The final CEAOB guidelines on limited assurance on sustainability reporting are now public

Published on 3 October 2024 Email this Share this on LinkedIn Share this on Facebook Communiqué The final CEAOB guidelines on limited assurance on sustainability reporting are now public These guidelines have been developed by the CEAOB at the request of the European Commission to help statutory auditors and other assurance service providers in charge of limited assurance engagements introduced by CSRD. Pending the adoption of a standard covering the limited assurance engagement by the European Commission, the CSSF recommend the use of these CEAOB guidelines in Luxembourg. CEAOB guidelines on limited assurance on sustainability reporting (europa.

1. eu)30 September 2024 CEAOB guidelines on limited assurance on sustainability reporting Guidelines PDF (460.78Kb) Main topic: Corporate Sustainability Reporting Directive (CSRD) Relevant for Public Oversight of the Audit Profession CEAOB Adopted on 30 September 2024 CEAOB guidelines on limited assurance on sustainability reporting 1. Context On 5 January 2023, the Corporate Sustainability Reporting Directive (EU) 2022/2464 (CSRD) entered into force. The CSRD amended Audit Regulation (EU) No 537/2014, Transparency Directive 2004/109/EC, Audit Directive 2006/43/EC and Accounting Directive 2013/34/EU. As from financial years starting on or after 1 January 2024, large companies shall draw up sustainability statements in accordance with the European Sustainability Reporting Standards (ESRS). These statements will need to be subject to an assurance engagement by statutory auditors or other assurance services providers (“practitioners” hereafter).1 The CSRD requires the adoption of limited assurance standards by the European Commission by 1 October 2026 at the latest to clarify what is expected from practitioners when carrying out a limited assurance engagement regarding the sustainability information reported pursuant to the ESRS. Until this adoption, there will be a gap period during which there will be no assurance standards adopted at EU level. The CSRD states that Member States can adopt national standards or pronouncements as long as the European Commission has not adopted standards at EU level.2 The CSRD (recital 69) mentions that, with a view to facilitating the harmonisation of the assurance of sustainability reporting across Member States, the CEAOB should be encouraged to adopt non-binding guidelines to set out the procedures to be performed [by practitionners1] when expressing an assurance opinion on sustainability reporting, pending the adoption by the European Commission of an assurance standard covering the same subject matter. With the aim to avoid fragmentation and to ensure that practices are as consistent as possible until the adoption of an assurance standard at EU level, the Commission has invited the CEAOB to develop non-binding guidelines regarding limited assurance on sustainability reporting, which are described in this document. 2. Objectives of the CEAOB guidelines In the absence of relevant international assurance standard(
2. s)covering fully the CSRD requirements for limited assurance on sustainability reporting3 finalised at the date of publication of the guidelines, this document is intended to provide high level assistance to facilitate a common understanding of some of the key aspects of the limited assurance engagement requirements introduced by the CSRD. The CEAOB guidelines do not override or replace national pronouncements that might be in force at national level in EU Member States. As such, the guidelines do not constitute a standard and should be read in conjunction with any national rules applicable to assurance on sustainability reporting. 1 statutory auditors and/or other assurance services providers appointed to perform the limited assurance engagement required by the CSRD are both designated as “practitioners” in these guidelines – see glossary in appendix 1 2 See Audit Directive - Article 26a 3 See Accounting Directive - Article 34 par 1 (
3. aa)1 CEAOB Adopted on 30 September 2024 Member States, through their competent authorities or otherwise, may recommend or require the use of the CEAOB guidelines for the sake of harmonisation of limited assurance practices at EU level, either alone or in addition to national pronouncements applicable at national level for limited assurance engagements required by the CSRD. The guidelines may also be used by practitioners for voluntary limited assurance engagements performed at the request of entities that prepare sustainability statements on a voluntary basis, even if the legal requirements stemming from the CSRD do not impose this preparation to them. 3. Ethics, engagement acceptance and quality control The guidelines cover some, but not all aspects of the procedures required in a limited assurance engagement and are not intended to be exhaustive. They do not, in particular, address ethical provisions. All practitioners are required to comply with the relevant ethical provisions which are described in the Audit Directive and Audit Regulation,4 and with any relevant national provisions. In addition, the provisions of the Audit Directive5 regarding independence, as transposed in national laws, apply to limited assurance engagements. The provisions governing acceptance of the engagement are not covered by the guidelines either. The content of the engagement letter prepared by the practitioners to present the practical organisation of the engagement is not specified in the guidelines. Practitioners are subject to requirements on quality control procedures and mechanisms6 and are thus required to put in place a system of quality control covering limited assurance engagements. I. General principles and approach to the limited assurance engagement The CEAOB invites practitioners to adopt a common approach when performing limited assurance engagements on sustainability reporting prepared in accordance with EU laws and regulations. This common approach encompasses the principles described hereafter. 4. Objective of the limited assurance engagement The work to be performed for the limited assurance engagement supports the practitioners’ conclusion to be expressed on the sustainability reporting prepared by the entity. In a limited assurance engagement, practitioners perform less extensive procedures than in a reasonable assurance engagement: the amount of work is expected to be less than for a reasonable assurance engagement that would be performed in the same circumstances.7 Practitioners shall obtain limited assurance that the information reported by the entity is free from material misstatement(s). Appropriate procedures are to be designed and performed by the practitioners to obtain this limited assurance. Practitioners are required to perform procedures that enable them to conclude on the sustainability statements with regards to the applicable legal provisions introduced by the CSRD and the relevant reporting frameworks mandated by EU laws and regulations.8 4 For assurance services providers, those provisions are referred to in Article 34.4 (
4. d)of the Accounting Directive Audit Directive, Article 22 and following articles 6 See Audit Directive (Article 24a and Article 24b) and Accounting Directive Article 34.4 7 See recital 60 of the CSRD “… The amount of work in a reasonable assurance engagement entails extensive procedures including consideration of internal controls of the reporting undertaking and substantive testing, and is therefore significantly greater than in a limited assurance engagement.” 8 ESRS, taxonomy reference framework and digitalisation rules 5 2 CEAOB Adopted on 30 September 2024 5. Material misstatement(
5. s)for practitioners in the context of a limited assurance engagement A misstatement is a difference between a disclosure provided (or omitted) and the appropriate disclosure required by the reporting framework (here the ESRS, and the taxonomy reference framework).9 Misstatements can be quantitative or qualitative and include omitted information. Misstatements can arise from error or fraud. Practitioners may determine that misstatements in the disclosures, individually or in aggregate, are not material, if, according to the practitioners’ professional judgement, these misstatements would reasonably be expected not to influence the decisions taken by the intended users of the sustainability statements. The materiality of misstatement(
6. s)in disclosures, which is to be taken into consideration during the limited assurance engagement, is linked but is not the same as the “double materiality” to be used by the entity in the preparation of the sustainability statements in accordance with the ESRS, to determine the matters to be reported on. Materiality is relevant for both quantitative and qualitative disclosures, considering the potential influence of the misstatement(
7. s)on the intended users of the information. 6. Fraud and non-compliance with laws or regulations Throughout the limited assurance engagement, practitioners should remain alert to the risk of fraud and to instances of non-compliance with laws and regulations. In the absence of non-compliance with laws and regulations suspected or identified through remaining alert during the engagement, the practitioners are not required to perform specific procedures regarding the entity’s compliance with laws and regulations outside those applicable to the sustainability statements’ preparation. Practitioners should communicate irregularities detected during the course of assurance engagements performed for public interest entities to the entity and, if the entity does not investigate the matter, to authorities designated by the Member State as responsible for investigating such irregularities.10 Non-compliance with laws and regulations detected during the sustainability assurance engagement falls within this category. 7. Procedures targeted at risk identification and assessment Practitioners should obtain an understanding of the entity, its environment,11 and its system of internal control relevant to the preparation of the sustainability statements. This understanding should be sufficient to provide the practitioners with the ability to identify and assess the risks of material misstatements at disclosures level, thus providing a foundation for determination of further procedures to be designed and performed to respond to the risks. To obtain this understanding, practitioners may use, for instance, some or all of the following techniques: - inquiries, requests for information from management and other individuals within the entity which may provide the practitioners with different perspectives; analytical procedures, which may, for instance, be used to identify unusual items; physical observations and inspections, which may enable practitioners to corroborate or contradict information obtained from management or other individuals. In identifying the risks of material misstatements, specific attention should be placed on disclosures that are likely to be most important to the information needs of intended users and on whether the disclosures meet the qualitative characteristics of information defined by the ESRS, including relevance and faithful representation. 12 9 See Appendix 1 glossary for the references to ESRS and taxonomy reference framework Audit Directive Article 25d, referring to Audit Regulation Article 7 – see also Accounting Directive Article 34.4.
8. h)11 Including relevant laws and regulations 12 See ESRS 1 paragraph 19 10 3 CEAOB Adopted on 30 September 2024 For the first year of the limited assurance engagement, due to time constraints, practitioners may choose not to perform the procedures targeted at risk identification and assessment described above in this section 7, and perform, as an alternative, an identification of disclosures where material misstatements are likely to arise.13 8. Process carried out and described by the entity In order to be able to express their conclusion, practitioners should place particular emphasis on the process put in place by the entity to determine material matters for disclosure in the sustainability statements. Procedures that should be performed for a limited assurance engagement encompass obtaining an understanding of the process carried out by the entity to identify and determine information to be reported in the sustainability statements based on the double materiality principle.14 Practitioners should assess whether the description of the process provided in the sustainability statements is consistent with the process implemented and should design and perform procedures to determine whether the process is meeting the prescriptions of the ESRS,15 meaning amongst others that this process allows to identify appropriately the information which enables users to understand the entity’s material impacts on people and environment and the material effects of sustainability matters on the development, performance and position of the entity.16 In designing those procedures, practitioners should take into account the qualitative characteristics of the information defined by the ESRS17 that require that the information (under the double materiality principle) shall be relevant and shall faithfully represent the substance of the phenomena, being complete, neutral and accurate. If, based on the procedures performed and evidence obtained, a matter has come to the practitioners’ attention to cause the practitioners to believe that the outcome of the process has not resulted in the disclosure of all material sustainability-related impacts, risks and opportunities in accordance with ESRS, the conclusion in the limited assurance report should reflect this situation (see section 18). 9. Responding to risks Based on the procedures performed for risk identification and assessment (described in section 7), practitioners should design and perform further procedures to respond to those risks, and/or on the disclosures where material misstatements are likely to arise. Procedures to respond to risk of material misstatements due to fraud and to suspected or identified instances of non-compliance with laws and regulations should also be performed. Examples of techniques that may be used for these procedures in a limited assurance engagement include, amongst others, inspection, observation, confirmation, recalculation, reperformance, analytical procedures and/or inquiry, on a standalone basis or in combination, at the level of the entity (including other entities or value chain from which the information may stem). Tests of details (so called substantive procedures) and/or tests of controls are not required but may be performed if deemed effective by the practitioners to collect evidence in the circumstances. The nature, timing and extent of procedures to be designed and performed by the practitioners should allow them to conclude with limited assurance regarding whether sustainability statements are free from material misstatements. Procedures should be designed and performed by the practitioners to obtain sufficient appropriate evidence on which to base the limited assurance report. 13 See section 9 for the description of further procedures on those disclosures Defined in ESRS 1 chapter 3 15 Including ESRS1 chapter 3 and ESRS 2 IRO1 and ESRS E1, E2, E3, E4 E5, G1 (see appendix C of ESRS 2), and non-binding guidance on materiality assessment issued by EFRAG which is available to facilitate the implementation 16 See eg.ESRS1 paragraph 2 17 See ESRS 1 paragraph 19 and following paragraphs, including section 3 14 4 CEAOB Adopted on 30 September 2024 10. Forward-looking information Information reported according to the ESRS includes impacts, risks and opportunities, and, when those are in place, the description of relevant policies, targets and action plans, in addition to metrics. These types of information may encompass a forward-looking dimension. Practitioners should focus on whether the information provides the existing policies, targets and plans of the entity when those are in place. Practitioners are not expected to provide a guarantee that the forward-looking information will play out as disclosed by the entity, but they should remain critical with regards to forward-looking information provided, including whether the underlying methods used for developing forward looking information are appropriate and have been applied consistently. If forward-looking information identified during the procedures targeted at risk identification and assessment seem unreasonable, practitioners should further assess whether the information meets the qualitative characteristics of the information18 required by the ESRS and evaluate the implications for their conclusion in the assurance report (see section 18). 11. Estimates If the practitioners identify during the procedures targeted at risk identification and assessment that the estimates seem unreasonable, practitioners should further assess whether the information meets the qualitative characteristics of the information19 required by the ESRS and evaluate the implications for their conclusion in the assurance report (see section 18). Practitioners are not required to perform test(
9. s)of details (so called substantive procedures) on the estimates but should remain critical with regards to estimates used for the disclosures, including underlying methods used. 12. Communication between practitioners and with other professionals Communication between practitioners and the statutory auditors of the entity (and/or subsidiaries) should take place, if not prohibited by laws or regulations, at appropriate points in time during the limited assurance engagement and before the signature of the limited assurance report and the signature of the audit report(s). The aim of the communication is for both parties to inform each other about the risks and misstatements identified on matters of connectivity between the financial statements and the sustainability statements. Practitioners should communicate with the statutory auditor(
10. s)of the entity (and/or subsidiaries) to the extent necessary to evaluate the consistency of the information provided in the sustainability statements with the information relating to relevant matters disclosed in the financial statements. The practitioners and the statutory auditors involved in the communication remain fully responsible for the conclusions in their respective engagements. If the statutory audit and the limited assurance engagement are performed by the same audit firm under the lead of different key partners/leaders, there should be communication between those key partners/leaders. Sustainability statements may include information for entities which belong to a group. In those situations, there should be communication between the practitioner and other practitioner(
11. s)engaged to perform procedures or assurance work on material information of entities which the practitioner has determined to be relevant for the consolidated sustainability statements. This should also apply to communication between team leaders in a situation where the same firm is involved in various entities in the same group. When one or more third parties (other than the practitioners of the limited assurance engagement for the entity) have been mandated to carry out assurance work on some parts of the sustainability information, the practitioners should consider using this work to avoid duplication in carrying it out again, taking into consideration their assessment of the objectivity of the third party and of the work performed. 18 see e.g. ESRS1 paragraph 19, ESRS 1 Appendix B QC 7 – “any aspirational sustainability information, for example targets and plans, shall cover both aspirations and factors that could prevent the undertaking from achieving these aspirations in order to have a neutral depiction.” 19 see e.g. ESRS 1 Appendix B QC 9 – “clear emphasis on possible limitations and associated uncertainty” 5 CEAOB Adopted on 30 September 2024 When two or more practitioners are engaged for the same limited assurance engagement, they should communicate and share the work according to provisions detailed in appendix 3. Practitioners should in all instances comply with the applicable confidentiality and professional secrecy rules when communicating with others and bear in mind that communication with others does not reduce or change the practitioners’ responsibilities for the limited assurance engagement and the assurance report. 13. Accumulation and consideration of identified misstatement(
12. s)In the context of sustainability reporting, misstatements identified during the limited assurance engagement often cannot be accumulated (into a single ‘total’ misstatement amount) to determine their effect in aggregate, particularly for qualitative information, given the variety of types of information. Before concluding in their report, practitioners should thus consider all the misstatements identified to determine whether: - there are one or more material misstatements; and/or when all are considered, considering the size, nature and number of misstatements, they may reasonably be expected to influence the decisions taken by the intended users of the sustainability statements. II – Disclosures provided to address Taxonomy Regulation Article 8 The limited assurance engagement covers the disclosures to be reported in the sustainability statements to comply with the provisions of Article 8 of the Taxonomy regulation (and the related taxonomy reference framework).20 Those disclosures are referred to hereafter as “Article 8 disclosures”. The other provisions of this document apply to those disclosures, together with those described in this part II. 14. Obtaining an understanding of the processes for determining eligible and aligned activities As per their understanding of the entity, 21 practitioners should obtain an understanding of processes that the entity has implemented to identify its activities, their nature (eligible/aligned) and prepare the disclosures required by Article 8. In particular, practitioners should: - assess whether these processes cover all of the economic activities, including the economic activities of the entity and those entities included within the scope of consolidation, evaluate whether these processes are appropriate to comply with the requirements of the taxonomy reference framework in terms of preparation and formal presentation, and evaluate whether these processes provide that the data used to prepare the key performance indicators (KPIs) reconcile with the accounting information underlying these disclosures. 15. Presentation Practitioners should evaluate whether the disclosures are presented in accordance with the requirements of both the ESRS and of the taxonomy reference framework, namely: - 20 21 disclosures are provided for each of the environmental objectives defined in the taxonomy reference framework, disclosures are included in a clearly identifiable part of the environmental section of the sustainability statements, and disclosures comply with the rules set out in the taxonomy reference framework. ESRS1 section 8.3 paragraph 113 See section 7 of the guidelines 6 CEAOB Adopted on 30 September 2024 16. Procedures on Article 8 disclosures Based on the information gathered when obtaining an understanding of the entity, practitioners should identify and assess the risks of material misstatements in Article 8 disclosures (or, for the first year, identify where material misstatements are likely to arise) and perform appropriate further procedures on selected disclosures. This identification of disclosures to be specifically evaluated involves consideration of the likelihood of occurrence and the magnitude of any misstatement, covering inaccuracies, deficiencies or omissions in the disclosures. For each Article 8 disclosure selected, the practitioners should: • • • • • assess whether the disclosure meets the requirements of the taxonomy reference framework, including the format in which these activities are presented, assess whether the eligible economic activities meet the cumulative conditions set out in the taxonomy reference framework to qualify as aligned and, in particular, whether the technical criteria defined in the taxonomy reference framework are met, assess whether the selected key performance indicators and the accompanying disclosures have been defined and calculated in accordance with the taxonomy reference framework, reconcile the accounting data underlying the information selected to the financial statements and, where necessary, communicate with the statutory auditors in this regard, and evaluate whether the disclosures are consistent or coherent with the other information reported according to the ESRS (E1, E2, E3, E4 and E5). III - Digitalisation of the information The EU digitalisation rules for sustainability statements are not adopted at the date of issuance of the guidelines. The guidelines thus do not cover the requirements introduced by the CSRD related to the electronic format of the information and the compliance of the sustainability statements with the requirements to mark up the information. IV - Limited assurance report 17. Format and content The practitioners’ limited assurance report should be in writing and should be signed and dated by the natural person responsible for carrying out the engagement in a personal capacity or on behalf of the audit firm or of the assurance services provider appointed. It should be written clearly and understandable by the intended users.