ISAE 3000 (Revised), from the International Auditing and Assurance Standards Board, is the general standard for assurance engagements other than financial-statement audits — and, until ISSA 5000's arrival, the workhorse of sustainability assurance. It defines limited versus reasonable assurance, evidence-gathering procedures, and the form of the assurance conclusion. Most assured sustainability reports of the past decade carry an ISAE 3000 opinion, and the limited-assurance conclusion ("nothing has come to our attention...") is materially weaker than reasonable assurance — a distinction readers of ESG claims must understand. It is now being superseded for sustainability engagements by ISSA 5000. The standard applies to any subject matter with suitable criteria — sustainability reports, KPIs, compliance statements, controls — which is why it served as the default for early ESG assurance. Engagements must state the criteria used, and the strength of a conclusion depends as much on those criteria as on the assurance level. Performing an engagement under this standard does not by itself guarantee a favourable conclusion, certify performance, or substitute for regulatory compliance.
Conditional relationships
Claims it may support
A relationship does not mean that the standard proves or validates every use of a claim.