Sustainability reporting has been a narrative exercise for most organisations. Assurance changes that, because a practitioner cannot assure a narrative. They assure numbers, and numbers need provenance.
The gap between the two is where most of the work sits, and it is systems work rather than reporting work.
What an assurance provider actually asks
The questions are unglamorous and consistent.
Where did this figure come from? Not which spreadsheet, which source system or meter or invoice. A number typed into a cell by someone who no longer works for you is not evidence.
What method was used, and is it documented? Emissions factors, conversion methodologies, estimation approaches. Which version of which factor set, applied when, and why.
Who checked it? Evidence of review. A number prepared by one person and reported without any check is treated as unreliable, exactly as it would be in a financial context.
Is the boundary consistent? Which entities are included, and does that match the consolidation boundary in the financial statements. Differences may be legitimate but they must be explained.
Has the method changed since last year? If so, are comparatives restated, and is the change disclosed.
How complete is it? Coverage gaps, sites excluded, periods estimated. Completeness is often the weakest area, and it is the one where an assurance provider will push hardest.
Where organisations typically fall short
Spreadsheets without controls. Collection files emailed between sites, no version control, formulas overwritten, no record of who changed what. This is the most common single problem and it is fatal to reasonable assurance.
Undocumented estimates. Estimation is legitimate and often unavoidable. Estimation without a written, consistently applied method is not.
Scope 3. Almost always the weakest data. It relies on third parties, on spend-based proxies, and on assumptions that are rarely written down. Start here, because it takes longest.
Boundary drift. Acquisitions, disposals and restructurings that are reflected in the financial consolidation but not in the sustainability boundary.
No audit trail. The reported figure cannot be traced back through the workings to the source. If a practitioner cannot follow the number backwards, they cannot assure it.
Ownership. No single person accountable for the data. Sustainability data frequently sits between operations, facilities, procurement and finance, with everyone contributing and nobody owning.
What to do, in order
Assign an owner. One person accountable for the integrity of the data, with the authority to require it from other functions. Without this, nothing else holds.
Map the sources. For each metric, document where the raw data comes from, who provides it, how often, and in what form. This exercise alone usually surfaces several surprises.
Write down the methods. Emissions factors used, versions, conversion approaches, estimation methodologies, and the rationale. Treat it as an accounting policy manual, because that is functionally what it is.
Put a control over the process. Preparation and review separated, evidence of review retained, and a sign-off before the figure goes anywhere.
Get the boundary agreed with finance. Same entities, same period, differences documented.
Do a dry run. Pick your most difficult metric and try to evidence it end to end as though a practitioner had asked. You will find the gaps faster this way than by planning.
Why to start before you are required to
Building data infrastructure under a reporting deadline is expensive and produces something fragile. Building it in a period when nothing depends on it produces something that works.
There is also a commercial argument that has nothing to do with regulation. Customers, lenders and prospective buyers increasingly ask for this information. Being able to answer credibly, with numbers you can stand behind, is a differentiator now and will be a hygiene factor shortly.
The organisations that struggle when assurance becomes mandatory will not be the ones with poor performance. They will be the ones with good performance they cannot evidence.