ESG reports: understanding limited assurance and its limitations

The European Commission is consulting until 18 January 2027 on the assurance of sustainability reports. What limited assurance checks, and how to distinguish it from funds’ ESG disclosures in Luxembourg.

On 12 November 2026, the European Commission launched a consultation on standards for “limited assurance” applied to companies’ sustainability reports. The issue is a practical one for readers: understanding what an independent review allows them to glean from this information, and what it does not say about a company’s environmental or social performance.

ESG criteria refer to environmental, social and governance issues. Under the EU’s CSRD, the large companies concerned must publish sustainability information in accordance with the applicable rules. Assurance involves having this information examined by an independent professional. It concerns the reliability of what is reported against defined criteria, not a promise that the company’s activities are beneficial.

A consultation on how reports are checked

The Commission is seeking feedback on a draft set of limited assurance standards. These draw on technical advice from the Committee of European Auditing Oversight Bodies (CEAOB), as well as international standards adapted to the EU legal framework. Companies, auditors, independent service providers, investors, standard-setting bodies, supervisory authorities and civil society organisations can respond until 18 January 2027.

This is a consultation on a draft, not on standards that have already been adopted. Responses should help assess the technical advice and proposed adjustments, as well as how the standard would work in the European context. The European Commission outlines the consultation and its deadline here.

The level of assurance chosen has legal and practical implications. In the Omnibus I simplification package, the Commission states that the EU requirement will remain limited assurance and that the option of subsequently requiring reasonable assurance has been removed. This describes the direction chosen for the EU framework; it does not exempt reports from being checked. A more in-depth voluntary engagement remains a separate possibility, subject to its own terms.

“Limited” does not mean “unchecked”

Reasonable assurance provides a high level of confidence, but never absolute certainty. Limited assurance provides a considerably lower level, while still being useful. The difference affects the nature, timing and extent of procedures, as well as the evidence gathered. It is therefore not simply a formality or a questionnaire.

The IAASB, the international body that develops auditing and assurance standards, explains that the conclusion of a limited assurance engagement indicates whether the work performed and evidence obtained brought to light an issue that would lead the professional to believe that the information does not comply, in all material respects, with the applicable criteria. A conclusion that identifies no irregularities is information about the work carried out and its result; it does not guarantee that no errors exist. The IAASB’s explanation of the two levels sets out this distinction.

An example helps distinguish checking from performance. A company may accurately report high emissions: assurance can help verify how this data is presented, but it does not turn that level of emissions into a positive environmental outcome. Similarly, accurate information about working conditions does not, by itself, mean that those conditions are good. The report subject to assurance primarily answers a question about the reliability of the information, not about the company’s overall ranking.

What to look for in a conclusion

When reading an assurance report, start with its scope. Which group entities and subsidiaries, which period and which information are covered? A conclusion on part of the business or on a given financial year does not automatically extend to the rest of the group or to subsequent years.

Next, check the criteria used. Is the data examined against a defined reporting framework? What level of assurance is stated? Finally, identify the conclusion, any qualifications and any limitations on scope or work performed. These elements affect the significance of the information: two conclusions are comparable only if the periods, subjects covered and criteria are sufficiently alike.

A qualification or exclusion indicates a limitation that must be interpreted in context; in itself, it is not proof of fraud. Conversely, a favourable conclusion does not mean that the professional checked every item of data in the same way, or that all risks associated with the activity have disappeared. Assurance provides information about the credibility of the report within its stated framework, not about every management decision.

In Luxembourg, don’t confuse companies with funds

The subject is also relevant to how financial information is read in Luxembourg, where the CSSF published its supervisory priorities for sustainable finance in March 2026. These cover, in particular, fund disclosures and their consistency across pre-contractual documents, periodic reports and marketing materials, as well as whether a fund’s portfolio matches its name, objective or strategy.

This supervision falls, in particular, under the SFDR, the EU regulation on sustainability disclosures in financial services, and the Taxonomy Regulation. It is distinct from the assurance of company reports under the CSRD framework. In one case, the focus is on the sustainability information published by a company and its independent examination; in the other, the CSSF monitors, in particular, the consistency of fund managers’ disclosures and practices. The CSSF sets out its priorities.

For an investor, these two levels can intersect without answering the same question. Assurance of a company report helps assess the reliability of information used by different readers. The supervision of a fund examines, in particular, whether its documents and portfolio match the characteristics it claims. A higher level of assurance does not automatically rank a company as more sustainable; and the presence of ESG information in a fund’s documentation is not, by itself, a guarantee of environmental or financial performance.