Assurance · UK SRS and beyond
Sustainability assurance in the UK: voluntary, but now disclosed
Sustainability assurance is an independent practitioner’s conclusion on reported sustainability information, and no UK company is under a legal duty to obtain it.
Under the FCA’s final rules, PS26/19, a listed company in scope that obtains assurance over its UK SRS disclosures names the provider, what was assured and to what level, and the standards used.
The UK assurance standard, ISSA (UK) 5000, was issued by the FRC for voluntary use and applies to periods beginning on or after 15 December 2026.
Is it required?
No UK duty to obtain sustainability assurance
No UK entity is under any legal duty to obtain assurance over its sustainability information, and the position can be shown regime by regime rather than assumed.
The SECR guidance is explicit: “There is no statutory requirement to have your environmental information audited”, and there is no requirement in the legislation for energy and emissions data to be independently assured, though the guidance recommends it as best practice.
Section 414CB of the Companies Act 2006, read in full, imposes disclosure duties only; no assurance, audit or verification obligation appears in it.
UK SRS S1 and S2, published by the Department for Business and Trade on 25 February 2026, are voluntary standards, and the FCA’s listing rules ask in-scope listed companies to report against them on a comply-or-explain basis, not to have the reports assured.
The one mandatory check in this area is different in kind: a UK ETS installation’s emissions report must be verified by a verifier accredited by UKAS to ISO 14065, which is verification of a regulated report, not assurance of sustainability disclosures.
Making sustainability assurance compulsory would need new legislation; the government has said the oversight regime’s statutory form will require amendments to the Companies Act 2006, and registration will remain voluntary for practitioners.
The UK SRS compliance guide sets out what comply or explain itself requires.
Does any UK duty require sustainability assurance?
No. Each regime below asks for disclosure; none requires assurance. UK ETS verification is a different duty.
Choose a duty to see why, and the provision behind the answer.
SECR requires a disclosure in the company’s own report and requires no assurance of it. The government guidance says: “There is no statutory requirement to have your environmental information audited.”
SI 2018/1155, amending Schedule 7 to SI 2008/410 · SI 2018/1155; Environmental Reporting Guidelines (March 2019) Ch.1 Action iv
Answers rest on the provisions named in each row.
Nothing you choose is saved.
The FCA’s final rules
What a listed company states about assurance
The FCA published its final rules on UK SRS reporting, PS26/19, on 30 September 2026.
Listed companies in UKLR 6, 14, 15, 16 and 22 report against UK SRS on a comply-or-explain basis for accounting periods beginning on or after 1 January 2027, with first reports in 2028.
On assurance the FCA proceeded with its proposal as consulted on in CP26/5: a company states whether it obtained third-party assurance over its UK SRS disclosures, and if it did, names the provider, what was assured and to what level, the assurance standards used, and where the report is.
The rule does not require a reason for not obtaining assurance, and it does not name a standard: the FCA said it would “retain the proposal to simply disclose the sustainability assurance standards used” to keep flexibility for issuers.
It also said it will “keep the case for mandating sustainability assurance under review”, which is a statement of intent, not a date.
The new rules apply to periods beginning on or after 1 January 2027, so the first statements appear in annual reports published in 2028; the dates for UK SRS S1 and S2 are set out in full, and UK SRS and the FCA covers the rules in full.
| Where assurance was obtained, state | Made rule |
|---|---|
| The name of the assurance provider | UKLR 6.6.6R(8)(d) |
| Which disclosures or explanations were assured, and to what level | UKLR 6.6.6R(8)(d) |
| Which assurance standards were used | UKLR 6.6.6R(8)(d) |
| Where the assurance report can be found | UKLR 6.6.6R(8)(d) |
Draft it
The assurance statement, in your own words
The builder beside this text drafts the statement the made rule asks for, from the answers you give.
If no assurance was obtained, the statement says so; no reason is needed.
If assurance was obtained, each of the four items is a separate fact, and “to what level” means limited or reasonable assurance, which read very differently.
The scope sentence should name the disclosures precisely — for example Scope 1 and 2 emissions under UK SRS S2 — rather than describe the report as “assured” as a whole.
The UK SRS reporting guide shows where the statement sits among the other disclosures, and the UK SRS S1 and S2 page sets out the standards being assured.
Draft the assurance statement
Answer the first question to start a draft.
Built on FCA PS26/19 ¶2.45 and UKLR 6.6.6R(8)(d); levels per ISSA (UK) 5000 ¶¶190, 198L, 198R.
A drafting aid, not advice.
Nothing you type is saved or sent.
The standard
ISSA (UK) 5000, issued for voluntary use
ISSA (UK) 5000, General Requirements for Sustainability Assurance Engagements, was issued by the FRC on 12 November 2025, and the FRC consulted on it as a standard “for use on a voluntary basis by UK assurance providers”.
It adopts the text of the IAASB’s ISSA 5000, published on 12 November 2024, which deals with both reasonable and limited assurance and requires neither.
Paragraph 15 of ISSA (UK) 5000 sets two triggers: engagements on information for periods beginning on or after 15 December 2026, or as at a specific date on or after then; earlier application is permitted.
It binds by representation: under paragraph 20 a practitioner shall not represent compliance with it unless they have complied with it.
Paragraph 11 says a practitioner using it is not required to apply ISAE (UK) 3000, which the FRC’s list of assurance standards still shows as current.
The IAASB has withdrawn ISAE 3410, the standard for greenhouse gas statements, with effect from ISSA 5000’s effective date.
The UK text differs from the international text in places, including a prohibition on internal auditors providing direct assistance in an engagement under ISSA (UK) 5000 (¶¶42, A29).
Paragraph 34 requires the practitioner to comply with the IESBA Code’s provisions for sustainability assurance, or requirements at least as demanding; the FRC’s Ethical Standard is an audit standard and does not cover sustainability assurance.
- Sep 2024ISSA 5000 approved
By the IAASB.
- 12 Nov 2024ISSA 5000 published
Covers limited and reasonable assurance.
- 17 Jan 2025IESSA released
Ethics for sustainability assurance.
- 12 Nov 2025ISSA (UK) 5000 issued
By the FRC, for voluntary use.
- 15 Dec 2026Effective
Periods beginning on or after; ISAE 3410 falls away.
- 1 Jul 2028IESSA sections 5405–5406
Value-chain component provisions.
Levels of assurance
Limited and reasonable: two different sentences
| Reasonable assurance | Limited assurance | |
|---|---|---|
| Engagement risk | Reduced to an acceptably low level | Reduced to an acceptable level, greater than for reasonable assurance |
| Form of the conclusion | Positive: the information is prepared, in all material respects, in accordance with the criteria | Whether anything has come to the practitioner’s attention suggesting the information is materially misstated |
| Report heading | Basis for Opinion | Basis for Conclusion |
| Required warning | — | Procedures are less in extent, and the assurance obtained is substantially lower than for reasonable assurance |
| Share of FTSE 350 engagements, 2023 | The remainder | 83% |
A limited assurance conclusion is never a positive statement that the information is correct: it says no matter came to the practitioner’s attention that causes them to believe it is materially misstated.
The standard makes the report say so, under paragraph 190(d)(ii): the procedures are less in extent than for reasonable assurance, and the assurance obtained is substantially lower.
A reasonable assurance opinion is positive but still “in all material respects”; it is not a guarantee, not an audit of the financial statements, and not a statement about environmental performance.
Paragraph 87 prevents a quiet downgrade: the practitioner shall not agree to change from reasonable to limited assurance without reasonable justification.
Both are attestation engagements; paragraph 10 confines the standard to them.
Check your reading
Six statements about assurance reports
Most misreadings of assurance come from treating “assured” as one thing.
The heading of the report, the form of the conclusion and the scope paragraph together tell you what was done and how far it goes.
The statements beside this text test those readings, each against the paragraph that settles it.
The readiness assessment covers the data and controls an engagement will test, and Scope 3 under UK SRS covers the disclosures that are hardest to evidence.
True or false?
01A limited assurance conclusion confirms the data is correct.
02A report headed “Basis for Conclusion” is a limited assurance report.
03A practitioner may switch from reasonable to limited assurance part-way through if the work is harder than expected.
04ISSA (UK) 5000 requires reasonable assurance.
05A listed company in scope must explain why it did not obtain assurance.
06ISSA (UK) 5000 may be applied before 15 December 2026.
6 statements.
Pick an answer to see the provision behind it.
Answers rest on the provisions named beside each one.
Nothing you pick is saved.
Oversight
The voluntary register that is not yet open
In its response of 30 January 2026, the government decided to establish “a voluntary oversight regime for sustainability assurance in the UK”, after a consultation that received 99 formal responses.
Practitioners will be able to opt in by registering with the financial reporting regulator, subject to registration conditions, and the register will be public.
The FRC was tasked to set up an interim, non-legislative regime by mid-2026; that target has passed, and no announcement that the register had opened was found as at 30 September 2026.
Legislation is intended “as and when Parliamentary time allows”, maintaining the voluntary status, and would require amendments to the Companies Act 2006; the government has also decided not to proceed with the Audit Reform Bill.
The consultation had proposed that registered practitioners must follow ISSA (UK) 5000; the government gave no response on that, leaving the regime’s design to the FRC.
The government sees the register as satisfying the requirements of Europe’s CSRD for the subsidiary reporting exemptions, which is its practical value for UK groups with EU subsidiaries.
The FRC’s market study had recommended a unified regulatory regime; the government did not adopt that model.
The government tasked the FRC to establish an interim, non-legislative regime “by mid-2026”, operational “well ahead of the 1 January 2027 reporting year”.
No announcement that the register had opened was found as at 30 September 2026.
DBT government response ¶¶1.13, 1.15
The market
What the FRC found across the FTSE 350
The FRC’s Assurance of Sustainability Reporting Market Study, published on 5 February 2025, draws on data from Minerva Analytics.
It found an 18 percentage point increase in FTSE 350 companies obtaining sustainability assurance between 2019 and 2023, equal to 62 additional companies.
Of the 59 providers assuring FTSE 350 companies in 2023, 40 carried out only one or two engagements and 16 assured greenhouse gas information only.
The Big Four’s share was 40% in 2023, up from 33% in 2019; 27% of assured FTSE 350 companies used their statutory auditor, and 37% in the FTSE 100.
Most of the assurance obtained is limited, so most “assured” sustainability data in the UK carries a limited conclusion and its warning.
Who can assure
A profession-agnostic standard, with an ethics code behind it
ISSA (UK) 5000 is designed to be profession-agnostic: a practitioner need not be an accountant, but must meet the standard’s quality and ethical requirements to claim compliance with it.
The IESBA’s ethics standards for sustainability assurance, released on 17 January 2025 and now Part 5 of the IESBA Code, apply to all sustainability assurance practitioners regardless of background, for periods beginning on or after 15 December 2026.
Provisions on work at value-chain components (sections 5405 and 5406) take effect for periods beginning on or after 1 July 2028.
On independence, a firm shall not provide a non-assurance service to a public interest entity client if it might create a self-review threat over the information it assures (R5600.17, R5601.6); for other clients it applies the Code’s conceptual framework.
So the common statement that a firm can never prepare and assure the same information is too broad: it is a prohibition for public interest entities and a judgement for others.
Accreditation is a separate question: UKAS accredits bodies that verify greenhouse gas statements under ISO 14065, which is a different scheme from ISSA (UK) 5000; UKAS accreditation explains it.
Firms that offer sustainability services are discussed on the consultancies resource.
Preparing
Getting ready for a first engagement
| Step | What to do | Why |
|---|---|---|
| 1 | Decide which disclosures to have assured, and at which level | The FCA statement names both; a narrow, well-evidenced scope is better than a broad unclear one |
| 2 | Document the data trail from source to figure, with methods and factors | The practitioner tests evidence; limited and reasonable engagements differ in how much |
| 3 | Put controls over collection, calculation and review | Reasonable assurance in particular looks at controls |
| 4 | Agree the standard in the engagement letter | The FCA asks which standards were used; ISSA (UK) 5000 applies from 15 December 2026 or earlier by choice |
| 5 | Settle the level at the start | ¶87 bars a downgrade without reasonable justification |
| 6 | Check the practitioner’s ethics and independence position | IESBA Part 5; public interest entity rules on non-assurance services |
Data systems matter more than the choice of provider: the carbon reporting software guide covers audit trails and methodology records.
The table is a checklist for planning, not a requirement of any rule; nothing in UK law requires the engagement in the first place.
Assurance and certification
Assurance is not certification
Assurance is a conclusion on a body of reported information for a period; certification is a statement that a system or organisation meets a scheme’s requirements.
ISO 14001 certifies a management system, B Corp certifies against B Lab’s standards, and schemes such as the Carbon Trust’s and Planet Mark certify on their own published terms.
None of those is an assurance engagement over UK SRS disclosures, and none should be described in the FCA statement as if it were.
The government’s UK SRS guidance describes the standards themselves.
Frequently asked
Sustainability assurance, answered
Is sustainability assurance mandatory in the UK?
No. No UK entity is under a legal duty to obtain assurance over its sustainability information.
SECR, section 414CB of the Companies Act 2006 and UK SRS impose disclosure duties only.
The FCA’s final rules require listed companies in scope to state whether assurance was obtained and, if so, the provider, scope and standards; obtaining it is not required.
What do the FCA’s final rules say about assurance?
PS26/19, published on 30 September 2026, keeps assurance as a disclosure: where a listed company in scope has obtained assurance over its UK SRS disclosures, it names the provider, which disclosures were assured and to what level, which assurance standards were used, and where the assurance report can be found.
The FCA said it will keep the case for mandating sustainability assurance under review.
What is ISSA (UK) 5000?
The FRC’s UK version of the IAASB’s International Standard on Sustainability Assurance 5000, issued on 12 November 2025 for voluntary use.
It applies to engagements on sustainability information for periods beginning on or after 15 December 2026, or as at a specific date on or after then, and earlier application is permitted. It binds a practitioner who represents compliance with it.
Will ISSA (UK) 5000 become mandatory on 15 December 2026?
No. 15 December 2026 is its effective date for engagements that use it.
No UK law requires sustainability assurance, the FRC issued the standard for voluntary use, and the proposal to make it a condition of registration on the oversight register was not decided by the government.
What is the difference between limited and reasonable assurance?
A reasonable assurance opinion states positively that the information is prepared, in all material respects, in accordance with the criteria.
A limited assurance conclusion states whether anything has come to the practitioner’s attention that causes them to believe the information is materially misstated, and the report must say that the assurance obtained is substantially lower than in a reasonable assurance engagement.
Is there an FRC register of sustainability assurance providers?
Not yet.
The government decided in January 2026 to establish a voluntary, opt-in oversight regime and tasked the FRC with an interim, non-legislative regime by mid-2026, operational well ahead of the 1 January 2027 reporting year.
As at 30 September 2026 no announcement that the register is open had been found.
Who can provide sustainability assurance in the UK?
Anyone who meets the requirements of the standard they claim to follow.
ISSA (UK) 5000 is designed to be profession-agnostic, and paragraph 34 requires compliance with the IESBA Code provisions for sustainability assurance or requirements at least as demanding.
The oversight register, when it opens, will be voluntary for practitioners.
Is ISAE 3410 still used?
The IAASB approved withdrawing ISAE 3410 with effect from ISSA 5000’s effective date, so it falls away for periods beginning on or after 15 December 2026.
For the UK, the FRC still lists ISAE (UK) 3000 as a current standard; ISSA (UK) 5000 paragraph 11 says a practitioner using it is not required to apply ISAE (UK) 3000.
Does SECR need to be assured?
No. The government’s guidance says there is no requirement in the legislation for emission and energy use data, or narrative on energy efficiency action, to be independently assured, although it recommends it as best practice.
Is UK ETS verification the same as sustainability assurance?
No. A UK ETS installation must have its emissions report verified by a verifier accredited by UKAS to ISO 14065.
That is a mandatory verification of a regulated report, not assurance of sustainability disclosures, and it applies only to UK ETS operators.
What share of FTSE 350 assurance is limited assurance?
The FRC’s Market Study found that 83% of FTSE 350 sustainability assurance engagements in 2023 were limited assurance.
It also found that demand rose by 18 percentage points between 2019 and 2023, equal to 62 additional companies.
Can a firm prepare and assure the same sustainability information?
Not for a public interest entity where the service might affect the information assured: the IESBA Code prohibits it (R5600.17, R5601.6).
For other clients the firm applies the Code’s conceptual framework to identify and address threats; it is not a blanket ban.
Sources
Primary sources
Every figure, date and status on this page traces to the instrument’s owner.
Secondary commentary is never the source for a number.
- FCAPS26/19: Aligning listed issuers’ sustainability disclosures with international standards (30 September 2026)
The final rules, ¶2.45 on assurance, and comply or explain from 1 January 2027.
- FCAPS26/19 (PDF), Appendix 1 — UKLR 6.6.6R(8)(d)
The made rule text for the assurance statement.
- FCACP26/5: Aligning listed issuers’ sustainability disclosures with international standards
The consultation the final rules finalise; ¶¶7.5–7.8 on assurance.
- FRCISSA (UK) 5000 — General Requirements for Sustainability Assurance Engagements
Effective date (¶15), relationship to ISAE (UK) 3000 (¶11), ethics (¶34), levels of assurance (¶¶18, 190).
- FRCAssurance standards (ISSA (UK) 5000, issued 12 November 2025)
The FRC’s list of current assurance standards, including ISAE (UK) 3000.
- FRCISSA (UK) 5000 consultation — “for use on a voluntary basis”
The voluntary basis on which the standard was issued.
- IAASBISSA 5000 — General Requirements for Sustainability Assurance Engagements
The international standard ISSA (UK) 5000 adopts; ¶9 covers limited and reasonable assurance.
- IAASBIAASB announces withdrawal of ISAE 3410 (8 May 2025)
ISAE 3410’s withdrawal takes effect from ISSA 5000’s effective date.
- IESBAInternational Ethics Standards for Sustainability Assurance (17 January 2025)
The ethics and independence standard for sustainability assurance practitioners.
- GOV.UK (DBT)Developing an oversight regime for assurance of sustainability-related financial disclosures — government response (30 January 2026)
The voluntary, opt-in register and the FRC’s interim regime.
- FRCAssurance of Sustainability Reporting Market Study — Final Report (5 February 2025)
Providers, levels and standards used across the FTSE 350.
- legislation.gov.ukCompanies Act 2006, section 414CB
Disclosure duties only; no assurance requirement.
- GOV.UK (DESNZ)Environmental Reporting Guidelines, including SECR (March 2019)
“There is no statutory requirement to have your environmental information audited.”
- GOV.UK (DESNZ)UK ETS for installations: how to comply — appointing a verifier
The one mandatory verification duty, which is not sustainability assurance.
- GOV.UK (DBT)UK Sustainability Reporting Standards
The standards whose disclosures an assurance engagement may cover.