Limited versus reasonable assurance: what changes for the preparer

Most preparers first meet the phrase "reasonable assurance" in a regulatory timeline, as a year several cycles away. It reads like a scheduling detail. It is closer to a change in what your reporting process has to be able to prove about itself.

The two levels are not two grades of the same review. They ask different questions.

The two levels, in plain terms

Under limited assurance, the practitioner performs enough work to conclude that nothing has come to their attention suggesting the information is materially misstated. The conclusion is worded negatively, and that wording is doing real work — it is a statement about what they did not find.

Under reasonable assurance, they express an opinion on the information itself. That is a positive assertion, and it requires substantially more evidence to support.

Neither gives absolute assurance. No assurance engagement does.

Both sit within ISSA 5000, which is convenient for you: moving from one to the other is a deepening of work under a single standard rather than a change of rulebook, as covered in what ISSA 5000 changes for the company being assured.

What your assurer does differently at reasonable

Think of assurance work as rungs.

Enquiry — they ask you how the process works and you describe it. Cheap, and weak evidence on its own.

Analytical procedures — they compare the figure against an expectation. Your electricity consumption fell 12% while headcount rose; why?

Substantive testing — they trace individual figures to source documents. This is where your evidence either exists or does not.

Tests of controls — they test the control itself rather than the figure. Not "is this number right" but "does the process that produced it reliably produce right numbers".

Limited assurance leans on the first two with some of the third. Reasonable assurance reaches the fourth.

What that means for the evidence you keep

Here is the distinction that matters most, and it is easy to miss.

Under limited assurance, you need to show that a figure is supported. One invoice, one approval, one explanation.

Under reasonable assurance, you need to show that a control operated. That is a claim about repetition across time, not about a single instance.

A worked example. Your process says site data is reviewed monthly before consolidation. Under limited assurance, showing the March review may be sufficient to demonstrate the process exists. Under reasonable assurance, your assurer will want to see that the review happened in January, February, April and every other month too — and that where it did not, someone noticed.

A single sign-off in March, on the annual figure, does not evidence a monthly control. It evidences an annual one.

The controls question

ISSA 5000 differentiates the requirements around obtaining an understanding of the entity's system of internal control between the two levels, and it broadens the scope of tests of controls generally, encouraging a controls-based approach without mandating one.

What that means in practice: if you have controls worth testing, your assurer can lean on them and reduce substantive work. If you do not, they fall back on testing individual figures — which means larger samples and more requests landing on your team.

The counterintuitive consequence is that having no formal controls does not reduce your workload during the engagement. It increases it.

Cost, time and the work that shifts to you

Fees go up moving from limited to reasonable. That is expected and is not the part worth planning around.

The part worth planning around is the internal effort. More sampled figures means more document retrieval. Testing controls means producing evidence that a process ran month after month, which either exists as a by-product of how you worked or has to be assembled.

Assembled evidence is expensive and, as covered in The audit trail behind your climate numbers, an assurer is trained to recognise reconstruction.

Preparing for reasonable while you are still under limited

Three things, none of which require you to be under reasonable assurance to start.

Make approvals records. Named person, timestamp, what was approved, on what basis. Covered in detail in who signs off on a climate disclosure figure.

Keep previous values. When a figure changes, retain what it was. This is what converts a set of files into a change history.

Run the control on the cadence you claim. If your process document says monthly review, review monthly and record it. Nothing is more damaging than a stated control that visibly did not run.

The opinion: the gap between limited and reasonable is mostly a gap in habits, not in systems. The evidence reasonable assurance requires is almost entirely produced by working in a way that records itself. Companies that wait for the mandate before changing how they work end up buying the evidence retroactively, at the worst possible time and at the highest possible cost.

Common questions

What is the difference between limited and reasonable assurance?

The level of confidence and the amount of work behind it. Under limited assurance the conclusion is expressed negatively: nothing came to the practitioner’s attention suggesting the information is materially misstated. Under reasonable assurance the practitioner expresses an opinion on the information itself. Neither provides absolute assurance.

Does reasonable assurance mean my controls get tested?

Yes, and that is the shift that catches preparers out. Under limited assurance your controls are understood but tested less deeply. Under reasonable assurance the control itself becomes the subject of testing, which means showing it operated repeatedly across the whole period rather than once at year end.

How much more work is reasonable assurance for the preparer?

It varies with how much record you already keep, but the shape of the increase is predictable: more figures sampled, more source documents requested, and evidence that a control ran throughout the period rather than a single sign-off at the end. Teams that already keep approvals and change history feel it least.

Can I prepare for reasonable assurance while still under limited?

Yes, and it is much cheaper than retrofitting. Record approvals as records rather than emails, keep previous values when a figure changes, and attach source documents to the figures they support as you go. None of that requires you to be under reasonable assurance to start.