Is there enough assurance capacity for ISSA 5000?

Preparers ask what ISSA 5000 requires of them. Almost nobody asks the question behind it, which is whether there will be somebody available to do the engagement.

It is a fair question, and the honest answer has two halves: one that can be stated from published sources, and one that cannot be quantified at all. Both halves matter, and we will keep them separate.

The question preparers are not asking yet

In a financial audit, capacity is a solved problem. The firms exist, the timetable is familiar, and your engagement partner was appointed years ago.

Sustainability assurance has none of that history in most markets. The requirement is arriving through jurisdictional adoption on national timetables, the standard governing it is new, and the population of firms able to sign is still forming. That is not a crisis. It is a scheduling problem that behaves very differently depending on when you start.

What changes on 15 December 2026

ISSA 5000, General Requirements for Sustainability Assurance Engagements, is effective for assurance engagements on sustainability information reported for periods beginning on or after 15 December 2026, or as at a specific date on or after that day. Early application is permitted, and the IAASB encourages it.

On the same date, ISAE 3410 has been withdrawn — the standard that previously governed assurance engagements on greenhouse gas statements. In jurisdictions adopting IAASB standards, ISAE 3000 (Revised) also stops applying to sustainability assurance engagements once ISSA 5000 is effective.

Two standards become one. It covers both limited and reasonable assurance, and it applies to voluntary engagements as well as those required by law, which matters if you are assuring ahead of a mandate.

Non-accountant practitioners are in scope

The IAASB describes ISSA 5000 as designed for use by both professional accountants and non-accountant assurance practitioners. The standard is deliberately profession agnostic.

Structurally this expands the pool of firms that could, in principle, provide sustainability assurance beyond the accountancy profession. It sits alongside sustainability-related ethics and independence standards issued by the IESBA, so a common ethical framework is available to practitioners who are not members of an accountancy body.

Two cautions before reading that as capacity relief. First, being permitted by a standard is not the same as being permitted in your jurisdiction: national regulators decide who may sign an assurance report, and several restrict it to registered auditors. Second, an engagement is only as useful as the assurance provider's standing with the people who read your report. Check both before you appoint.

Where the constraint actually sits

If there is a squeeze, it will not be evenly distributed, and reasoning about its shape does not require data nobody has.

It is seasonal. Sustainability assurance is tied to the reporting cycle in the same way as audit. Most companies in a jurisdiction share a year end, so demand arrives in the same few months rather than spread across the year. Annual capacity is not the binding number; capacity in the busy quarter is.

It is concentrated in experience, not headcount. The scarce input is people who have run an engagement over greenhouse gas data before — who know what a defensible Scope 2 position looks like and how to test a value chain estimate. That population grows through cycles, not hiring.

It is worse where the reporting is worse. An unprepared file consumes far more practitioner time than a prepared one. Every company that arrives with untraceable figures removes capacity that would otherwise have gone to somebody else.

That last point is the one preparers can act on, and it is the only one they control.

What we can and cannot say about supply

Here is the part where a research note has to be disciplined.

We cannot tell you how many practitioners will be available. There is no reliable public count of firms able and willing to sign sustainability assurance reports in any given jurisdiction, no reliable count of qualified staff within them, and no published measure of how many engagements one team can carry in a season. Any article that gives you a ratio of reporters to assurers has estimated at least one side of it.

We are not going to produce that number, because we would be inventing it, and a fabricated statistic on this subject would travel further than it deserves.

What can be said is structural. The demand side has dates attached: jurisdictions have published adoption timetables, and 15 December 2026 is fixed. The supply side has no equivalent published schedule. When one side of a market has a hard date and the other does not, the timing risk sits with whoever moves last.

That is a claim about sequencing, not about scarcity, and it holds whether or not there turns out to be a shortage.

What this means if you engage late

The realistic consequences of a late engagement are not that you cannot find anyone. They are narrower and more expensive than that.

You get less choice of provider, and less room to negotiate scope and fee. You lose the readiness review, which is the genuinely valuable part — being told in advance what will be asked for, while there is still time to produce it. You compress fieldwork into the weeks before your reporting deadline. And you discover control gaps at the point where the only remaining option is a modified conclusion, because a control cannot be operated retrospectively.

That last one is the real cost. A missing approval from March cannot be created in December, a point we make at length in who signs off on a climate disclosure figure.

A sensible engagement timetable

The sequencing above is illustrative rather than required by any standard, and jurisdictional timetables differ. But the shape holds: the further left an activity sits, the more optionality you keep.

The six-month step is the one that cannot be compressed. Evidence, provenance and recorded sign-off either exist by the time the period closes or they do not, and no amount of fieldwork intensity creates them afterwards. It is also the step most likely to be skipped, because it is internal work with no external deadline attached.

If you want to know what a provider will ask for before you ask one, what auditors check in a first cycle is the shorter version, and our readiness questionnaire scores the same ground in about ten minutes.

The position: capacity is unknowable, and that is precisely why it is not worth waiting to find out. If supply turns out to be comfortable, engaging early costs you nothing but a few earlier meetings. If it turns out to be tight, engaging early is the whole difference. That asymmetry is the argument, and it does not need a number to work.

Common questions

When does ISSA 5000 take effect?

It is effective for assurance engagements on sustainability information reported for periods beginning on or after 15 December 2026, or as at a specific date on or after 15 December 2026. Early application is permitted, and the IAASB encourages it. Jurisdictions decide separately whether and when to adopt it.

What happens to ISAE 3410?

The IAASB states that ISAE 3410, which covered assurance engagements on greenhouse gas statements, has been withdrawn with effect from 15 December 2026, the effective date of ISSA 5000. In jurisdictions adopting IAASB standards, ISAE 3000 (Revised) also ceases to apply to sustainability assurance engagements from that point.

Can a firm that is not an accountancy firm provide sustainability assurance?

Under ISSA 5000, yes in principle. The IAASB describes the standard as profession agnostic and designed for use by both professional accountants and non-accountant assurance practitioners. Whether a particular non-accountant firm may sign your engagement is decided by your jurisdiction, not by the standard.

How early should I engage an assurance provider?

Earlier than most first-cycle preparers do. The work that determines how an engagement goes is the evidence, provenance and sign-off behind your figures, and that cannot be created retrospectively. Approaching providers around twelve months before the reporting date leaves room for a readiness review while there is still time to act on it.