CSRD Pre-Assurance: Get Audit-Ready Before the Assurer

Your CSRD report is drafted. The double materiality assessment is signed off. The finance team has closed the reporting boundary. Your statutory assurance provider is booked to start in three months, and the audit committee wants to know whether the report will pass — before the assurer's first working paper request lands.

This is the moment a CSRD pre-assurance engagement exists for. Not another implementation programme. Not a fresh readiness assessment. A short, tightly scoped dry run that puts your drafted report through the same tests a limited assurance engagement will apply, done by someone who will never sign the opinion.

Companies that skip it discover the same findings the assurer would have found — in the middle of the assurance engagement, with two weeks to fix them, under a fee clock that ticks whether the report is defensible or not. Companies that run it well arrive at fieldwork with a clean file, a shortlist of pre-agreed judgements, and an assurer who spends the engagement testing controls rather than chasing missing documentation.

This guide sets out what a proper pre-assurance dry run covers, why the reviewer must be independent of the assurer, how long and how much it takes, and what the deliverable should look like when it lands.

What Limited Assurance Will Test

The CSRD requires limited assurance on the sustainability statement. That is the level that stays: the earlier plan to step up to reasonable assurance was dropped by the Omnibus directive, and the Commission is adopting harmonised limited assurance standards by 1 July 2027. Our assurance guide sets out the mechanics of the engagement itself.

For pre-assurance planning, the relevant question is what limited assurance tests, and what it does not. In practice an assurer performing a limited engagement will:

• Understand the process — how the double materiality assessment was run, how data was collected, who signed off what
• Perform inquiries and analytical procedures — comparing disclosures against internal information, prior year data, industry benchmarks
• Review evidence for a selection of material datapoints — sample rather than population
• Test consistency — between the sustainability statement, the rest of the management report and the financial statements
• Read the double materiality methodology and challenge whether it is defensible against ESRS 1

Limited assurance is a "nothing came to our attention" conclusion, not a "we tested and confirmed everything" one. That is why the pre-assurance dry run has to think like a limited assurance provider on their worst day — the datapoint that the assurer happens to sample, or the topic where the analytical review throws up an outlier. Pre-assurance is a coverage exercise, not a deep audit.

Pre-Assurance Is Not a Readiness Assessment

This is the distinction that keeps the two engagements from cannibalising each other, and it matters commercially.

A readiness assessment comes before the implementation programme. It answers: how far off the ESRS bar are we today, across every dimension, and what will the work cost? The output is a maturity report and a costed plan for the year ahead. It is the diagnostic that scopes the programme.

Pre-assurance comes after the drafting, and before the assurer. It answers: given what we have already produced, would it pass a limited assurance engagement, and where are the weak points? The output is a findings log against the actual draft — not a plan for work that has not yet started.

Engagement	When	Answers	Output
Readiness assessment	12–18 months before first report	How far are we, across every dimension?	Maturity scoring + costed plan
Pre-assurance dry run	2–3 months before assurance fieldwork	Will the drafted report pass limited assurance?	Findings log + fix list
Limited assurance engagement	Around report sign-off	Is anything materially misstated?	Assurance opinion

Buying a second readiness assessment when what you need is pre-assurance means paying for governance and scoping work you have already done. Buying pre-assurance when what you need is a readiness assessment means testing a report you have not yet produced. The two engagements have different scopes, different deliverables and different day counts, and they should be bought with different specifications.

Why Your Adviser Shouldn't Be Your Assurer

The rule cuts across every CSRD engagement: the firm reviewing your work should not be the firm signing the opinion. Our proposal comparison guide makes the same point about implementation partners — the "Independence Constraint" section explains why the same firm generally cannot both advise on the CSRD programme and assure the resulting statement. Pre-assurance is the same principle, one step later in the cycle.

The mechanics matter. If the firm doing your pre-assurance is also your assurer, two things happen. They should not rely on their own findings as evidence in the eventual engagement, because that would be self-review. And they have a commercial incentive to soft-pedal difficult findings so as not to make the assurance engagement harder to sell.

An independent pre-assurance adviser sits outside that loop. They can flag every finding — including the ones the assurer would happily wave through — because they never have to sign the opinion. Their engagement letter states plainly that they are excluded from providing your assurance for this reporting cycle. That is the point.

In Germany the constraint has a structural form. Only a Wirtschaftsprüfer may sign the statutory sustainability opinion once the CSRD-Umsetzungsgesetz is in force — the German drafts do not open the role to independent assurance service providers. But under the same draft your sustainability assurer need not be your Abschlussprüfer, so there is a real procurement choice on who signs. Our Germany implementation guide covers the WPO mechanics; the practical effect for pre-assurance is that the reviewer can be a non-WP consultant with assurance experience, an advisory firm that is not your assurer, or a WP working independently of your assurance provider — the Wirtschaftsprüfer requirement bites only on the signed opinion.

Elsewhere in the EU the rule is looser but the reasoning is the same. If your assurer is doing the dry run, you are not getting an independent second opinion — you are getting a scoping conversation billed as one.

What a Pre-Assurance Dry Run Covers

A serious pre-assurance engagement tests five things against the drafted report. If a proposal only names two or three, it is doing a partial review and it will miss the finding the assurer eventually raises.

1. Double materiality documentation

The double materiality assessment is the piece of work an assurer will read first, and it is where challenges land hardest. Pre-assurance checks whether the methodology is written up in enough detail that an outsider can reproduce the reasoning, whether the stakeholder engagement record exists and matches the disclosures, and whether the material IROs in the report are the ones the methodology actually returned. A common finding: a topic in the report that the methodology does not support, or a topic the methodology supported that never made it in.

2. Evidence per material datapoint

For every quantitative datapoint in the report, the assurer will want a source, a calculation method and a reviewer sign-off. Pre-assurance samples the material datapoints and re-walks the trail. Where does the number come from? Which system produced it? Who reviewed the extract? Was the methodology consistent with prior year? A typical finding is a datapoint whose extract cannot be reproduced from the source system because it was manually adjusted at some point in the pipeline — the data collection gap analysis will have flagged the risk months earlier, but the fix often wasn't landed before drafting.

3. Process controls

Segregation of duties over the sustainability data flow. Management review on narrative disclosures. Change control over the calculation models. Version control on the datapoint list. Pre-assurance walks these the way an internal audit function would — enough to say whether the controls exist, are documented, and have been operated during the period.

4. Estimates and their disclosures

ESRS requires that estimation uncertainty is disclosed for material estimated datapoints — Scope 3 categories are the obvious ones, but there are others across E4 and S2. Pre-assurance re-performs a sample of estimates, checks that the methodology is documented, and that the disclosure narrative is honest about the range of plausible outcomes. Findings here often shape the assurer's own approach, so it is worth catching them first.

5. XBRL-readiness hand-off

Digital tagging is inside the assurance perimeter. The pre-assurance review checks that the iXBRL tagging plan is aligned with the disclosed datapoints, that the taxonomy version is the one the assurer expects, and that the tagging hand-off will not force late changes to the narrative to accommodate the machine-readable format.

Scope and Fees Compared With a Full Programme

Pre-assurance is a fraction of a full implementation, which is what makes it attractive — and the shape of the engagement is what the fee follows. Ask for a breakdown by days and by seniority mix; a proposal that quotes a lump sum without either is one you cannot compare.

Typical shapes by company complexity, not by revenue band (the post-Omnibus scope test — more than 1,000 employees and more than 450 million EUR net turnover, both — knocks the "mid-market by revenue" framing out of the picture):

• Single-entity in-scope company — 10–20 consultant-days over 2–3 weeks, with a senior lead running the review
• Multi-entity group with centralised reporting — 20–40 consultant-days over 3–4 weeks, senior lead plus one manager
• Complex multinational with subsidiary-level data — 40+ days over 4–6 weeks, senior lead, two managers and an analyst pool

The proposal comparison guide walks through why the same brief returns implementation bids that vary by a factor of four; pre-assurance has less variance because the scope is narrower, but the same normalisation to days and seniority applies. Ask for a named lead reviewer before signing.

Two commercial questions to settle in the engagement letter:

• Assurance exclusion. State that the firm and its parent group are excluded from providing your assurance for the current reporting cycle. Without this, the pre-assurance findings are conflicted.
• Deliverable ownership. The findings log, the fix list and the assurer hand-off pack belong to you and can be shared with the assurance provider. This should not be controversial — a pre-assurance report that cannot be shown to the assurer defeats the purpose — but it needs to be written down.

What to Hand the Assurer After the Dry Run

The output of a good pre-assurance engagement is not a report you file in a drawer. It is a package the assurer works from on day one.

Four documents:

1. The findings log — every issue raised during the dry run, with a status (fixed, in progress, accepted as-is with rationale) and the evidence for the fix. An assurer who sees this document knows the report has been stress-tested, and their fieldwork can focus on testing the fixes rather than finding the issues from scratch.
2. The evidence pack index — one line per material datapoint, pointing at the source system extract, the calculation memo and the sign-off. Built during the dry run, handed over as-is.
3. The DMA memo — a written narrative of the double materiality method, the stakeholder engagement, and the mapping from IROs to disclosed topics. If the assurer asks how the material topics were selected, this is the answer.
4. The judgement log — the material accounting-style judgements made in the report (boundary calls, estimation approaches, scope 3 category inclusions) with the rationale for each. This is what shortens the "why did you do it this way" conversations during fieldwork.

Hand these over at the pre-assurance closing meeting, and give the assurer a copy the week before their planning meeting. The engagement will be shorter, less contested, and less likely to end in a qualified opinion.

Where to Find an Independent Pre-Assurance Reviewer

The pool is smaller than for implementation. The reviewer needs assurance or audit experience, current CSRD/ESRS knowledge, and — critically — no conflict with the assurer your audit committee has already appointed. That combination rules out the advisory arm of your current statutory auditor and, in most cases, of the firm that will sign the sustainability opinion.

The directory carries independent experts with assurance backgrounds who can run the dry run and then step aside. Filter by assurance experience, by the country your reporting entity sits in, and by the ESRS topics where you already know the evidence is thin. Then read the 25 questions to ask a CSRD consultant with an assurance lens — the ones on evidence trails, controls and estimation methodology are the ones that separate a real pre-assurance reviewer from a report editor.

Ten to forty senior consultant-days ahead of the assurer's fieldwork is the work that stops a qualified opinion turning up in your management report. That is the number the audit committee needs to hear.