The moment an external party has to give an opinion on your sustainability report, the question changes. It is no longer just about what is stated in the report, but about whether what is stated can be traced back to a source, a process and a responsible person. At its core, an assurance statement is an opinion on the quality of that traceability. That places demands on a file that many companies underestimate until the question is asked in concrete terms.
An accountant or other assurance provider does not look at the intention behind a figure, but at the evidence behind it. Where does the data come from, who recorded it, what control has been applied to it, and is that control repeatable. This means that a file must show not only an outcome, but also a path: from source registration to collection, from collection to processing, from processing to the final report text. If a link in that path is missing, that does not necessarily mean the figure is incorrect, but it does mean it cannot be demonstrated. And demonstrability is what assurance is judged on.
A report describes an outcome at a given moment. It shows a structure at the time of writing, but not whether that structure still holds up when underlying evidence is requested six months later. This distinction is addressed in why a compliance check is different from a report: a report is a photograph, a file must be a running system that can be queried again at any moment. For assurance, that distinction is not theoretical. A statement is not issued on the basis of a well-written document, but on the basis of a trail that can still be followed on the day of the audit.
Three elements keep recurring when a file is tested for traceability. Who is responsible for a piece of data or an obligation, which piece of evidence substantiates that this obligation has been met, and which control shows that this happens not just once but structurally. Without an owner, it is not clear who is accountable if something is missing. Without evidence, a claim is no more than an assertion. Without control, it cannot be shown that what is correct today will still be correct next quarter. This is also the structure that fits the question of how a board demonstrates that it is in control: not by declaring that an overview exists, but by showing who manages it and how that can be verified, as further elaborated in how does a board demonstrate that it is in control.
A file that aligns with the European text of an obligation is not automatically ready for assurance in a specific country. Many European rules receive a national implementation that differs in scope, deadline or required form of evidence. A company that has only documented the European layer runs the risk of overlooking the national requirement behind it, precisely at the moment a statement has to be issued per country. How an organisation keeps track of this without having to take out a new subscription or engage a new advisor for every jurisdiction is described in how do you keep track of national headings without a jungle of subscriptions.
The Compliance Check maps out which obligations apply to your organisation, and links each obligation to an owner, a form of evidence and a control. That is the structure an assurance process needs in order to begin: an overview in which nothing has remained implicit. What the Compliance Check does not do is assess the evidence itself for substantive correctness, and it does not guarantee that an assurance provider will issue a positive opinion. The structure makes a file assessable; it does not determine the outcome of that assessment. This distinction has deliberately been kept sharp, because a claim about an outcome cannot be substantiated before an external party has actually seen the file.
The moment an organisation discovers that a chain of evidence is missing is usually the moment an assurance process is already underway. At that point, the time left to appoint an owner or set up a control after the fact is limited, and it becomes clear what it costs not to have known earlier which obligations the company fell under and what was needed for them, a question further addressed in what does it cost not to know what you are subject to. Starting early does not mean a file will therefore be error-free, but it does mean the gaps become visible at a time when there is still time to close them.
The Compliance Check is under construction. Anyone who needs this now can sign up for the waiting list; nothing is being offered that does not yet exist.
Building and maintaining a chain of evidence takes time, and within many organisations that time is filled in manually: collecting data, updating files, repeating checks. The work scan from FTE TO AI calculates per task which part of that work can be taken over by AI, so that it becomes clear where people remain needed for judgement and where repeatable work no longer requires human hands.
Vraag maar welke verplichting op u van toepassing is, en waaraan u dat kunt aantonen.
Answers come from this site’s knowledge base. Not tailored advice, and not a scan of your company.