ISAE 3000 assurance readiness for information your stakeholders can trust.

What it is

What is ISAE 3000 and what is it used for?

ISAE 3000 (Revised), Assurance Engagements Other than Audits or Reviews of Historical Financial Information, is the International Auditing and Assurance Standards Board's general standard for assurance on anything that is not a set of past financial statements. An independent practitioner evaluates information about a subject matter against stated criteria and reports a conclusion that intended users can rely on. ISAE 3410, Assurance Engagements on Greenhouse Gas Statements, applies the same logic to an entity's emissions statement.

Readiness is the work before the assurer arrives. The practitioner cannot accept an engagement where the criteria are unclear, the data cannot be traced or the evidence does not exist. Most first engagements that stall do so on exactly those points, and each one is fixable in advance.

Current editions. ISAE 3000 (Revised) was issued on 9 December 2013 and applies to assurance reports dated on or after 15 December 2015. ISSA 5000, General Requirements for Sustainability Assurance Engagements, was issued in November 2024 and takes effect for sustainability information reported for periods beginning on or after 15 December 2026, or as at a date on or after then. From that date the IAASB withdraws ISAE 3410, and ISSA 5000 replaces ISAE 3000 (Revised) for sustainability assurance, except where a jurisdiction has not yet adopted it. Early application is permitted.

Who it is for

Who needs ISAE 3000 assurance?

No standard makes assurance compulsory on its own; demand comes from the people who read your information. Organisations come to Sterling for assurance readiness from four starting points:

• Customers want assured figures. A major customer asks for independently assured emissions data, or for assurance over the controls or performance claims in your service commitments, before renewing a contract.
• A tender or financing condition asks for it. Bids, sustainability-linked loans and investor questionnaires increasingly score assured information above self-declared figures.
• A regulator or exchange expects it. Reporting rules in your jurisdiction may require assurance on published sustainability or other information; we work alongside your legal advisers on what applies to you.
• The group needs one answer. A parent company is collecting assured data from every subsidiary, and each local team must produce records that hold up to the same practitioner.

Readiness pays off whether or not assurance is mandatory: numbers that can be traced and defended are numbers management can decide on.

Requirements

What are the main ISAE 3000 requirements?

ISAE 3000 (Revised) is written for the practitioner, but most of its preconditions depend on you. Before accepting, the practitioner must be satisfied on each area below; during the engagement it gathers evidence against them. The list is a plain-language map at title level, not a substitute for the standard.

• Engagement type: an attestation engagement, where you measure or evaluate the subject matter, or a direct engagement, where the practitioner does.
• Level of assurance: reasonable assurance, with engagement risk reduced to an acceptably low level, or limited assurance, with more risk accepted and less work performed.
• Roles and responsibilities: the responsible party, the measurer or evaluator, the engaging party and the intended users identified, with suitable responsibilities for each.
• Appropriate subject matter: something that can be identified and consistently measured or evaluated.
• Suitable criteria: relevant, complete, reliable, neutral and understandable, and available to the intended users.
• Access to evidence: records, systems and people available so that the practitioner can support its conclusion.
• Purpose and report: a rational purpose for the engagement, and a conclusion expressed in a written report, unmodified or modified.
• Practitioner obligations: ethics, independence, quality management, professional scepticism, planning, evidence, subsequent events and documentation, all on the practitioner's side of the table.
• Greenhouse gas statements: ISAE 3410 until its withdrawal takes effect; ISSA 5000 for periods beginning on or after 15 December 2026.

Assurance route

How do you prepare for an ISAE 3000 assurance engagement?

You prepare the subject matter, the criteria and the evidence; an independent practitioner then decides whether to accept the engagement and performs it. Keeping those roles apart is what gives the conclusion its value.

1. 01
   Define the subject matter, the users and the level.Agree what will be assured, for which period or date, for whom, against which criteria, and whether limited or reasonable assurance is required.
2. 02
   Gap analysis: test your information against the preconditions.The gap analysis traces reported figures to source, reviews the criteria for suitability and lists missing controls, records and owners, with actions and dates.
3. 03
   Write the basis of preparation and fix the data trail.Document criteria and methods, introduce reviews and reconciliations, correct data gaps and start producing evidence for the reporting period.
4. 04
   Readiness assessment before the practitioner starts.Sterling samples and re-performs as an assurer would, so errors and missing records are corrected while they can still be corrected.
5. 05
   The assurance engagement.The practitioner confirms acceptance, plans, gathers evidence and issues its report with a limited or reasonable assurance conclusion; we support you through its requests.

Check the practitioner before you sign. Ask which standard it will report under (ISAE 3000 (Revised), ISAE 3410 or ISSA 5000), the level of assurance, the ethics and independence requirements it applies, its quality management arrangements and any local licensing your regulator or customer expects, and confirm them directly. Be wary of one firm offering to prepare your figures and also assure them.

Cost

How much does ISAE 3000 assurance readiness cost?

Readiness for one emissions statement at a single site is a different piece of work from preparing a multi-country report for reasonable assurance. The scope sets the effort; our proposal sets the fee, fixed and itemised.

Timeline

How long does ISAE 3000 assurance readiness take?

Two dates drive the plan: the end of the reporting period the practitioner will examine, and the date the report must be published. As an estimate, limited assurance on an established data set is usually achievable in three to six months; a first reasonable assurance engagement, or a new reporting process, more often needs nine to fifteen, because controls must operate through the period being assured.

Tell us your publication date at the first meeting. If it is not achievable at the level of assurance you want, you should hear that before work starts, not during fieldwork.

Your engagement

What your ISAE 3000 readiness engagement includes

Sterling OS™ organises the work. You choose one support level for the build, Design™ or Drive™; they are alternatives, not stages. Sterling does not provide assurance, and does not certify, attest or validate: the conclusion belongs to the independent practitioner.

• Design™: guided readiness

  Your team does the work with Sterling's method, templates and review at each milestone.

• Drive™: managed readiness

  Sterling's consultants carry the build with your data owners, from criteria to evidence trail.

• Automate™: Effivity

  Data points, owners, reviews and evidence in one workspace, included with the engagement at no additional cost.

• Training for everyone

  Internal auditor training for your review team, as applicable to your standard, and preferential Sterling Academy access, including complimentary awareness training for your people as part of the engagement.

• Readiness assessment

  A sample-based test of your report before the practitioner starts, with gaps closed on evidence.

• Sustain™ after the first report

  Support for each new period, the step up to reasonable assurance and the ISSA 5000 changeover.

Assurance conclusions remain with the independent assurance practitioner.

Often combined with

Standards organisations pair with ISAE 3000 / ISAE 3410

• AA1000AA1000 implementation and requirements: apply the AccountAbility Principles and SES, then prepare for AA1000AS v3 assurance by a licensed provider.
• B Corp CertificationB Corp certification made clear: the new B Lab Standards, Foundation Requirements, seven Impact Topics, the audit route and how Sterling prepares you.
• CBAMCBAM compliance and requirements explained: authorised declarant status, the 50-tonne threshold, verified embedded emissions and how Sterling helps you prepare.
• CDPCDP disclosure consulting: a complete, evidenced response on climate, forests and water, prepared with your team.
• CSDDDCSDDD compliance and requirements after Omnibus I: scoping, risk-based due diligence, complaints, monitoring and the 2029 start, delivered in one all-inclusive proposal.
• CSRD / ESRSCSRD and ESRS Sustainability reporting consulting: double materiality, ESRS disclosures and data prepared for limited assurance of your statement.