ESG’s New Reality
ESG reporting has shifted from voluntary, narrative-driven disclosures to regulated, data-focused disclosures. New rules, like California’s SB 253 and the EU’s CSRD, along with increased stakeholder scrutiny, now require sustainability information to be complete, consistent, and reliable.
Limited assurance is evolving to the baseline standard for sustainability-related data, providing users with greater confidence in the reported data. This trend is particularly evident in climate-related disclosures. California’s SB 253 mandates large companies to report greenhouse gas emissions (Scopes 1, 2, and 3), with assurance requirements phased in over time, as summarized below.
| GHG Emissions Scope | Reporting Deadline | Assurance Requirement |
|---|---|---|
| Scope 1 (direct) | 20261,2 | – Limited assurance expected by 20273 – Reasonable assurance expected by 2030 |
| Scope 2 (indirect from purchased energy) | 20261,2 | – Limited assurance expected by 20273 – Reasonable assurance expected by 2030 |
| Scope 3 (indirect upstream and downstream across the supply chain) | 2027 | – Without assurance in 2027 – Limited assurance by 2027 |
1As of 2025, and following stakeholder feedback, CARB is proposing a first-year-only reporting deadline of August 10, 2026.
2CARB clarified that entities with fiscal year-ends between January 1, 2026, and February 1, 2026, will report on data from the fiscal year ending in 2026, while entities with fiscal year-ends between February 2, 2026, and December 31, 2026, will report on data from the fiscal year ending in 2025.
3CARB has clarified that it will exercise enforcement discretion for first-year reporting in 2026, meaning companies may submit Scope 1 and Scope 2 emissions data based on the information they already had or were collecting when the enforcement notice was issued, even if that data has not undergone limited assurance.
What Does Limited Assurance Actually Mean?
Limited assurance is a moderate level of confidence provided by an independent assurer over the sustainability-reported data and quality of reporting. In practice, this means the assurer performs targeted procedures such as analytical reviews, interviews, and selective testing to determine whether anything suggests the information is materially misstated.
Unlike reasonable assurance (think: full financial audit), the work is narrower in scope but still requires transparent, well-defined processes. However, “limited” does not mean “light.” Assurance providers still expect structured processes, defensible methodologies, clear ownership, and effective governance, along with clearly documented assumptions, consistent calculation methods, and evidence that management can confidently substantiate how each metric was developed and whether the resulting metrics are reasonable. Although controls are generally not tested during limited assurance, a strong control environment plays a critical role in supporting the completeness and accuracy auditors look for in the reported information.
Essential Steps for Assurance Readiness
With a practical, step-by-step approach, organizations can strengthen assurance readiness. The steps below define a clear path to limited assurance preparation:
1. Clarify Scope and Ownership
Clear roles and scope help prevent reporting errors and increase auditor confidence in ESG oversight.
- Identify which ESG disclosures fall under limited assurance (e.g., GHG emissions, workforce metrics, value-chain data).
- Clearly define boundaries to avoid gaps or ambiguity in what must be reported.
- Assign ownership across sustainability, finance, risk, internal audit, IT, and operations to ensure accountability and active governance.
2. Assess Current Maturity
Early discussions with SMEs and auditors help identify high-risk areas and remediation priorities before formal assurance begins.
- Review current data collection processes for completeness, consistency, and auditability.
- Evaluate existing documentation, calculation methods, assumptions, and controls to understand your true readiness level.
Explore expert ESG Reporting solutions that solve real-world problems
Integrate sustainability reporting best practices and build an ESG framework that meets current and emerging regulatory requirements.
3. Strengthen Governance and Controls
Effective governance frameworks allow ESG information to withstand independent scrutiny.
- Establish formal ESG policies, procedures, process documentation, and oversight mechanisms that mirror the rigor of financial reporting.
- Align ESG controls with SOX-like principles like segregation of duties, documented review and approval processes, evidence retention, and escalation protocols to ensure consistency and reliability.
4. Test, Refine, Prepare
Early testing reduces surprises during the formal assurance engagement and accelerates readiness.
- Conduct mock or dry-run assurance reviews to identify weaknesses early.
- Use findings to develop targeted remediation plans, refine data, enhance documentation, strengthen methodologies, and improve audit trails before auditors arrive.
These four steps establish the foundation for credible, repeatable ESG reporting under assurance. While limited assurance may be the starting point, the disciplines required to achieve it set organizations up for longer-term regulatory resilience, and as ESG reporting matures, limited assurance will eventually evolve into reasonable assurance. By approaching assurance readiness as a journey rather than a one-off exercise, organizations can reduce audit friction, build stakeholder confidence, and position themselves for the increasing scrutiny that lies ahead.
Accelerate Readiness Today
Translating assurance requirements into operational reality is where many organizations encounter complexity. ESG data cuts across functions, systems, and geographies, often without the benefit of mature controls or standardized processes.
CrossCountry Consulting is uniquely positioned to guide organizations through the complexities of ESG assurance readiness. Our team delivers:
- Deep expertise in sustainability, financial reporting, and risk advisory.
- Tailored solutions that meet both regulatory requirements and strategic objectives.
- Targeted training for management and internal teams, fostering ESG awareness and embedding compliance into daily operations.
- Technology enablement for data management and evidence trails, helping automate and streamline ESG processes.
To accelerate your ESG assurance readiness with the partnership of a strategic ally, connect with CrossCountry Consulting.