Limited vs Reasonable Assurance: Third-Party Verification

CDP (formerly the Carbon Disclosure Project) requires companies to verify their reported environmental data to receive an A score. The Science Based Targets initiative (SBTi) will require larger companies to obtain independent third-party assurance of the baseline emissions data their targets are set against, under its revised Corporate Net-Zero Standard V2.0. Rules in the EU, California and Japan also require assurance or are phasing it in for companies in scope.

This kind of independent check is often called third-party verification, and the confidence it gives is described as limited or reasonable assurance. Limited assurance is the most common starting point across major frameworks. Reasonable assurance is the higher level and involves more extensive work. Several 2026 developments make the distinction increasingly important, from changes to EU rules to a revised SBTi standard and a new global assurance standard. 

This blog explains how the two levels differ, which frameworks require each, and how an emissions inventory can be prepared for assurance.

What has changed for assurance in 2026

• EU Omnibus. Directive (EU) 2026/470, part of the Omnibus simplification package, removed the planned move to reasonable assurance, leaving limited assurance as the only level under the Corporate Sustainability Reporting Directive (CSRD).
• SBTi V2.0. The revised Corporate Net-Zero Standard, published in June 2026, requires independent third-party assurance of the target base year inventory (the emissions baseline that targets are set against) for Category A, its larger company category. Validation under V2.0 opens in February 2027, and the previous version, V1.3.1, remains available during a transition period.
• ISSA 5000. The International Standard on Sustainability Assurance (ISSA) 5000, issued by the International Auditing and Assurance Standards Board (IAASB), takes effect for periods beginning on or after 15 December 2026 and covers both levels.

Limited vs reasonable assurance: what differs

The two levels differ mainly in how much confidence the assurance provider gives and how much work supports it.

Choosing the level

Where a framework sets an assurance level, it starts at limited assurance. Reasonable assurance applies where a law requires it, as California's Climate Corporate Data Accountability Act (SB 253) does from 2030, or where a stakeholder asks for it. The IAASB notes that some investors seek reasonable assurance because they are used to audited financial statements. Moving up is not simply a bigger sample. Reasonable assurance takes a closer look at the controls behind the figures, so the review and approval processes around the data matter more.

Verification, validation and assurance: what the terms mean

• Verification. Under ISO 14064-3, the international greenhouse gas verification standard, the examination of historical data, such as an annual Scope 1 and 2 inventory, to determine whether it is materially correct and meets the reporting criteria. When an independent external body carries it out, it is third-party verification.
• Validation. Under ISO 14064-3, the evaluation of the assumptions and methods behind forward-looking statements, such as projected emissions reductions from a project.
• Assurance. The level of confidence given about the reported information, either limited or reasonable, expressed as a conclusion or opinion.

In practice the terms overlap: a third-party verification engagement ends in an opinion or conclusion at one of the two assurance levels.

Which level of assurance each framework requires

Why mid-market companies are coming into scope

The narrowed CSRD scope covers only companies exceeding both 1,000 employees and EUR 450 million in net turnover, so most mid-market companies sit outside it. SBTi V2.0 can still bring some of these companies into Category A. Category A companies must obtain at least limited assurance of their target base year inventory, covering Scope 1, 2 and 3. A company is in Category A if it meets either of two tests:

• Any country: net turnover of EUR 450 million or more, or 1,000 or more full-time equivalent employees (FTEs).
• High-income countries: Scope 1 and 2 emissions of 10,000 tCO₂e or more, or two of the following three: a balance sheet of EUR 25 million or more, net turnover of EUR 50 million or more, and 250 or more FTEs.

For example, a manufacturer incorporated in the UK, a high-income country, with 260 FTEs and EUR 60 million in net turnover meets two of the three size tests (250 or more FTEs, and EUR 50 million or more in net turnover). It is therefore Category A, even though it falls well below the CSRD thresholds. The tests use consolidated group figures averaged over the two most recent financial statements. A company's country is where its ultimate parent is incorporated. The SBTi V2.0 target-setting guide covers the wider requirements, and the Corporate Net-Zero Standard sets out the category definitions.

Assurance standards and who can provide assurance

ISSA 5000 is emerging as the global baseline standard, with jurisdictions adopting it one by one. ISO 14064-3 sets requirements for verifying and validating greenhouse gas statements, and applies to organisation, project and product statements. AccountAbility's AA1000AS v3 and the American Institute of Certified Public Accountants (AICPA) attestation standards are also in use.

The standard used has to be one the receiving framework or organisation accepts. CDP accepts ISSA 5000 and ISO 14064-3 but does not accept lighter-touch checks such as agreed-upon procedures, pre-assurance or internal verification. CARB proposes accepting ISSA 5000 for engagements starting on or after 15 December 2026, alongside ISO 14064-3 (with additional accreditation), AA1000AS v3 and AICPA standards.

Statutory auditors can provide assurance, and under the CSRD Member States may also allow independent assurance services providers, which are organisations accredited to assess compliance with standards. In Japan, assurance providers must be registered. In the UK, the Financial Reporting Council (FRC) is developing a voluntary register of assurance providers, and a listing will not be an endorsement of the provider.

How to prepare for third-party verification of emissions data

Assurance providers test an emissions inventory against a recognised method. Calculations built on audit-ready methodology, aligned with the GHG Protocol and ISO 14064-1, give the provider a clear basis for testing. A typical engagement moves through five stages, and preparation for each can start before the provider arrives.

1. Agree scope, level and criteria. The assurance provider confirms the boundary, the assurance level and the reporting criteria. Preparation starts with confirming which framework applies and which standards it accepts, and documenting the organisational and operational boundary.
2. Assess risks. The provider reviews the inventory, data sources and controls to find where material misstatement is most likely. Documented controls, with review and approval of key figures, an emission factor register and a log of estimates and exclusions, give the provider clear evidence to work from.
3. Test evidence. The provider tests figures against source records and checks calculations. This is easier where key figures trace back to source records, such as invoices, meter readings or supplier data. Scope 3 data also needs to be classified by source and method, with estimates and limitations documented.
4. Review findings. The provider shares any findings with the company for review. Preparation here means naming an owner for the provider's queries and completing an internal readiness check before the engagement begins, testing a sample of figures against source records.
5. Issue the statement. The provider issues the assurance statement at the agreed level. Evidence of management review and approval of the inventory should be on file, and a plan should be in place for where the statement will be filed or shared, such as with CDP, SBTi or customers.

How Zevero can help

Zevero helps companies put these requirements into practice by building an emissions inventory that an independent assurance provider can review. Corporate Carbon Footprint from Zevero covers Scope 1, 2 and 3 using a methodology aligned with the GHG Protocol and ISO 14064-1, giving assurance providers a documented basis to test. If you already have an inventory, our team can review it against ISO 14064-1, agree the gaps with you, help close them and prepare the evidence pack your verifier will sample. Verification itself is always carried out by an independent third party. Zevero also supports SBTi-aligned target setting, which builds on the base year inventory that Category A companies must have assured.

Get in touch to see how Zevero can support an audit-ready, full Scope 1, 2 and 3 inventory.