SSA 5000: A Practitioner’s Guide to India’s New Sustainability Assurance Standard
Standard on Sustainability Assurance (SSA) 5000, General Requirements for Sustainability Assurance Engagements. Issued by the Sustainability Reporting Standards Board (SRSB) of ICAI.
AT A GLANCE
Issuer | SRSB, The Institute of Chartered Accountants of India |
Basis | Draws on the IAASB’s ISSA 5000; deleted or modified paragraphs are tabulated in Appendix 4 |
Effective date | Sustainability information reported for periods beginning on or after 1 April 2027 |
What it replaces? | SSAE 3000 and SAE 3410, which are withdrawn once SSA 5000 becomes effective |
Who it applies to? | Sustainability assurance engagements of all entities that are required to obtain assurance mandatorily under any law or otherwise |
Type of engagement | Attestation engagements only; both limited and reasonable assurance |
Out of scope | Forward-looking statements; sustainability information that sits inside the financial statements (audited under the SAs) |
Why this standard matters?
Until now, assurance on the BRSR and other sustainability disclosures in India has leaned on SSAE 3000 and SAE 3410 (greenhouse gas statements). SSA 5000 replaces both with a single overarching standard that covers every element of the engagement: acceptance, quality management, planning, risk assessment, evidence, misstatements, representations, other information and reporting.
Three features set the tone:
a. One standard for all sustainability information. It applies to all types of sustainability information regardless of how it is presented (para 8), and to entities of all sizes and complexity (para 14, scalability).
b. Audit-style rigour. The engagement is risk-based. The practitioner identifies and assesses risks of material misstatement, designs responsive procedures, accumulates misstatements and evaluates evidence in a way that will feel familiar to anyone who has worked with the Standards on Auditing. The Standard recognizes both reasonable and limited assurance.
c. Sustainability-specific building blocks. Suitability of criteria, the entity’s process to identify what to report, reporting boundary, value chain information, double materiality and sustainability competence are all built into the requirements.
The standard requires the practitioner to give a conclusion in the assurance report on the BRSR or other sustainability or non-financial information and its compliance with the requisite reporting requirements.
How an SSA 5000 engagement runs?
2.1. Acceptance and preconditions
The practitioner accepts or continues an engagement only when ethical requirements including independence can be met, the team collectively has the right competence, capabilities and time, and the basis of the engagement is agreed. Four points stand out in a sustainability setting:
Sustainability competence. The engagement leader must have sustainability competence sufficient to accept responsibility for the conclusion, in addition to assurance skills. The team, experts and any internal auditors providing direct assistance must collectively have it.
The entity’s process to identify what to report. Before accepting, the practitioner considers whether the entity has a process to identify the sustainability information to be reported, including how materiality and the reporting boundary are applied.
Appropriate matters and suitable criteria. The sustainability matters must be identifiable and capable of consistent measurement against defined criteria. The criteria are tested for relevance, completeness, reliability, neutrality and understandability, and for availability to intended users.
Rational purpose. For limited assurance the practitioner must expect to obtain a meaningful level of assurance, and the engagement as a whole must be useful and not misleading. Meaningful assurance is described as likely to enhance users’ confidence to a degree that is clearly more than inconsequential.
If the preconditions are not present and cannot be fixed, the practitioner does not accept the engagement as an assurance engagement and must not refer to SSA compliance in any report. If criteria turn out to be unsuitable after acceptance, the practitioner considers withdrawing, or otherwise gives a qualified or adverse conclusion or a disclaimer.
2.2 Engagement terms
The engagement letter must cover, among other things, the objective, the information in and out of scope, the reporting boundary, whether the engagement is limited, reasonable or combined (and which information falls under each), the applicable criteria, and management’s responsibilities including a system of internal control and unrestricted access. A downgrade from reasonable to limited assurance cannot be agreed without reasonable justification.
2.3 Planning and materiality
The practitioner develops an overall strategy and engagement plan, with the engagement leader and key team members involved.
For group sustainability information, the plan determines what information will be assured, the sources, resources, and whether to use component practitioners.
Materiality is considered for qualitative disclosures and determined for quantitative disclosures. Performance materiality is set for quantitative disclosures. Narrative disclosures therefore get a materiality lens too, which is a real shift from financial audit habits.
Double materiality. If the criteria require both financial and impact materiality, the practitioner takes both perspectives into account. Ordinarily the lower of the two levels is used for quantitative disclosures.
Materiality is revised when new information warrants it.
2.4 Risk assessment
This is where limited and reasonable assurance diverge most visibly. Risks are identified and assessed at the disclosure level for limited assurance and at the assertion level for the disclosures for reasonable assurance. Assertion level assessment takes a holistic view by questioning the occurrence, existence, completeness, accuracy, cut-off, presentation and consistency of the disclosures and allied matters. The practitioner:
holds an engagement team discussion on susceptibility to misstatement due to fraud or error, and on how the criteria apply to the entity;
understands the sustainability matters, the criteria, the entity’s reporting policies and any changes to them, the entity and its environment (including sustainability goals, targets and how management is measured against them), the legal and regulatory framework, and inquires about fraud, non-compliance and the internal audit function;
understands the system of internal control: control environment, risk assessment process, monitoring, information system and communication, and control activities, with the depth differing between L and R (limited and reasonable assurance, respectively);
treats management override of controls as a risk of material misstatement due to fraud, at the upper end of the risk spectrum, in reasonable assurance.
2.5 Responding to the assessed risks
Area | Limited assurance | Reasonable assurance |
Risk level | Disclosure level | Assertion level for disclosures |
Understanding of controls | Through inquiry; results of risk assessment and monitoring | Inquiry plus other procedures; evaluates the control environment, risk process and monitoring; identifies and evaluates design and implementation of key controls and general IT controls |
Further procedures | Responsive to disclosure-level risks | Responsive to assertion-level risks; must include substantive procedures for risks near the upper end of the spectrum and consider substantive procedures for material disclosures |
Analytical procedures | Develop an expectation; inquire of management about unexpected differences | Expectation must be precise enough to identify material misstatement; investigate differences with additional evidence |
Other points of note:
Tests of controls are required where the practitioner intends to rely on them. Controls must be tested for the relevant period, interim evidence must be rolled forward, and prior-period evidence can be reused only if still relevant, with controls tested at least once in every third engagement and some controls tested every time. For risks near the upper end of the spectrum, controls must be tested in the current period.
Group aggregation. The practitioner responds to risks arising from how information is aggregated, including whether all entities required by the criteria are included and whether aggregation judgements indicate management bias. A footnote points to SA 600 and the Guidance Note on Audit of Consolidated Financial Statements.
Fraud and non-compliance. Professional scepticism is maintained throughout. Where fraud or non-compliance is suspected, the practitioner obtains an understanding, discusses with management and those charged with governance, evaluates the implications, and considers reporting duties to authorities.
2.6 Misstatements, representations, subsequent events, other information
All misstatements other than clearly trivial ones are accumulated, communicated to management and evaluated individually and in aggregate, considering size, nature and circumstances. Misstatements include omitted information or information that obscures presentation.
The practitioner evaluates whether the sustainability information adequately references or describes the applicable criteria and their sources.
Subsequent events up to the report date are identified and evaluated (para 163).
Written representations are obtained on responsibility for preparation, completeness of information and access, uncorrected misstatements, assumptions in estimates, control deficiencies, fraud and non-compliance, and subsequent events. Failure to provide the core representations, or doubt about the integrity of those giving them, leads to a disclaimer or withdrawal.
Other information (for example the rest of the annual report) is read for material inconsistency with the sustainability information and the practitioner’s knowledge. If a misstatement is not corrected, the practitioner escalates to those charged with governance and considers the effect on the report or withdrawal.
2.7 Conclusion and report
The practitioner evaluates sufficiency and appropriateness of evidence, including contradictory evidence and indicators of management bias in estimates and assumptions.
An inability to obtain sufficient appropriate evidence is a scope limitation, leading to a qualified conclusion, disclaimer or withdrawal.
The engagement leader must be satisfied on ethics, evidence, personal involvement and completion of any engagement quality review before dating the report.
Report content includes: a title that identifies limited, reasonable or combined assurance; the conclusion placed first; a Basis for Opinion or Conclusion section; management’s responsibilities; inherent limitations where relevant; the practitioner’s responsibilities; signature, location and date. For limited assurance there must be a Summary of Work Performed describing the nature, timing and extent of procedures.
Conclusion forms: reasonable assurance is a positive opinion that the information is prepared or fairly presented in all material respects; limited assurance is a negative-form conclusion that nothing has come to attention to suggest otherwise.
For listed entities the engagement leader’s name must be disclosed unless a significant personal security threat is reasonably expected.
A reference to a practitioner’s expert must not identify the expert or imply reduced responsibility.
Emphasis of Matter and Other Matter paragraphs are allowed but must be clearly separated from the conclusion.
3. Points that matter most in a sustainability audit
1. Criteria come first. Unlike a financial audit where the framework is usually settled, the practitioner must actively evaluate suitability of criteria and whether they exist for all the information in scope. For an entity reporting under a regulatory framework, the presumption of suitability helps, but entity-developed criteria, for example for voluntary metrics, need full evaluation and must be disclosed and located in the report.
2. The materiality assessment and boundary are part of what you assure. The practitioner understands and evaluates the entity’s process to identify sustainability information to be reported. A weak materiality assessment is both a risk and potentially a scope or criteria issue.
3. Value chain information. Even where the criteria relieve management from obtaining direct data (for example, allowing sector-average data after reasonable efforts), the practitioner must still obtain sufficient appropriate evidence about the value chain information reported (A252). Procedures may include testing management’s process for obtaining the data and, where available, using other practitioners’ work.
4. Estimates and management bias. Where disclosures involve estimates, the practitioner evaluates methods, assumptions, data and changes from prior periods, and considers whether judgements indicate bias. Intentional bias is fraudulent in nature.
5. Experts and other practitioners. A practitioner’s expert must be evaluated for competence, capabilities and objectivity, with agreed scope, and the work evaluated for adequacy; Component or another practitioner’s work is evaluated before reliance.
6. Practitioner responsibility cannot be delegated. The engagement leader retains overall responsibility, and the report must not imply that responsibility is reduced because of an expert’s involvement.
7. Forward-looking statements are carved out. Targets, commitments, projections, strategy and aspirations are outside the standard’s purview. The illustrative reports provided in the Standard include an Exclusions paragraph stating that the conclusion does not extend to forward-looking statements, including their achievability, underlying assumptions or eventual outcomes.
8. Documentation. The file must let an experienced practitioner with no prior connection understand the procedures, results, evidence and significant judgements. After file assembly, documentation cannot be deleted before the end of the retention period.
4. Limited versus reasonable assurance at a glance
Dimension | Limited assurance | Reasonable assurance |
Engagement risk | Reduced to an acceptable level, but higher than reasonable | Reduced to an acceptably low level |
Risk assessment | Disclosure level | Assertion level |
Internal control understanding | Mainly inquiry-based | Inquiry and other procedures, with evaluation of design and implementation of key controls |
Conclusion wording | Negative form: nothing has come to our attention | Positive opinion |
Report | Includes a Summary of Work Performed | Does not require that section |
Procedures | Vary in nature and timing and are less in extent, but meaningful | Fuller procedures including mandatory substantive work for high risks |
A combined engagement is allowed, with different levels for different parts of the information, and the report must make clear which is which.
5. SSA 5000 audit versus a statutory audit
Aspect | Statutory audit of financial statements (SAs) | Sustainability assurance (SSA 5000) |
Subject matter | Historical financial information, derived primarily from the accounting system | Sustainability information on diverse topics, quantitative and qualitative, which may come from non-accounting systems, external sources and the value chain |
Assurance level | Reasonable assurance | Reasonable, limited or combined |
Framework | Financial reporting framework is generally defined and stable | Practitioner must evaluate suitability and availability of the criteria; entity-developed criteria are possible |
Opinion basis | True and fair view or compliance, depending on framework | Fair presentation or compliance criteria; conclusion also covers prepared in accordance with criteria |
Materiality | Mainly quantitative with qualitative considerations | Quantitative and qualitative, with double materiality where the criteria require it |
What is tested up front | Financial reporting process | Also the entity’s process to identify sustainability matters and the boundary |
Boundary | Legal entity or consolidation | Reporting boundary which may reach the value chain, outside the entity’s control |
Competence | Auditing and accounting expertise | Assurance skills plus sustainability competence, often through experts |
Appointment | Statutory appointment under the Companies Act | Engagement letter between the practitioner and the engaging party, unless law prescribes otherwise |
Report | Prescribed audit report, Key Audit Matters (KAM) for listed entities under SA 701 | Report per para 190; no KAM requirement in the requirements; Summary of Work Performed for limited assurance |
Forward-looking content | Estimates and going-concern assessments in scope | Forward-looking statements out of scope |
The machinery is shared: professional scepticism, risk assessment, tests of controls, substantive procedures, sampling, misstatement evaluation, representations and other information all echo the SAs.
6. SSA 5000 audit versus internal audit
Aspect | Internal audit | Sustainability assurance (SSA 5000) |
Purpose | Evaluate and improve governance, risk management and internal control processes (as the standard defines the function) | Express a conclusion that enhances intended users’ confidence in the sustainability information |
Reporting line | To management or the audit committee | Independent report to intended users |
Independence | Organisational objectivity within the entity | Independence from the entity under the ICAI Code of Ethics |
Scope setting | Set by management or the audit committee, can be varied | Fixed by the terms of engagement; management cannot impose limits that would lead to a disclaimer |
Output | Findings and recommendations | A formal conclusion or opinion; findings and recommendations must be separated from the conclusion |
Responsibility | Management owns the internal audit function | The practitioner alone is responsible for the conclusion |
Practically, a strong internal audit function over sustainability data (ESG data controls, BRSR data review) improves the control environment and monitoring, but it never substitutes for the practitioner’s own evidence.
7. SSA 5000 versus ISSA 5000
The SRSB states that SSA 5000 draws reference from ISSA 5000. Structure, concepts and most paragraph numbering follow the international standard, including its L and R lettering for limited and reasonable assurance requirements, the treatment of double materiality, value chain information, the entity’s process to identify sustainability information, and the report model. What differs is set out below.
7.1 Formal carve-outs listed in Appendix 4
ISSA 5000 paragraph | In SSA 5000 | Reason given |
54 and A134 | Deleted | To make the provisions relevant to both component practitioner and another practitioner, aligned with SA 600 |
A113 | Modified | Same as above |
A242, A243, A244, A335, A450 to A452, A462R, A496, A497, A501(e)(i), A560 | Deleted | Forward-looking statements are outside the purview of the standard, so assurance cannot be given on them |
179 | Modified | Same forward-looking reason; the management bias evaluation is confined to estimates and assumptions in the information |
References to ISQM 1 and ISQM 2 | Modified | SQC 1 is to be read as SQM 1 and SQM 2 from the dates of their respective applicability |
7.2 What the forward-looking carve-out means in practice?
The most consequential difference is conceptual. ISSA 5000 contemplates evidence procedures on forward-looking information; SSA 5000 removes those. Practitioners cannot provide assurance on targets, transition plans, commitments, projections or the achievability of aspirations, and should say so in the report. Historical estimates, such as emissions calculated from activity data and emission factors, remain squarely in scope. The boundary between a historical estimate and a forward-looking statement is a judgement that should be settled and documented at the engagement acceptance stage and recorded in the engagement letter.
8. Getting ready
For firms and companies, the lead time to 1 April 2027 is not long. Sensible steps:
Gap-assess methodology. Map current SSAE 3000 and SAE 3410 working papers to SSA 5000, especially risk assessment at disclosure or assertion level, materiality for qualitative disclosures, and documentation.
Build competence. Define sustainability competence criteria for engagement leaders and teams, and set up a vetted panel of practitioner’s experts with objectivity checks.
Revisit engagement letters. Cover boundary, levels of assurance by disclosure, criteria, forward-looking exclusions and management’s representations.
Test the entity’s identification process. Review how the entity runs its materiality assessment and sets its boundary before fieldwork.
Plan for value chain evidence. Agree early what evidence management can obtain and what the practitioner will test.
Align reporting. Prepare report templates for limited, reasonable and combined engagements, including the Summary of Work Performed and the engagement leader’s name for listed entities.
9. Closing thoughts
SSA 5000 turns sustainability assurance in India into a fully-fledged, standards-based discipline. It keeps the architecture of ISSA 5000 while adapting the ethical, quality and local reference points, and it draws a clear line at forward-looking statements. For practitioners the challenge is less about learning new procedures and more about combining assurance rigour with genuine sustainability competence. For preparers, the message is that data lineage, boundary decisions, materiality processes and internal controls over sustainability reporting will be examined much as financial reporting controls are today.
Read the full Standard here: https://publication.icai.org/publication/1235
For further queries, feel free to reach out to us at info@esgityadvisors.com.
Comments