ISSA 5000 vs ISAE 3000: which assurance standard should verification bodies choose for CSRD?
If you lead a verification body positioned on CSRD sustainability assurance, you have heard these two acronyms on repeat:
- ISAE 3000
- ISSA 5000
The question the whole sector asks is simple: which one should you use?
The answer is not obvious: the two frameworks are not interchangeable, and the transition timeline already shapes your offerings.
In this article we clarify:
- what each standard covers and how they differ in practice
- what the transition means for ISO 17029-accredited bodies
- what verification bodies should prioritise before December 2026
Also read: ISO 14019:2026 — new requirements for verification bodies
Why this question is urgent
CSRD requires external assurance of sustainability reports.
For Wave 1 companies already in scope for FY 2024, the obligation is active.
Today’s sustainability assurance market brings together:
- audit firms, under IAASB frameworks, mainly ISAE 3000
- validation and verification bodies (VVBs), accredited under ISO/IEC 17029 and ISO 14065
Both can assure under CSRD, but with distinct frameworks, competence requirements and ethical obligations.
Understanding that distinction is not theoretical: it drives positioning, target clients and the accreditation scope you must cover.
What is ISAE 3000?
Definition — ISAE 3000: International Standard on Assurance Engagements 3000 — Assurance Engagements Other Than Audits or Reviews of Historical Financial Information. Published by the IAASB, it is the framework audit firms use to assure non-financial information, including sustainability reports. It covers limited and reasonable assurance.
ISAE 3000 has been the de facto reference for more than a decade (GRI, integrated reports, early CSRD engagements). It is a general-purpose standard, adapted to sustainability by practitioners rather than designed specifically for it.
Who uses ISAE 3000?
Primarily statutory auditors and audit firms under the IAASB frame, subject to the IESBA Code of Ethics.
What is ISSA 5000?
Definition — ISSA 5000: International Standard on Sustainability Assurance 5000 — General Requirements for Sustainability Assurance Engagements. Published by the IAASB in late 2024, it is the first standard designed exclusively for sustainability assurance. Applicable to engagements beginning on or after 15 December 2026. Unlike ISAE 3000, it is explicitly open to audit firms and other assurance providers, including accredited VVBs.
ISSA 5000 responds to the complexity of sustainability information — multidimensional, forward-looking, quantitative and qualitative — with a dedicated framework.
Key characteristics:
- Covers limited and reasonable assurance
- Compatible with any sustainability framework (ESRS, GRI, ISSB, etc.)
- Open to non-audit providers, including accredited VVBs
- Addresses double materiality, value chain and forward-looking assumptions
- Aligned on IESBA ethics and independence as a global baseline
Side-by-side comparison
| ISAE 3000 | ISSA 5000 | |
| Publisher | IAASB | IAASB |
| In force | Already applicable | 15 December 2026 |
| Focus | General non-financial assurance | Sustainability assurance only |
| Double materiality | Partially | Explicitly required |
| Value-chain data | Limited treatment | Explicit requirements |
| Open to accredited VVBs | Yes, under conditions | Yes, explicitly |
| Ethics baseline | IESBA Code | IESBA Code (mandatory) |
| Replaces ISAE 3000? | No — coexistence | New target framework for sustainability |
Implications for ISO 17029-accredited bodies
This is the most confusing point. Let’s be direct.
Definition — ISO/IEC 17029: the international framework for validation and verification bodies. It sets competence, consistent operation and impartiality. It is a conformity-assessment framework: it defines how a VVB operates and can be accredited. It is not a CSRD assurance standard by itself.
To assure under CSRD, a VVB needs two layers at once:
- An assurance standard: ISAE 3000 today, ISSA 5000 from December 2026
- A conformity-assessment framework: ISO/IEC 17029, with ISO 14065 for carbon
These layers are complementary. ISO 17029 accreditation alone is not enough to perform CSRD assurance.
The ethics dimension: the critical element
IAF and IESBA have formalised a partnership to make the IESBA Code the global ethics baseline for all sustainability assurance providers, including VVBs under ISSA 5000.
From December 2026, VVBs will need to demonstrate conformity with IESBA ethical requirements, not only ISO 17029 impartiality — a substantial gap for most bodies today.
What to do now
Step 1: continue ISAE 3000 on live engagements
For Wave 1 companies (FY 2025 data), ISAE 3000 remains applicable. Do not postpone engagements waiting for ISSA 5000.
Step 2: run an ISSA 5000 gap analysis
ISSA 5000 notably strengthens: documentation of understanding the sustainability subject matter, examination of double materiality, value-chain requirements and assessment of forward-looking assumptions.
Step 3: review your ethics and independence framework (IESBA)
Map gaps between current procedures and the IESBA Code before the application date.
Step 4: engage your accreditation body early
Scope extension and competence demonstration take time — anticipate surveillance audits.
In summary
ISAE 3000 remains the immediate operational framework; ISSA 5000 becomes the target standard for sustainability assurance from end-2026. ISO 17029-accredited VVBs must combine both layers (assurance + conformity assessment) and strengthen IESBA ethics conformity.
FAQ — ISSA 5000 and verification bodies
Does ISSA 5000 replace ISO 17029?
No. ISO 17029 frames how the body operates; ISSA 5000 frames the sustainability assurance engagement.
Can a VVB use ISSA 5000 without being an audit firm?
Yes — that is explicitly provided for, subject to competence, accreditation and ethics.
When should preparation start?
Now: gap analysis, team training, dialogue with the accreditation body.
Support for verification bodies: explore our ISO 17029 & ISO 14065 support or contact us.
