ISSA 5000 vs ISAE 3000: Which Assurance Standard Should Verification Bodies Choose for CSRD?
If you run a verification body positioning for CSRD sustainability assurance work, you have heard both names repeatedly:
- ISAE 3000
- ISSA 5000
And the question everyone in the sector is asking is simple: which one should we be working with?
The answer is not as straightforward as it seems because the two standards are not interchangeable, and the transition timeline matters enormously for how you structure your services right now.
In this article, we explain clearly:
- what each standard covers and how they differ in practice
- what the transition means for ISO 17029 accredited bodies specifically
- and what verification bodies should prioritise before December 2026
Related reading: ISO 14019:2026 – New Requirements for Verification Bodies in Climate Transition and Sustainability Assurance
Why this question matters right now
The CSRD requires that sustainability reports be externally assured.
For Wave 1 companies, those reporting on FY 2024 data, the assurance obligation is already active.
The sustainability assurance market now includes two types of providers:
- Audit firms using IAASB standards, primarily ISAE 3000
- Verification and validation bodies (VVBs) accredited under ISO/IEC 17029 and ISO 14065
Both can provide assurance under CSRD, but under different frameworks, with different competence requirements and ethics obligations.
Understanding the distinction is not merely academic. It will shape how you position your services, which clients you can serve, and what your accreditation scope needs to cover.
What is ISAE 3000?
Definition : ISAE 3000 ISAE 3000 (Revised) stands for International Standard on Assurance Engagements 3000 — Assurance Engagements Other Than Audits or Reviews of Historical Financial Information. Published by the IAASB (International Auditing and Assurance Standards Board), it is the standard audit firms use to provide assurance on non-financial information, including sustainability reports. It covers both limited and reasonable assurance engagements.
ISAE 3000 has been the de facto reference for sustainability assurance for over a decade, widely used in the context of GRI reporting, integrated reports, and, more recently, early CSRD engagements.
It is a general assurance standard, adapted to sustainability by practitioners rather than purpose-built for it.
Who uses ISAE 3000?
Primarily statutory auditors and audit firms operating under the IAASB framework, subject to the ethical requirements of the IESBA Code of Ethics for Professional Accountants.
What is ISSA 5000?
Definition : ISSA 5000 ISSA 5000 stands for International Standard on Sustainability Assurance 5000 — General Requirements for Sustainability Assurance Engagements. Published by the IAASB in late 2024, it is the first standard designed specifically and exclusively for sustainability assurance. It becomes effective for engagements beginning on or after 15 December 2026. Unlike ISAE 3000, it is explicitly open to both audit firms and other assurance providers, including accredited verification bodies.
ISSA 5000 was designed because the complexity of sustainability information: multi-dimensional, forward-looking, quantitative and qualitative, requires a dedicated framework, not a general one adapted by analogy.
Key characteristics:
- Covers both limited and reasonable assurance
- Designed to work with any sustainability framework (ESRS, GRI, ISSB, etc.)
- Explicitly open to non-audit assurance providers, including accredited VVBs
- Incorporates sustainability-specific concepts: double materiality, supply chain data, forward-looking assumptions
- Aligned with IESBA ethics and independence standards as the global baseline
According to the IAASB, over 600 organisations and individuals responded to the public consultation on ISSA 5000, the highest engagement level ever recorded for an IAASB standard, reflecting the scale of market interest.
Head-to-head comparison
| ISAE 3000 | ISSA 5000 | |
| Published by | IAASB | IAASB |
| Effective | Already in force | 15 December 2026 |
| Purpose | General non-financial assurance | Sustainability assurance only |
| Double materiality | Partially addressed | Explicitly required |
| Value chain / supply chain data | Not specifically addressed | Explicit requirements |
| Open to accredited VVBs | Yes, with conditions | Yes, explicitly |
| Ethics baseline | IESBA Code | IESBA Code (mandatory) |
| Replaces ISAE 3000 for sustainability? | No, will coexist | Intended as the new standard for sustainability engagements |
What this means for ISO 17029 accredited bodies
This is the area that generates the most confusion in the market. Let us be direct.
Definition : ISO/IEC 17029 ISO/IEC 17029 is the international standard that governs validation and verification bodies (VVBs). It establishes requirements for competence, consistent operation, and impartiality. ISO 17029 is a conformity assessment framework : it defines how a VVB operates and how it can be accredited. It is not an assurance standard in itself: it does not specify the rules for conducting a CSRD sustainability assurance engagement.
When a VVB performs sustainability assurance under CSRD, it needs two layers simultaneously:
- An assurance standard : currently ISAE 3000, and ISSA 5000 from December 2026
- A conformity assessment framework : ISO/IEC 17029, paired with ISO 14065 for GHG-related work
These two layers are complementary, not competing. The confusion arises when VVBs assume that ISO 17029 accreditation alone is sufficient to perform CSRD assurance. It is not.
The ethics dimension is the critical new element.
The IAF (International Accreditation Forum) and the IESBA formalised a strategic partnership to establish IESBA ethics and independence standards as the global baseline for all sustainability assurance providers, including accredited VVBs operating under ISSA 5000.
This means: from December 2026, VVBs performing CSRD assurance engagements under ISSA 5000 will need to demonstrate compliance with IESBA ethics requirements, not only ISO 17029 impartiality requirements.
This is a substantive gap for most VVBs currently operating under ISO 17029 alone.
What should verification bodies do right now?
Step 1 : Continue with ISAE 3000 for current engagements
If you are already conducting or preparing sustainability assurance engagements for Wave 1 companies reporting on FY 2025 data, ISAE 3000 remains the applicable standard.
Do not wait for ISSA 5000. Your clients need assurance now.
Step 2 : Conduct a formal ISSA 5000 gap analysis
ISSA 5000 introduces requirements that go beyond ISAE 3000 in several areas:
- Enhanced documentation of the practitioner’s understanding of the sustainability matter
- Specific procedures for double materiality assessment review
- More prescriptive requirements around value chain data
- Explicit procedures for evaluating forward-looking assumptions and targets
If your body is accredited under ISO 17029 for GHG verification, some of these competencies will already exist in your system. But a formal gap analysis against ISSA 5000 requirements is still necessary, do not assume coverage.
Step 3 : Review your ethics and independence framework against IESBA
This is the area most ISO 17029 bodies underestimate.
Conduct an internal review of your current ethics and independence policies against the IESBA Code of Ethics, specifically the requirements on:
- Independence (conceptual framework approach, threats and safeguards)
- Conflicts of interest in sustainability engagements
- Rotation requirements for key engagement personnel
Document the gaps and define a remediation plan before mid-2026.
Step 4 : Engage your accreditation body early
Whether you are accredited with SCC, COFRAC, UKAS, or another national accreditation body, engage them early on how ISSA 5000 will be incorporated into your accreditation scope.
National accreditation bodies will receive guidance from the IAF on how to assess VVB compliance with ISSA 5000, but timelines for these updates vary. Early dialogue will put you ahead of the transition.
Related reading: How 2025 ESG Reforms Will Transform SMEs and Assurance Bodies in 2026
In summary
ISAE 3000 and ISSA 5000 are not rivals. They are sequential standards for a market in transition.
For verification bodies, the strategic question is not which one, it is how to manage the transition without interrupting your service delivery or leaving ethics and independence gaps in your system.
The bodies that act now, on gap analysis, IESBA alignment, and accreditation body engagement, will be positioned to serve the market confidently from December 2026 onwards.
FAQ : ISSA 5000 and Verification Bodies
Does ISSA 5000 replace ISAE 3000 entirely? Not immediately. ISAE 3000 will continue to be used, particularly for non-sustainability assurance engagements. However, for sustainability assurance specifically, ISSA 5000 is designed to become the primary standard from December 2026. The two will coexist during the transition period.
Can an ISO 17029 accredited body perform CSRD assurance without being an audit firm? Yes. CSRD member states have the option to recognise accredited conformity assessment bodies (CABs) as eligible assurance providers alongside statutory auditors. ISO 17029 accreditation is the conformity assessment basis for this recognition. However, VVBs must also comply with the applicable assurance standard (ISAE 3000 today, ISSA 5000 from December 2026) and the IESBA ethics requirements.
What is the difference between limited assurance and reasonable assurance under ISSA 5000? Limited assurance results in a negative-form conclusion (“nothing has come to our attention that causes us to believe…”) and involves less extensive procedures. Reasonable assurance results in a positive-form conclusion (“in our opinion…”) and requires more rigorous evidence gathering. Under the Omnibus I package, only limited assurance is currently required for CSRD; reasonable assurance has been deferred to at least 2028.
Do we need to update our ISO 17029 management system specifically for ISSA 5000? Yes, in several areas. You will likely need to update your competence framework, ethics and independence procedures, methodology documentation, and engagement quality review process to reflect ISSA 5000 requirements and IESBA compliance. A structured gap analysis is the right starting point.
Need support to prepare your verification body for ISSA 5000?
Many ISO 17029 accredited bodies are facing the same challenge:
- they are already performing GHG or sustainability verification
- ISSA 5000 introduces new requirements they have not yet mapped
- and the IESBA ethics dimension is largely uncharted territory for conformity assessment practitioners
At Eco Fluent Solutions, we support verification bodies to:
- conduct structured gap analyses against ISSA 5000 and IESBA requirements
- strengthen internal systems, ethics frameworks, and impartiality documentation
- prepare for accreditation body assessments under evolving CSRD assurance requirements
Book a consultation to assess your readiness.
Eco Fluent Solutions is a specialist consultancy in ISO management systems and sustainability governance assurance. We support verification bodies in building accreditation-ready systems without unnecessary complexity.
