Assuring Sustainability Disclosure in South Africa

Sustainability assurance is the independent verification of the environmental and social information a company reports — and a new standard, ISSA 5000, will hold it to the rigour of a financial audit.

For a decade, the sustainability section of an integrated report was the part that escaped the auditor. The numbers in the financial statements were tested to a hard standard; the carbon figures, the social metrics and the governance narrative beside them were not. That gap is closing. The work for every audit committee now is to make sure the sustainability data can survive the same scrutiny as the trial balance.

The climate-finance picture that frames this — the Climate Change Act, the Just Energy Transition Investment Plan and the disclosure expectations channelled through the Johannesburg Stock Exchange (JSE) — we set out in our analysis of South Africa's climate-finance reality. This piece is narrower: not what companies must disclose, but how that disclosure gets assured, and who signs the report.

What ISSA 5000 is, and why it matters

The International Auditing and Assurance Standards Board (IAASB) released the International Standard on Sustainability Assurance 5000, General Requirements for Sustainability Assurance Engagements, in November 2024. It is the first comprehensive, stand-alone standard for assuring sustainability information, and it replaces the patchwork of standards practitioners used before.

ISSA 5000 is framework-neutral. It can be used to assure information prepared under the ISSB standards — IFRS S1 (general sustainability-related financial disclosures) and IFRS S2 (climate-related disclosures) — the Global Reporting Initiative standards, the JSE Sustainability and Climate Disclosure Guidance, or an entity's own criteria. The standard does not dictate what a company reports; it disciplines how that report is verified.

It is also profession-agnostic. ISSA 5000 can be applied by both registered auditors and non-auditor practitioners, provided their firm meets the International Standard on Quality Management (ISQM) 1 and they are bound by the international ethics and independence code. That single design choice opens sustainability assurance to a wider market than the statutory audit — but, as set out below, not without limits.

Where South Africa stands: IRBA's adoption

South Africa has moved early. On 29 January 2026 the Board of the Independent Regulatory Board for Auditors (IRBA) approved ISSA 5000 for adoption, issue and prescription for use by auditors in South Africa, together with the conforming amendments to the other assurance standards. The adoption communique was issued on 23 February 2026.

The timing is the detail audit committees most often misread. ISSA 5000 is effective for assurance engagements on sustainability information reported for periods beginning on or after 15 December 2026 — which makes it apply from the December 2027 year-end onwards. Early adoption is both permitted and encouraged. The standard is law for auditors now, in the sense that it has been adopted; the date it bites depends on the reporting period.

The adoption also retires the standards that came before. The International Standard on Assurance Engagements (ISAE) 3000 (Revised) will no longer apply to sustainability engagements once ISSA 5000 is effective, and ISAE 3410, the greenhouse-gas standard, is withdrawn on the effective date. In the interim, registered auditors apply ISAE 3000 (Revised) supplemented by South African Assurance Engagements Practice Statement (SAAEPS) 1.

Limited versus reasonable assurance

The single most important distinction in sustainability assurance is the level of assurance obtained, because it determines both the cost of the engagement and the weight a reader can place on the conclusion. ISSA 5000 supports two levels, and an audit committee should know which one it is buying.

• Limited assurance reduces engagement risk to a level that is acceptable but higher than for reasonable assurance. The practitioner expresses a conclusion in the negative — that nothing has come to their attention to suggest the information is materially misstated. The procedures are lighter, and so is the cost.
• Reasonable assurance reduces engagement risk to an acceptably low level and supports a positive opinion on the information itself — the same form of conclusion an auditor gives on financial statements. It demands far more evidence, and far more time.
• Most sustainability assurance in the South African market today is limited assurance, typically over selected metrics or narratives in an integrated or sustainability report. Reasonable assurance is the higher bar, and the direction of travel as the data matures.

Who may sign the report depends on this distinction. Under the Auditing Profession Act, only a registered auditor may provide reasonable assurance over sustainability information. Limited assurance is open to both registered auditors and other practitioners. An audit committee weighing a non-audit provider for a sustainability engagement should understand that the choice quietly caps the level of assurance available to limited.

The level of assurance is not a technical footnote. It is the difference between a practitioner saying nothing is obviously wrong and a practitioner putting their name to the number.

The audit committee's role under King

Sustainability assurance is not a stand-alone purchase. It sits inside the combined-assurance model that South African governance codes have asked boards to operate for years. King IV embedded combined assurance as a principle — that management, internal audit, external audit and other assurance providers should be coordinated so that significant risks are covered without wasteful duplication or dangerous gaps.

That principle now carries directly into sustainability. The JSE Listings Requirements mandate the application of the King Code by listed issuers, and the code makes the governing body responsible for the integrity of external reports — including the non-financial information beside the financials. The audit committee, acting for the board, has to decide the nature, objective and scope of the assurance obtained over each external report, and to confirm that the combined-assurance model genuinely covers the sustainability risks the company faces.

In practice that means three questions for the committee. Which sustainability metrics are material enough to assure? What level of assurance — limited or reasonable — does each warrant? And does the assurance provider have the competence and the independence to give it? These are governance judgements the committee owns; they cannot be delegated to the preparer or the assurance firm.

Assurance readiness: the work before the engagement

Most South African sustainability data is not yet ready to be assured, and the gap is rarely the headline number. It is the absence of the controls, definitions and evidence trail that an assurance practitioner needs to test. Financial data has decades of internal control behind it; sustainability data often has a spreadsheet and a well-meaning manager.

A readiness assessment closes that gap before the formal engagement begins. It is a non-assurance engagement — it does not produce an assurance conclusion — that tests whether the preconditions for assurance are present: suitable reporting criteria, a defensible measurement method, and sufficient evidence. The IAASB's implementation guide treats it as a legitimate, valuable step that helps management understand what an assurance engagement will require.

There is an independence trap in the sequence, and the committee should see it. A practitioner who designs the controls or develops the criteria, and then assures the same information, creates a self-review threat to their independence. Advising management is permissible only where management makes the judgements and decisions itself. An audit committee that lets one firm both build and bless the sustainability data may find the assurance conclusion compromised before it is signed.

The governance scaffolding for this readiness work already exists. The Building Trust in Sustainability Reporting guidance, published by the International Federation of Accountants with the We Mean Business Coalition in December 2024, sets out the governance and controls a company needs over sustainability information — the same internal-control disciplines that make financial data auditable, applied to the carbon ledger and the social metrics.

Value-chain reporting raises the bar again. Where a company reports Scope 3 emissions or labour practices across its suppliers, the assurance practitioner has to gather and verify data from parties outside the entity's own walls — suppliers and distributors at varying levels of maturity. The audit committee that has mapped its material value-chain disclosures, and tested the data behind them, will face a shorter and cheaper engagement than the one that has not.

Sustainable bonds make the stakes concrete. South Africa's green, social and sustainability-linked bond market is growing, and investors increasingly expect independent assurance that proceeds were allocated as promised and that the reported outcomes are real. Assurance here is the direct defence against a greenwashing claim — and the standard that governs it is now ISSA 5000.

What audit committees should do now

The effective date is the December 2027 year-end, but the readiness work runs ahead of it. Committees that treat 15 December 2026 as a distant date will meet the standard underprepared. Five moves matter in the current cycle.

1. Decide which sustainability metrics are material enough to assure, and set the target level — limited or reasonable — for each, rather than assuring everything to a token standard.
2. Commission a readiness assessment now, against the reporting criteria the company uses, to surface the control and evidence gaps before the formal engagement.
3. Map the combined-assurance model against the company's sustainability risks, so that management, internal audit and external assurance cover the field without gaps or duplication.
4. Test the assurance provider's independence — in particular, separate the firm that helps build the data from the firm that assures it, to avoid a self-review threat.
5. Extend the evidence trail into the value chain where Scope 3 or supplier-level disclosures are material, because that is where assurance is hardest and slowest.

ISSA 5000 does not change what a company believes about its sustainability performance. It changes whether anyone outside the company has to take that belief on trust. The audit committees that prepare the data now will buy credible assurance at a sensible price. Those that wait will assure weak data expensively, or not at all.