Sustainability Assurance Is No Longer the Last Step

For many companies the sustainability reporting year has followed a familiar order. The narrative is drafted and the data collected. The report is written and designed; the final PDF then goes to the assurance provider shortly before publication.

That order made sense. When a sustainability report was largely narrative, with a modest set of historical performance indicators, most of the work sat in the writing. The figures were few, their calculations were relatively simple and assurance, where a company obtained it, usually covered a small number of them. Checking those figures near the end was manageable.

The order is harder to sustain now. Under IFRS S1 and S2, adopted in Malaysia through the National Sustainability Reporting Framework, a reported figure increasingly carries other disclosures with it: targets, scenario analysis and financial effects. When assurance raises a question about that figure, the answer may lie several steps upstream of the page.

What has changed?

The information behind the report has become more connected. A reported number rarely stands on its own. Total Scope 2 emissions depend on source data such as electricity invoices and meter readings; on a calculation that applies emission factors within a defined boundary; on a methodology that decides how gaps and estimates are treated. The result then feeds the analysis that turns it into target progress or a financial effect. The disclosure on the page is the last link in that chain.

An assurance question therefore tends to travel backwards. A question about a reported emissions figure may lead the reporting team to revisit the source data, the calculation method, the boundary or the evidence behind them. If the answer changes the figure, it may also change whatever was built on it.

Our article on why sustainability data is no longer separate from the sustainability report described how data has moved upstream of the report. Assurance has followed it. It can now generate changes before the report is final, which is a reason to plan for it rather than a reason to avoid it.

Assurance is not simply checking the PDF

Sustainability assurance is not a financial statement audit. An engagement is agreed for a defined subject matter, at a defined level of assurance, against defined criteria. Some engagements cover a handful of metrics; others cover a broader set of disclosures. Limited assurance involves less extensive procedures than reasonable assurance, which the Securities Commission Malaysia describes as a high but not absolute level of assurance.

Within its scope, an engagement may examine the information and evidence behind a disclosure rather than only the disclosure itself. Depending on the engagement, that can include source data and calculation workbooks, methodologies and emission factors, reporting boundaries and assumptions, supporting documentation, controls, reconciliations between source records and reported figures, the reported metrics and selected narrative disclosures. No single engagement necessarily covers all of them. What matters is where the work takes place.

The international baseline for this work is now the IAASB’s ISSA 5000, issued in November 2024 for both limited and reasonable assurance engagements and effective for periods beginning on or after 15 December 2026. It is profession-agnostic, so it can be applied by accounting firms and other assurance providers alike.

Malaysia is moving the same way. Bursa Malaysia’s Listing Requirements already ask listed issuers to state whether their sustainability statement has been reviewed by internal auditors or independently assured. In September 2026 the Advisory Committee on Sustainability Reporting, chaired by the Securities Commission, confirmed that reasonable assurance of Scope 1 and Scope 2 emissions under ISSA 5000 will become mandatory for Main Market issuers with a market capitalisation of RM2 billion or more for annual reporting periods beginning on or after 1 January 2028. Other Main Market issuers follow in 2029; ACE Market issuers and large non-listed companies in 2030. The committee’s 2025 consultation also proposed extending reasonable assurance to the IFRS S1 core content and Scope 3 emissions in later years; its decision on those proposals is still to come.

The committee deferred the first date by a year to give preparers time to strengthen reporting processes, controls and data quality. All three sit well upstream of the final PDF. Reasonable assurance over emissions will rest on the GHG inventory behind the figure: its data, factors, boundary and evidence.

Why the final PDF creates a particular problem

A sustainability report often moves from a Word draft to design, then to a designed PDF, management and Board review, assurance and final amendments. Design changes the cost of a change. In a Word draft, correcting a number is an edit. In a designed report the same correction may mean recalculating related figures, revising the narrative, updating a chart, a table and a footnote, amending the page layout, producing another PDF and sending it for another review.

Each step is small. Together they take time the timetable may not have allowed for. A corrected typing error stays a small fix at any stage; a corrected number that feeds other numbers is different, because the downstream work can be out of all proportion to the original issue.

That is why late assurance can be disproportionately disruptive. The question raised may be reasonable and the answer simple. The disruption comes from when it is asked.

Assurance, management review and Board review are different

Three processes often meet at the end of the reporting year. They ask different questions.

None of the three is unnecessary and none replaces another. The difficulty arises when all three are left until the end, because each can raise a question the other two then need to see answered.

How they are ordered varies. Some Boards review a draft while assurance is under way and approve the final version afterwards; others see the report once. The order matters less than knowing in advance which review depends on which.

The Board’s role has also changed

Sustainability disclosures increasingly contain information a Board would recognise as strategic: climate-related risks and opportunities, their financial implications, scenario analysis, targets, materiality judgements, governance and strategy itself. IFRS S1 also asks companies to disclose how the Board oversees these matters.

Directors may reasonably ask what a number means and why performance has changed. They may ask why a risk is considered material, what assumptions underpin the scenario analysis, why an exposure is described as it is and what evidence supports a statement. They may ask what would happen under a different scenario.

This is not scrutiny for its own sake. It reflects the strategic weight the information now carries. It also means a Board question can reach as far upstream as an assurance question; a question about why a topic is material leads back to the materiality assessment in the same way that a question about emissions leads back to the inventory.

Assurance can create a useful feedback loop

The same dependency can work in the company’s favour. A well-timed assurance process identifies questions while there is still time to resolve them properly. A question or finding leads back to the evidence or the calculation; the evidence is supplemented or the calculation corrected; the analysis is updated and the disclosure follows.

Seen this way, assurance is part of a feedback loop rather than a sign-off step at its end. A finding that changes a figure is not in itself a sign that something went wrong. Where it reflects a corrected boundary or better source data, the disclosure is more reliable for it. The same principle sits behind restating GHG emissions when better information becomes available.

The cost of resolving issues late

Consider one technical issue found at two different points. Found early, the path is short: the question is raised, the evidence is examined, the correction is made and the figure is updated.

Found after design, the same issue follows a longer path. The correction is followed by recalculation of dependent figures, redrafting of the narrative, redesign of the affected pages, a new PDF and another round of review. The technical issue is identical in both cases. The difference is the downstream work created by timing.

The reporting timetable needs to work backwards

The practical answer is not simply to start assurance earlier. Assurance cannot test information that does not yet exist. Starting before the data, calculations and analysis are mature tends to move the questions rather than answer them.

A more useful approach works backwards from the publication date. IFRS S1 asks for sustainability disclosures to be reported at the same time as the related financial statements; in Malaysia they form part of the annual report, which Main Market issuers publish within four months of the financial year end. Working back from that date shows what each stage depends on.

Read from the bottom, this is the familiar order of work. Read from the top, it shows how much has to be mature before the last weeks begin.

The designed report is part of the controlled information

Once information enters design, it becomes part of the record of what the company reports. Changes after that point need managing as carefully as the figures themselves.

The principles are familiar from financial reporting. Version control means everyone works from the same draft. Source data is reconciled to the report, amendments are tracked and a revised number is confirmed in every chart, table and footnote that uses it. The evidence for the final reported information is kept. None of this needs to be elaborate. It needs to be in place before the late changes arrive.

Several streams of work converge on the final report: data, calculations, narrative, financial information, assurance, Board review and design. They run in parallel for much of the year and they interact. Control is what brings them to the same version.

The report is becoming an integrated process

The broader process now runs from data to calculation and analysis, then to management decision, disclosure, assurance and revision before the final report. These stages interact; they do not necessarily happen once in a fixed order. A revision prompted by assurance can send the work back to the calculation; a management decision can change what the analysis needs to show.

The report is increasingly the output of an interconnected information process. Assurance is one of the places where the connections are tested.

What companies can do differently

Most of the change is in sequencing. Companies can identify early which disclosures depend on which data and which of them fall within the assurance scope. They can agree that scope and the provider’s expectations early in the year, prepare supporting evidence alongside the data rather than after it and reconcile source data to reported figures as they go.

A timetable that leaves room for assurance questions, builds in Board review and avoids unnecessary changes after design will absorb the questions that do arise. A controlled final version then keeps the report and its evidence aligned. For companies preparing their first IFRS S1 and S2 disclosures, building this into the first timetable is easier than retrofitting it into the second.

While there is still time

Sustainability assurance is increasingly part of the reporting process, not simply the final step before publication. The earlier the underlying data, calculations, analysis and evidence are sufficiently mature, the more useful assurance can be.

The objective is not to eliminate questions or prevent changes. It is to allow those questions to improve the underlying information and the disclosure while there is still time.

Ace CSR supports Malaysian companies with GHG accounting, IFRS S1 and S2 advisory and sustainability reporting, including preparing the evidence behind reported figures so that assurance questions can be answered while there is still time to act on them.