Sustainability reporting gathers pace

Sustainability assurance

From 1 January 2025, all large Irish companies will have to start collating information to report under European Sustainability Reporting Standards (ESRS). A year later, these same companies will be required to seek out a sustainability assurance service provider (SASP) to provide assurance over their reports.

The provision of sustainability information and compliance with ESRS is a legal requirement and a category 2 offence if not reported.

While the ESRS information will be included within the main financial statements, it can be assured by either the company’s existing statutory auditor (as long as they have a SASP licence) or a different SASP. There is likely to be a shortage of SASPs, so large companies are advised make their arrangements early and not assume their existing statutory auditor will have the resources to undertake the sustainability work.

For the avoidance of doubt, a top 10 firm could be the statutory auditor for a large company while a small or medium practice could be the SASP for that same company, or vice versa.

For those requiring assurance assignments for the first time in 2026, the standard that will be used is an EU-adopted ISSA 5000. ACCA has published a guide to using it.

Preparing ESRS information will be by far the most expensive element to implement of the Corporate Sustainability Reporting Directive. The assurance over the ESRS disclosures, by contrast, will be a relatively inexpensive exercise because it requires ‘limited’ rather than ‘reasonable’ assurance.

There has been considerable pushback of late against the directive by EU parliamentarians, and by France in particular. There is concern that the burden is too heavy and that it will put EU companies at a commercial disadvantage.

What is clear is that the sustainability assurance fee is likely to be in excess of 30% of the main statutory audit fee while the cost of implementing ESRS will be many multiples of the assurance fee. But at this stage it is unlikely that any amendments to the directive could be achieved in the short term by the EU.

SASPs

Currently, a SASP licence is available only to statutory auditors as a bolt-on qualification. To become a SASP, an auditor must complete 60 hours of sustainability CPD to include coverage of the four pillars in the directive. ACCA and CAI have designed their own sustainability diploma courses, both of which are open to non-members, to meet the CPD requirements. The 60 hours of CPD can be built up through both structured and unstructured learning, and can include non-verifiable as well as verifiable learning as well as some hours achieved through work experience.

In an unusual quirk in the legislation’s wording, an auditor applies for a SASP licence to the professional body that regulates their firm for audit rather than the professional body the auditor qualified with. To make this process as seamless as possible, both ACCA and CAI have agreed an identical application form.

If an accountant is an approved statutory auditor before 1 January 2026, they can achieve SASP status simply by undertaking the 60 hours of sustainable CPD described above. An application under the 60 hours of CPD route may also be made in 2026 or 2027 as and when the auditor requires a SASP licence.

To gain a SASP licence, accountants who are not statutory auditors before 2026 will have to show they have professional exam coverage of the CSRD topics and eight months’ experience of sustainability assurance. Accountants who qualify prior to ESRS being on their syllabus but do not achieve statutory audit status before 2026 will need to undertake a diploma or university-level course on sustainability reporting and assurance as well as gain the eight months’ experience.

I-SASPs

An independent (non-auditor) SASP or I-SASP is a member state option in the CSRD. An I-SASP could be an environmental engineer but is far more likely to be an accountant who is not an auditor but would like to offer sustainability assurance services.

So far three EU countries have decided to permit I-SASPs, 17 have not said what they are doing, and seven are not currently allowing for I-SASPs. Ireland does not currently permit I-SASPs, but the Irish government is consulting on the matter and may allow for them in the future.

I-SASPs will require the full rigour of oversight and regulation currently applied to auditors, which will probably be too expensive an option in a small country where only a limited number of people are likely to be interested in qualifying as an I-SASP. However, it is expected that almost all the larger EU countries will allow for the registration of I-SASPs.

SMEs

Many SMEs (small and medium-sized enterprises) are already reporting ESG (environmental, social and reporting) data to their major customers as a condition of supply. This is no surprise as large companies will have to report on their supply chain as part of their ESRS compliance.

The European Financial Reporting Advisory Group (EFRAG) is working on a super slimmed down version of ESRS for SMEs. The standard-setter will present a final version of this voluntary SME (VSME) standard to the EU Commission for approval in November.

VSME is expected to be a tiny fraction of the size of the main ESRS standard, with something like 20 disclosures compared with a possible 1,100 under full ESRS. The penultimate draft of VSME looked like it would be relatively easy and inexpensive for an SME to comply with, and the EU has said it plans to forbid large companies from asking for more ESG information from a supplier than would be required under VSME.