What Is ISAE 3000? Scope, Assurance Levels, and Reporting

ISAE 3000 is the international standard that governs independent assurance engagements on subject matter other than historical financial statements. Issued by the International Auditing and Assurance Standards Board in December 2013 and effective for reports dated on or after December 15, 2015, it sets out how practitioners plan, evidence, and report on non-financial information such as sustainability disclosures, greenhouse gas data, internal controls, and regulatory compliance.¹ With demand for credible non-financial reporting rising, particularly under the EU Corporate Sustainability Reporting Directive, it has become the baseline framework practitioners around the world use to structure this work.

What the Standard Applies To

ISAE 3000 applies to any assurance engagement that falls outside audits or reviews of historical financial statements. That includes sustainability reports, environmental impact data, cybersecurity controls, compliance with governance frameworks, and effectively any other subject matter where stakeholders want an independent practitioner’s conclusion about whether reported information is reliable.

The standard also functions as a parent framework for subject-specific standards. ISAE 3410 covers assurance on greenhouse gas statements, and ISAE 3402 covers reports on controls at service organizations. When a practitioner performs one of those engagements, they must comply with both the specific standard and ISAE 3000.²

Reasonable Assurance and Limited Assurance

Every ISAE 3000 engagement operates at one of two levels of assurance. The choice determines how much work the practitioner does, how the conclusion is worded, and how much confidence intended users can reasonably take from the report.

Reasonable Assurance

Reasonable assurance gives users a high level of confidence that the subject matter information is free from material misstatement. The practitioner reduces engagement risk to an acceptably low level through extensive testing, then issues a positive-form conclusion: “In our opinion, the subject matter information is presented fairly, in all material respects, in accordance with the criteria.”³

Getting there takes work. The practitioner builds an understanding of the subject matter and its controls, assesses risks of material misstatement, designs procedures that respond directly to those risks, performs them, and evaluates whether the evidence obtained is enough. The process is explicitly iterative: risks get reassessed as evidence accumulates.⁴ Reasonable assurance is not absolute assurance. Judgment, sampling, and evidence limitations mean risk is never zero. But it is the highest level ISAE 3000 offers.

Limited Assurance

Limited assurance involves fewer and different procedures. The practitioner does enough to identify whether anything suggests the information is materially misstated, without performing the extensive testing a reasonable assurance conclusion requires. Procedures center on inquiry of management and analytical review, such as comparing reported data against expectations from prior periods or industry benchmarks.³

The conclusion is expressed in the negative: “Based on the procedures performed, nothing has come to our attention that causes us to believe the subject matter information is materially misstated.” That wording is a signal to readers that the confidence level is lower. The EU Corporate Sustainability Reporting Directive, for instance, initially requires limited assurance on sustainability reports, with a potential move toward reasonable assurance in later phases.

Attestation Engagements Versus Direct Engagements

ISAE 3000 recognizes two structural forms. In an attestation engagement, someone other than the practitioner (usually management) measures or evaluates the subject matter against the criteria and produces a statement. The practitioner then examines that statement to conclude whether it is fairly presented. Most sustainability assurance work follows this pattern: the company prepares the emissions report, and the practitioner tests whether it holds up.

In a direct engagement, the practitioner performs the measurement or evaluation themselves and gathers original evidence to reach an independent conclusion about the underlying subject matter. The distinction matters because it changes who is responsible for producing the information and how deeply the practitioner is involved in generating the findings.¹

Who Is Involved

Every ISAE 3000 engagement has at least three parties: the practitioner, the responsible party, and the intended users. In some circumstances, a separate measurer or evaluator and a distinct engaging party (the entity that contracts the practitioner) are also involved.⁵

The responsible party is responsible for the underlying subject matter. In an attestation engagement, it is often also the measurer or evaluator that prepares the subject matter information.
The practitioner is the independent professional who gathers evidence and forms the conclusion. The practitioner cannot be the responsible party, the engaging party, or an intended user.
The intended users are the individuals or organizations expected to rely on the assurance report. The responsible party can be one of the intended users, but not the only one.

The separation of roles is what makes the engagement credible. The practitioner’s independence from the responsible party is what gives the conclusion weight for users who cannot verify the information themselves.

Preconditions Before Accepting the Work

Before agreeing to an engagement, the practitioner has to verify several preconditions. If any of them is absent, the engagement should not proceed. The roles of all parties must be appropriate for the circumstances, and the engagement itself must have six characteristics:⁶

The underlying subject matter is identifiable and capable of consistent evaluation.
The criteria used to evaluate it are suitable, exhibiting relevance, completeness, reliability, neutrality, and understandability.⁵
Those criteria are available to intended users so they can understand the basis for the conclusion.
The practitioner can reasonably expect to obtain the evidence needed to support a conclusion.
The conclusion will be contained in a written assurance report.
The engagement has a rational purpose. For limited assurance specifically, the practitioner must expect to obtain a meaningful level of assurance rather than something so diluted it adds no value.

The practitioner also has to be satisfied that relevant ethical requirements (including independence) will be met, and that the engagement team collectively has the competence and capabilities for the work. These checks happen before terms are formally agreed.⁶

Materiality and Risk for Non-Financial Data

Materiality drives the engagement. It determines what the practitioner tests, how deeply they test it, and what threshold of error would change intended users’ decisions. Setting materiality for non-financial subject matter is harder than in a financial audit because there is often no single monetary figure to anchor the assessment. Practitioners weigh both quantitative thresholds and qualitative factors, including the nature of the misstatement, whether it obscures a trend, and what the intended users would reasonably consider important.⁴

For ESG engagements, practitioners often work with two layers: report materiality (what belongs in the report at all, given the reporting framework, the entity’s strategy, and stakeholder engagement) and element materiality (the tolerance for each individual metric).⁷ Risk assessment feeds into all of this. The practitioner has to understand the subject matter and its circumstances well enough to see where material misstatement is most likely, and that understanding drives where experts are needed, how analytical procedures are calibrated, and how further evidence-gathering procedures are designed.

Ethics, Independence, and Firm-Level Quality

Practitioners working under ISAE 3000 must comply with the International Code of Ethics for Professional Accountants issued by IESBA. The Code sets out five fundamental principles: integrity, objectivity, professional competence and due care, confidentiality, and professional behavior.⁸

Independence is non-negotiable. The Code distinguishes independence of mind (actually being free from influences that compromise judgment) from independence in appearance (avoiding circumstances that would lead a reasonable third party to doubt objectivity). Part 4B of the Code specifically addresses independence for assurance engagements other than audits and reviews, which is where ISAE 3000 work sits.⁸

The firm itself must operate under a system of quality management conforming to International Standard on Quality Management 1 (ISQM 1), which applies to all firms performing assurance engagements and sets requirements for engagement-level quality management, including engagement partner responsibilities and review processes.⁹

Evidence and the Use of Experts

The practitioner must obtain sufficient appropriate evidence to support the conclusion. What counts as sufficient depends on the assurance level: for reasonable assurance, enough to reduce engagement risk to an acceptably low level; for limited assurance, enough to support the negative-form conclusion.

Evidence-gathering procedures include inspection of records and documents, observation of processes, confirmation from third parties, recalculation, re-performance, analytical procedures, and inquiry. The practitioner selects and combines them based on the assessed risks in each area.⁴ Management typically provides written representations confirming that the subject matter information was prepared in line with the applicable criteria and that they have fulfilled their responsibilities. Those representations do not substitute for other evidence, but they formalize management’s accountability.

Non-financial engagements often need specialized knowledge the practitioner does not have. A greenhouse gas engagement may need environmental science expertise; a cybersecurity engagement may need information security specialists. ISAE 3000 allows the practitioner to use the work of an expert, but the practitioner retains sole responsibility for the conclusion. Before relying on an expert, the practitioner must evaluate the expert’s competence, capabilities, and objectivity. For external experts, that includes inquiry into interests or relationships that could threaten objectivity. The practitioner also has to get enough understanding of the expert’s field, agree on the nature and scope of the work, and evaluate whether the results are adequate for the engagement’s purposes.¹⁰

The Assurance Report and Modified Conclusions

The assurance report is the deliverable. It identifies the subject matter information, describes the criteria, explains the scope of procedures, states the applicable standards (including ISAE 3000), and presents the conclusion. For reasonable assurance the conclusion is positive; for limited assurance it is expressed in negative form.

Not every engagement ends cleanly. ISAE 3000 requires the practitioner to modify the conclusion when problems arise, and the modification depends on the severity of the issue:⁵

A qualified conclusion is issued when the effects of a misstatement, or the possible effects of a scope limitation, are material but not pervasive. It is phrased as “except for” the specific matter.
An adverse conclusion is issued when the subject matter information is materially and pervasively misstated.
A disclaimer of conclusion is issued when a scope limitation is so material and pervasive that the practitioner cannot obtain sufficient evidence to form any conclusion at all.

“Pervasive” here means the effects are not confined to one isolated area but spread across the subject matter information, represent a substantial proportion of it, or are fundamental to intended users’ understanding.⁵ Where applicable law or regulation permits, the practitioner may also withdraw from the engagement entirely.

Documentation and Retention

All workpapers, communications, and evidence must be documented systematically so that an experienced practitioner with no prior connection to the engagement could understand what was done, what evidence was obtained, and how the conclusion was reached. Workpapers should show a clear connection between the assessed risks, the procedures designed to respond, and the evidence gathered.

Retention is governed by ISQM 1, which does not prescribe a single universal period and instead defers to applicable law, regulation, and professional standards in the practitioner’s jurisdiction. In practice, many firms retain engagement files for at least five years, though the specific requirement varies by country.⁹

A Note for U.S. Practitioners

In the United States, attestation engagements on non-financial subject matter for nonissuers follow the AICPA’s Statements on Standards for Attestation Engagements, codified as AT-C sections within SSAE No. 18 and its amendments.¹¹ The AT-C framework is conceptually aligned with ISAE 3000 in many respects, but they are separate standards. U.S. practitioners working under international standards, for example on behalf of a multinational parent reporting under ISAE 3000, must comply with ISAE 3000 directly. Following the AT-C sections alone does not satisfy its requirements.

1
International Auditing and Assurance Standards Board. International Standard on Assurance Engagements (ISAE) 3000 Revised, Assurance Engagements Other than Audits or Reviews of Historical Financial Information
2
Danish Institute of State Authorized Public Accountants. ISAE 3410, Assurance Engagements on Greenhouse Gas Statements
3
ICAEW. Limited Assurance vs Reasonable Assurance
4
Instituto de Censores Jurados de Cuentas de España. ISAE 3000 (Revised), Assurance Engagements Other than Audits or Reviews of Historical Financial Information
5
Independent Regulatory Board for Auditors. ISAE 3000 (Revised), Assurance Engagements Other than Audits or Reviews of Historical Financial Information
6
International Federation of Accountants (IFAC). ISAE 3000 (Revised), Assurance Engagements Other than Audits or Reviews of Historical Financial Information
7
ICAEW. Assurance Opinions on ESG Metrics Under ISAE 3000 (Revised)
8
International Ethics Standards Board for Accountants (IESBA). Handbook of the International Code of Ethics for Professional Accountants
9
Independent Regulatory Board for Auditors. International Standard on Quality Management 1
10
Malaysian Institute of Accountants. ISAE 3000 (Revised), Assurance Engagements Other than Audits or Reviews of Historical Financial Information
11
AICPA & CIMA. AICPA SSAEs – Currently Effective