assurance as their systems mature.
The international standard for this work, ISSA 5000, was issued by the International Auditing and Assurance Standards Board in November 2024. It can be applied to sustainability information prepared under any framework and is effective for assurance engagements on sustainability information for periods beginning on or after 15 December 2026. In Kenya, ICPAK has indicated that sustainability disclosures will be subject to independent assurance under a phased approach.
What assurance providers look for
Every engagement is different, but the questions tend to fall into the same seven areas.
|
Area |
Typical questions |
|
Scope and criteria |
What exactly is being reported, for which entities and period, and against which framework or criteria? |
|
Data lineage |
Can each reported figure be traced to source records and calculation files? |
|
Methods |
Are calculation methods, emission factors, assumptions and reporting boundaries documented and applied consistently? |
|
Controls |
Who prepares, reviews and approves the data, and how are errors caught? |
|
Evidence |
Does supporting documentation exist for narrative claims about policies, training, targets or incidents? |
|
Consistency |
Do the numbers agree with the financial statements and with other published information? |
|
Governance |
Has management reviewed the report, and does the board or audit committee oversee the process? |
Six steps to readiness
- Define scope and criteria. Decide which information will be reported, for which entities and period, and against which framework.
- Build an evidence map. For every reported figure and key claim, record the source, the owner, the calculation method and where the supporting evidence is stored.
- Assess controls. Review how data is collected, reviewed and approved. Add checks where there are none, such as second-person review and reconciliation to source records.
- Document methodologies. Write down boundaries, assumptions, conversion factors and estimation methods so that someone else could reproduce your numbers.
- Run a dry run. Ask someone independent of the preparers, such as internal audit, to test a sample of figures before a real engagement begins.
- Secure sign-off. Management should formally review and approve the report, and the board or audit committee should see the readiness findings.
Where organisations most often struggle
In our experience of preparing organisations for external scrutiny, the same weak spots appear again and again:
- Key figures that live in uncontrolled spreadsheets with no version history or review trail.
- Estimates, such as for emissions or waste, with no documented basis.
- Changes to reporting boundaries from one year to the next that are not explained.
- Claims of improvement with no baseline year to compare against.
- Inconsistent units or definitions between departments or sites.
- Evidence that exists somewhere but cannot be found when it is requested.
None of these is a deal-breaker on its own. Together, they turn a routine engagement into a slow, expensive and uncomfortable one.
Keep an assurance file
A simple discipline makes a large difference: create an assurance file for every reporting cycle. It should hold the final report, the indicator register, source data extracts, calculation workbooks, methodology notes, approvals, relevant policies and board or committee minutes. When the assurer asks for evidence, your team can retrieve it in minutes rather than weeks, which also lowers the cost of the engagement.
The file also protects continuity. When the person who built last year’s spreadsheet moves on, the next preparer inherits a documented process rather than a mystery.
Start early
Assurance readiness cannot be rushed in the final weeks before publication. Controls need a full reporting cycle to bed in, and the first dry run will almost certainly reveal issues. We advise organisations to begin at least a year before they expect their first assurance engagement and to treat the first cycle as a learning exercise.
Melanel supports organisations with ESG controls assessments, evidence mapping, documentation readiness, reporting quality reviews and overall assurance readiness reviews. We do not provide the assurance opinion itself, which must come from an independent provider. Our role is to make sure you are ready for it.
