CSRD readiness: limited assurance approach to value chain information

The Corporate Sustainability Reporting Directive (CSRD) requires companies to draw up sustainability reports in accordance with the European Sustainability Reporting Standards (ESRS). According to the CSRD, these reports will also be subject to assurance. The first sustainability reporting and assurance reports will be published in 2025 on 2024 data.

Professional assurance standards such as the International Standard on Sustainability Assurance (ISSA 5000) and CEAOB guidelines outline principles for sustainability reporting assurance engagements. The European Commission will adopt an EU limited assurance standard to define expectations for practitioners conducting limited assurance engagements in the EU on the basis of CEAOB technical advice including adds-on and possible carve-outs to ISSA 5000 (see EC letter to CEAOB).

In this series of three papers, we share some key aspects on the assurance practitioner’s approach to double materiality assessment, value chain information and transition plans to contribute to the CSRD implementation and readiness debate.

These three short papers are meant to provide a high-level explanation of the limited assurance approach rather than a detailed roadmap of procedures. They are primarily addressed to stakeholders such as users of assurance and structured in three parts:

• facts and principles from the CSRD and ESRS including those that are key to the assurance engagement
• high-level explanation to limited assurance approach along with examples
• preparer’s perspectives on value chain information

Value Chain information

Facts and principles – CSRD/ESRS

According to the ESRS, a company shall identify and assess material impacts, risks and opportunities in its value chain to determine the information to include in its sustainability statement. The company shall then disclose to what extent the sustainability statement covers its upstream and downstream value chain based on this identification and assessment.

Most of the disclosure requirements and datapoints in the ESRS focus only on a company’s own operations and do not require value chain information. For example, ESRS disclosure requirements related to metrics apply only to the company’s own operations, except for GHG related disclosures, and entity-specific disclosures if the company determines that value chain information is material.

Companies can report value chain information either by validating data gathered from value chain actors or using estimates or proxies when the data unavailable. 

Under the optional transitional provisions in the ESRS, companies may for the first three years:

• limit value chain information to that available in-house for policies, actions and targets
• omit value chain information for metrics, except for datapoints derived from EU legislation[1]

Limited assurance approach

Company’s management is responsible for preparing and presenting the value chain information in line with the CSRD and ESRS requirements. This means that reported information should be relevant, complete, neutral and accurate regardless of the level of external assurance.

The exact nature and extent of assurance procedures will depend on the engagement circumstances and the practitioner’s risk assessment. In this regard, an important factor is how the company collects and reports information about its upstream and downstream value chain, including products and services, business relationships and supply chain.

For value chain-related disclosures on matters managed by the company itself, such as policies, actions and targets that address the actors in the value chain, the assurance work may largely be performed at the reporting entity level where policies, actions and targets are developed and set.

For other value chain-related disclosures, the practitioner may decide to:

• perform assurance procedures directly at the value chain actor
• perform assurance procedures on the controls and other procedures over the data provided by the company
• carry out analytical work and/or independent research
• rely on the work of another assurance provider if a value chain actor issues a sustainability report subject to independent assurance. This can only be done considering the practitioner’s independence, competence and the nature and extent of procedures performed.

If, after making reasonable efforts, a company cannot obtain the required value chain information or make estimates using sector-average data or proxies, the company needs to disclose this. If the practitioner in their professional judgement deems the omission of such information material for users, then a scope limitation may exist. In such cases, the inability to obtain sufficient appropriate evidence could require the practitioner to express a qualified conclusion (if the matter is material but not pervasive) or disclaimer of a conclusion (if the matter is both material and pervasive). In certain circumstances, an emphasis of matter paragraph might suffice based on a national limited sustainability assurance standard or guidance.

If a company opts for the ESRS transitional provisions for value chain information, a scope limitation would not be required.  

Preparer perspectives

As a financial services company, our value chain in relation to suppliers is quite simple and therefore we have not come across a significant challenge in terms of data collection with one exception: the scope 3 GHG emissions where, I guess, everyone is struggling with obtaining accurate data.

Paul Symons – Chief Sustainability Officer, Euroclear

Determining the extent of value chain information to be reported is the crux of the CSRD reporting. I am pretty sure that over the next few years, there will be some common ground based on reporting practices. In the meantime, it’s very important that companies are transparent about their principles and approach to value chain reporting.

Jane Thostrup – Director, Net Zero Finance

[1] EFRAG Implementation Guidance IG 2 Value chain, Section 2.7 https://www.efrag.org/sites/default/files/sites/webpublishing/SiteAssets/EFRAG%20IG%202%20Value%20Chain_final.pdf