Annual reports increasingly carry a statement from an independent party, and the wording of that statement depends on two terms: limited assurance and reasonable assurance.
The two assurance levels
Linklaters, summarising the international standard for sustainability assurance, explains that limited assurance gives substantially lower assurance than reasonable assurance, because the procedures differ in nature, timing and extent.
| Feature | Limited assurance | Reasonable assurance |
| Level of assurance | Substantially lower | Higher |
| Procedures | Differ in nature, timing and extent | More extensive |
ISSA 5000
The International Auditing and Assurance Standards Board published ISSA 5000 on 12 November 2024, following consultation from August to December 2023. It applies to sustainability assurance engagements for reporting periods beginning on or after 15 December 2026, and early application is permitted.
Linklaters notes these features:
- It covers sustainability information on any topic, prepared under multiple frameworks
- It can be used by professional accountants and by other practitioners
- It addresses both limited and reasonable assurance
- It works with traditional and double materiality concepts
The standard builds on existing practice, including ISAE 3000 and ISAE 3410. Individual jurisdictions decide whether assurance is required and whether the standard is mandatory.
What a draft Swiss law would require
Under the draft Federal Act on Sustainable Corporate Governance that the Federal Council put out for consultation on 1 April 2026, all in-scope companies would need limited assurance over the whole sustainability statement, according to PwC Switzerland. Assurance providers would be subject to independence and ethics requirements. The draft is not yet law.
Assurance beyond sustainability
Independent assurance covers more than emissions or climate. Forvis Mazars in Switzerland lists these review areas on its service page:
- Internal controls, such as ISAE 3402, SOC 1 or SOC 2 reports
- Equal pay for women and men
- Human rights
- Corporate culture
- Anti-bribery and corruption
- Diversity and inclusion
- Data privacy or security
- Fraud
- Carbon emissions
An internal controls report is the type many service organisations provide to customers, who rely on it when assessing outsourced processes.
The EU timetable behind it
Linklaters also reports that the European Commission must adopt limited assurance standards by 1 October 2026 and reasonable assurance standards by 1 October 2028, if reasonable assurance is found feasible, and that member states may use national standards until the Commission adopts one. Swiss groups with EU subsidiaries may meet these requirements through their foreign entities, so it is worth asking which standard each entity will use.
Linklaters adds that ISSA 5000 does not include EU-specific requirements such as the taxonomies. Practitioners therefore explain how the international standard and local requirements fit together.
An example from outside sustainability
A software company that hosts customer data may be asked by clients for a SOC 2 report. That is an independent report on controls over a defined period, and customers use it during procurement and vendor reviews. The company chooses the scope with the practitioner, such as the systems and trust criteria covered, and the report states what was tested.
Similar logic applies to an equal pay review or a carbon emissions statement: the organisation decides the subject, the practitioner applies a standard and the report records the result.
How to read an assurance report
Readers can check four things:
- The subject matter: which numbers or statements were covered?
- The criteria: which framework was used to measure them?
- The level: limited or reasonable?
- The scope exclusions: what was left out?
A report that covers only some indicators gives no comfort about the rest. A limited report on emissions says less than a reasonable one, and both say nothing about areas outside their scope.
Choosing and briefing a practitioner
Organisations commissioning assurance for the first time can ask what standard the practitioner follows, how independence is managed and what evidence will be required from management. Teams that have mapped data sources before the work begins find the process shorter.
Boards looking at Independent assurance services in Switzerland often start with one subject, such as an internal controls report, and add others as stakeholders ask.
A planning note
For reporting periods beginning on or after 15 December 2026, ISSA 5000 will apply to engagements under it. Companies with calendar financial years will see the first full-year effect in their 2027 reports. They can use 2026 to agree the scope and level of assurance with their practitioner.
Disclaimer: This article contains sponsored marketing content. It is intended for promotional purposes and should not be considered as an endorsement or recommendation by our website. Readers are encouraged to conduct their own research and exercise their own judgment before making any decisions based on the information provided in this article.
