Sustainability Assurance
On 3 July 2026 the European Commission adopted the revised sustainability reporting standards, replacing the set preparers spent three years building against. The reporting question is now settled. The control question is not: whether the figures you publish can be traced, reproduced and signed for by a named individual when an assurance provider asks.
This is the same discipline we run over cyber, model and settlement exposure, pointed at the sustainability statement. One control set, several regimes, one figure.
What the 2026 reset actually does
01
A restatement problem
Every preparer already reporting has to move an existing datapoint population onto a different one. Where a definition changed, the comparative has to be recomputed on the new basis and the restatement documented. Presenting two bases side by side is a misstatement, not a presentational choice.
02
An assurance problem
Limited assurance is performed against held evidence, not against the report. Most preparers hold spreadsheets with no lineage, no versioned factors and no individual sign-off. The first cycle then becomes an evidence-building exercise carried out under audit conditions.
03
A concentration problem
Simplification is not deregulation. Fewer datapoints carry the same liability, so exposure concentrates on a smaller, more quotable surface — and on the materiality assessment that justifies every omission the revision created.
ESRS 2026 transition board
The revised standards adopted on 3 July 2026 replace the set preparers built against. What matters operationally is not the count of datapoints removed — it is whether the move from one population to the other was a controlled restatement or a quiet change of basis. Indicative rows, drawn from a representative preparer.
Control consequence
Survives the revision intact, which means the assurance bar rises rather than falls: it is now a smaller set of figures carrying the same scrutiny, with no adjacent disclosure to dilute a misstatement.
Control domains
- Source
- Meter data and utility invoices via the energy management system
- Accountable
- Group Head of Environment
- Evidence held
- Invoice extracts, meter reads, consolidation workbook
- Restatement
- Controlled
Limited-assurance readiness
Twelve questions an assurance provider will ask in the first week. Answer them as your evidence stands today, not as the programme intends it to stand.
01 · Datapoint inventory
Can you produce, today, the full list of datapoints you intend to disclose under the revised standards, each with a named owner in post?
02 · Restatement control
For every datapoint whose definition changed, is there a documented restatement showing prior-period figures recomputed on the new basis?
03 · Lineage depth
For a disclosed figure picked at random, can you trace it to source system records without a manual reconstruction exercise?
04 · Estimation policy
Is every estimated or modelled figure marked as such, with the method, factor source and version recorded against the disclosed value?
05 · Value-chain evidence
Where value-chain figures rest on supplier submissions, do you hold the submission, its date, and the basis on which it was accepted?
06 · Control testing
Are the controls over sustainability figures tested to the same standard as controls over financial figures, by the same second line?
07 · Preparer sign-off
Does each disclosed figure carry an individual sign-off from the person accountable, recorded before the statement is approved?
08 · Claim substantiation
Can every public sustainability claim — website, prospectus, marketing, fund documentation — be traced to a control that substantiates it?
09 · Transition plan integrity
Does each quantified milestone in the transition plan reconcile to an approved capital plan and a named accountable executive?
10 · Double materiality
Is the materiality assessment reproducible — method, inputs, thresholds and challenge — for every topic you chose not to disclose?
11 · Assurance pack assembly
Can the assurance pack be assembled from held evidence in days rather than assembled by writing it for the first time?
12 · Cross-regime reuse
Where the same figure is disclosed under more than one regime, is it produced once from one control and reconciled across all of them?
Answer the questions above to see an indicative position.
Sustainability data lineage
The same lineage discipline supervisory reporting already carries, applied to the sustainability statement. A figure is only as defensible as the weakest stage between the meter and the claim.
Evidenced
Source capture
Meter reads, utility invoices, payroll extracts, procurement ledger lines, supplier submissions.
What a reviewer asks
What is the system of record, and who can change a value in it after capture?
How it fails
A figure whose origin is a spreadsheet emailed by a site manager, with no upstream record behind it.
Transition plan and value chain
Value-chain assurance fails on ambition rather than effort. The discipline is stating what is obtainable at each tier, evidencing that, and refusing to assert the rest. Drawn off the third-party register already maintained for resilience, not a parallel supplier model.
Tier 1 — critical and important suppliers
Contracted, in the third-party register, subject to periodic review.
Obtainable, and testable
Primary data, contractual right of audit, remediation commitments with dates, and a substitutability position already held for resilience purposes.
Where the assertion breaks
Even here, primary emissions data is often the supplier's own estimate. Record it as their estimate, not as your primary data.
Tier 1 — long tail
Thousands of low-value suppliers with no bespoke contract terms.
Obtainable, and testable
Spend-based modelling with a documented factor source, plus whatever the smaller-undertaking voluntary standard permits you to request.
Where the assertion breaks
Questionnaire response rates below fifty per cent are normal. A coverage percentage built on non-responses is a fiction with a decimal point.
Tier 2 and beyond
Suppliers of your suppliers, largely invisible in your systems.
Obtainable, and testable
Sector-level modelling, adverse-media and sanctions screening, and targeted deep dives where a specific impact is alleged.
Where the assertion breaks
You cannot assert tier-2 coverage. You can assert a method, a screening cadence and an escalation route when something surfaces.
Transition plan execution
Each quantified milestone in the published plan.
Obtainable, and testable
Board approval, funded capital line, named executive, interim measurement point, and the variance record when the milestone moves.
Where the assertion breaks
A target with no funded line behind it is an aspiration. Disclose it as one or fund it; do not present it as a commitment.
Jurisdictional map
A group operating across these regimes holds one emissions inventory, one workforce population and one conduct record. It should not hold three. State the fact once, produce it from one control, and reconcile every presentation back to it.
Who it reaches
In-scope undertakings reporting under the Accounting Directive as amended by CSRD, on the revised standards adopted 3 July 2026.
Assurance expectation
Limited assurance on the sustainability statement, performed against the disclosed datapoints and the process that produced them.
Where it overlaps
Climate datapoints substantially overlap IFRS S2; workforce datapoints overlap national pay-transparency filings.
Claim substantiation
Enforcement rarely starts with the sustainability statement. It starts with a sentence on a website, in a fund factsheet or in a tender response that outruns the figure it derives from. Every claim is registered, traced to a disclosed figure and to the control that substantiates it, and given one of three verdicts. Illustrative examples.
“Net zero by 2040 across our operations and value chain”
Corporate website, investor deck
Basis
Operational scope is funded and measurable. The value-chain component rests on supplier commitments that are neither contractual nor evidenced.
What has to change
Separate the operational target from the value-chain target, state the boundary for each, and disclose the proportion of the value-chain figure that is modelled.
“Carbon neutral since 2024”
Product marketing, email footer
Basis
Rests on retired offsets rather than reduction, and the offset quality assessment is not held. This is the highest-frequency enforcement pattern in the market.
What has to change
Withdraw the unqualified claim. If offsets are retained in the strategy, disclose volume, vintage, registry and quality basis alongside gross emissions.
“EUR 20 billion of sustainable finance deployed”
Annual report, press release
Basis
The figure is real; the definition of what qualifies is internal, undisclosed and has widened twice since first publication.
What has to change
Publish the eligibility taxonomy, state when it changed, and restate the prior-year figure on the current definition.
“One hundred per cent of suppliers screened for human rights risk”
Sustainability statement, tender responses
Basis
One hundred per cent of tier-1 contracted suppliers were sent a questionnaire. Response rate was under half, and tier 2 was not addressed.
What has to change
Restate as the population actually screened, on the actual method, with the response rate and the tier boundary stated.
“Our data centres run on one hundred per cent renewable electricity”
Website, RFP responses
Basis
Backed by contractual instruments with retirement evidence held per site, reconciled to metered consumption for the period.
What has to change
Maintain the reconciliation each period and disclose the instrument type, since market-based and location-based figures differ materially.
What we test
Domain C40 in the unified control spine. Each control states what must be true; the test states how a reviewer proves it, on what population, and what counts as failure. Test procedures, evidence specifications and the effectiveness rubric are issued under engagement.
C40.01
Disclosure population is defined and owned
Every datapoint the entity intends to disclose is listed, mapped to its standard reference, and resolves to one named owner in post at the test date.
inspection · quarterly · assisted
C40.02
Restatement control on changed definitions
Where a datapoint definition changed between standard versions, prior-period figures are recomputed on the new basis and the restatement is documented and approved before publication.
reperformance · annual · assisted
C40.03
Source-to-disclosure lineage without reconstruction
Any disclosed figure can be traced to source system records through every transformation, on demand, without a manual reconstruction exercise.
reperformance · semi-annual · assisted
C40.04
Consolidation perimeter reconciles to the financial boundary
The sustainability reporting perimeter is stated, reconciled to the financial consolidation, and every difference is explained and approved.
inspection · annual · manual
C40.05
Factor and method versioning is reproducible
Every conversion factor, emission factor and allocation method is versioned, and the version applied to any past period can be reproduced.
reperformance · annual · assisted
C40.06
Estimated values are marked and quantified
Each disclosed figure states the proportion that is estimated or modelled, with the method and the trigger that permits estimation.
inspection · annual · assisted
C40.07
Value-chain submissions carry provenance
Where a figure rests on a supplier submission, the submission, its date, the submitting entity and the basis on which it was accepted are held.
inspection · semi-annual · assisted
C40.08
Data requests respect the smaller-undertaking ceiling
Information requested from smaller suppliers stays within the applicable voluntary-standard ceiling, and requests exceeding it are approved and justified.
inspection · annual · manual
C40.09
Transition plan milestones are funded and owned
Each quantified milestone in the published transition plan reconciles to an approved capital plan line and a named accountable executive, with variance recorded when it moves.
reperformance · annual · manual
C40.10
Public claims resolve to a substantiating control
Every public sustainability claim, wherever it appears, is registered and traced to the disclosed figure and the control that substantiates it.
inspection · quarterly · assisted
C40.11
Individual sign-off before statement approval
Each disclosed figure carries a recorded sign-off from the individual accountable, dated before the statement is approved.
inspection · annual · automated
C40.12
Assurance pack assembles from held evidence
The limited-assurance pack is assembled from evidence already held, within the stated service level, rather than created during fieldwork.
reperformance · annual · assisted
The reported position
The figures as they currently stand, shown for orientation. Assurance does not begin here — it begins with whether each of these numbers can be traced back to a source record and signed for. Illustrative data.
Emissions Tracker
GHG Protocol aligned Scope 1, 2, 3 emissions monitoring
Total Emissions (2025)
50.1k
mtCO2e
Scope 1 (Direct)
9.2k
Scope 2 (Indirect)
5.9k
Scope 3 (Value Chain)
35.0k
Progress to 2030 Target (50% reduction)
Emissions Trend
Year-over-year emissions by scope
Scope Distribution
2025 emissions by scope
What this is not
Cabier does not compute emissions, sell emission factors, prepare the sustainability statement or tag the filing. We assure the controls over the figures and the process that produced them, and we say so in writing before an engagement starts.
We do not operate a carbon accounting engine, sell an emission factor library, generate the tagged filing or run supplier survey collection. Those are data products. Assurance is a different business, and mixing them costs the independence that makes the opinion worth holding.
Public references
European Commission — revised sustainability reporting standards adopted, 3 July 2026
Delegated act setting out the revised ESRS and a voluntary standard for smaller undertakings.
EFRAG — 2026 revised ESRS and voluntary standard interactive document set
Published text of the revised topical standards, glossary and defined terms.
IFRS Foundation — IFRS S1 and IFRS S2
The ISSB baseline that adopting jurisdictions apply, with climate first.
California SB 253 and SB 261
State-level emissions disclosure and climate-related financial risk reporting.