ISSA 5000: An AI Can Draft the Report, Not the Evidence

A sustainability report that used to take a team four months can now be drafted in an afternoon. The draft may look finished even when a figure cannot be traced to its source.

Eight months later an assurance practitioner opens the same report and asks a question that has nothing to do with how it reads. Where did this number come from, and what happened to it on the way here.

A global standard now says what has to exist before you can answer that. It applies to reporting periods beginning on or after 15 December 2026.

ISSA 5000 starts on 15 December 2026

The standard is ISSA 5000, General Requirements for Sustainability Assurance Engagements, issued by the International Auditing and Assurance Standards Board on 12 November 2024.

The letters are worth getting right, because a lot of people search for “ISAE 5000” and that designation does not exist. ISAE 3000 (Revised) is the older, general assurance standard that sustainability engagements have been performed under until now, and ISAE 3410 is the one for greenhouse gas statements. From the ISSA 5000 effective date, ISAE 3000 (Revised) stops applying to sustainability assurance and ISAE 3410 is withdrawn (IAASB webinar, foundational principles).

ISSA 5000 is effective for sustainability assurance engagements on information reported for periods beginning on or after 15 December 2026. It also applies to information reported as at a specific date on or after that day. Early application is permitted (IAASB).

It applies to sustainability information prepared under any suitable reporting framework. That includes ESRS, SSBJ and IFRS S1 and S2 reports. It covers both limited and reasonable assurance. A practitioner can use it when their firm has a system of quality management, even if the firm is not an audit firm (IAASB webinar, foundational principles).

The practitioner traces each figure to its source

Before designing any procedure, the practitioner has to understand five components of the entity’s internal control as they relate to the preparation of the sustainability information: the control environment, the entity’s risk assessment process, the entity’s process for monitoring the system of internal control, the information system and communication, and control activities. In a limited assurance engagement that understanding comes from inquiry. In a reasonable assurance engagement it is inquiry plus other procedures, and the practitioner also evaluates whether those processes are appropriate (IAASB webinar, planning and risk assessment).

For a plant reading, the practitioner follows the value from the source file into the published report. They inspect the correction log for any change. For an estimate, they inspect the method and its data source. They then decide whether the system supports the reported information (same source).

At both assurance levels, the practitioner reconciles the sustainability information to its underlying records. Under limited assurance, they also ask about material adjustments. Under reasonable assurance, they obtain evidence for those adjustments and test them (same source).

Record the AI drafting step

An AI draft fails assurance when a sentence loses its link to the source record. A model may combine three plant readings into a group total without recording the calculation. The report then carries a number that the practitioner cannot reproduce.

The drafting step therefore needs its own records inside the information system.

Every number in the report should resolve to the record it came from. A link to the workbook is not enough. The practitioner needs the meter reading, invoice or other source record.

For the three-plant total, the drafting record should identify the three input files. The same record should carry the model version, template, date and operator.

Any change between a source record and the published number should be recorded with its reason. The practitioner will ask about material adjustments.

An estimate file should state the method and its data source. It should record the assumptions and explain any change from last year. Limited assurance evaluates the criteria and methods. Reasonable assurance tests the process or develops an independent estimate (same source).

A human reviewer should sign and date each section. The record should name the source used for the check. A review without that record cannot support the engagement.

Follow one electricity figure

Take the purchased-electricity total for three plants. The source layer holds each utility invoice in its original form. A calculation table converts the units and adds the plant values. Each conversion keeps the formula and the person who approved it.

The AI drafting tool should receive the approved total with a figure ID. It can write the sentence around that number, but the ID stays attached. The reviewer opens the ID and follows it back through the calculation table to the three invoices. If the tool rounds the total, that rounding is recorded as an adjustment.

External data needs the same treatment. An emission factor should carry its issuer, publication date and version. If the issuer later replaces the factor, the report still needs the version used for that reporting period. A link to the latest webpage cannot prove which value was used months earlier.

This trail gives the practitioner a record to test. Under limited assurance, the practitioner reconciles the published figure and asks about material adjustments. Under reasonable assurance, they obtain evidence for those adjustments and test whether the treatment was appropriate.

The existing rules already cover generated text

ISSA 5000 is neutral about frameworks and tools. It sets requirements for the practitioner and for the entity’s reporting process. The practitioner tests that process and its evidence.

The existing reconciliation requirement already covers a report whose system cannot show where a number came from.

The IAASB’s own materials list what makes professional scepticism harder. Among the impediments to professional scepticism it lists for engagement teams are difficulties in access to evidence and overreliance on IT, and among the triggers for heightened scepticism are complexity, rapid change, and immaturity of an entity’s systems and controls (IAASB webinar, foundational principles). A first-year filer running a new AI drafting pipeline can present all of those at once. The engagement still happens. The amount of evidence you are asked for goes up.

Japan’s first SSBJ assurance falls inside ISSA 5000

For European filers, sustainability statements have required limited assurance since the CSRD’s first wave, and the difference between limited and reasonable assurance is worth understanding before the standard underneath changes (CSRD assurance: limited vs reasonable).

For Japanese filers, mandatory SSBJ disclosure begins with fiscal years ending March 2027 for the largest Prime-listed tier, and mandatory assurance follows one year later, scoped in its first two years to governance, risk management and Scope 1 and 2 (why FY2028 is really FY2027). A fiscal year beginning April 2027 starts after 15 December 2026, so the first Japanese assurance engagements land inside ISSA 5000’s effective window.

Trace one figure now

Take one number in last year’s report and trace it out loud, from the published sentence back to the meter reading or the invoice. Write down every hand it passed through. That walk is a small version of the engagement. It takes an afternoon, and it shows you where the record stops.

Set the tool to save that trail automatically. The assurance practitioner will ask for it.

---

The free CSRD readiness check takes about three minutes and scores the dimensions an assurance provider will test: socious.io/csrd-check.

Socious Report takes one dataset into AI-drafted CSRD, SSBJ and ISSB reports, then adds an independent Socious Verify credential.