CSRD Assurance: 4 Pillars for a Robust Approach

CSRD Assurance: 4 Pillars for a Robust Approach

Analysis Report February 2026

In Brief Almost all large listed companies in the Netherlands voluntarily applied the CSRD in their sustainability report for 2024. This provided a lot of relevant information about their impact on the environment, people, and society. OOB (Organizations of Public Interest) accounting firms provided assurance on CSRD sustainability reports for the first time, with a limited level of assurance. The AFM is positive about the efforts of OOB accounting firms: significant steps have been taken. This report contains our insights and provides 4 pillars for the (further) development of a robust approach to CSRD assurance. High-quality CSRD assurance contributes to reliable, understandable, and consistent sustainability reporting, so that users can make well-informed choices.

Table of Contents

1. Introduction 3

2. Ensure a robust quality control system for CSRD assurance 5 2.1 Setting up a quality control system is no sinecure 5 2.2 Ensure sufficient capacity and expertise 5 2.3 Make client and engagement acceptance specific 6 2.4 Develop a methodology with associated work programs and explanations 7 2.5 Implement the right mix of safeguards and ensure sufficient support for assurance teams 8 2.6 Ensure a good PDCA cycle to continuously develop the quality control system 8

3. Ensure a skilled assurance team and good project management 10 3.1 Assemble a skilled assurance team 10 3.2 Start on time and ensure good engagement management 10

4. Understand the client and their processes for a good assurance plan 11 4.1 Ensure in-depth insight into the client 11 4.2 Use the obtained insight for the DMA assessment 11 4.3 Make assurance risks sufficiently specific 12 4.4 Differentiate in assurance materiality 12

5. Align the work to be performed with the estimated assurance risks and assurance materiality 13 5.1 Adopt a professional-critical attitude, a sieve, and a helicopter view for a good mix of assurance work 13 5.2 The first year requires more assurance work ('first-year effect') 14 Appendix: Accountability 16

6. Introduction 1 The enterprise and its place in the world: 3 focus points for CSRD, AFM 2025. 2 CSRD: No time to lose! Exploration of the application of new sustainability regulation in the annual report (CSRD) for listed companies and accounting firms, AFM 2023.

A sustainability report shows the place of an enterprise in the world around it. According to the Corporate Sustainability Reporting Directive (CSRD), enterprises must prepare their sustainability reports in accordance with the European Sustainability Reporting Standards (ESRS). They must ask accountants to provide assurance on this (CSRD assurance). The purpose of this assurance is to provide assurance regarding the reliability, understandability, and consistency of sustainability reporting. This helps investors and society make well-informed decisions.

OOB accounting firms provided assurance on sustainability reports prepared according to ESRS for the first time in 2025. The CSRD was not yet implemented in Dutch law in 2025. Nevertheless, almost all large listed companies in the Netherlands voluntarily prepared their sustainability reports according to ESRS for the financial year 2024 (the first wave). Accounting firms licensed to perform statutory audits for organizations of public interest (OOB accounting firms) provided CSRD assurance in this context.

Assurance on sustainability reporting differs fundamentally from assurance on financial reporting. The CSRD prescribes a limited level of assurance – lower than the reasonable level of assurance required for assurance on a statutory audit of financial reporting. This limited level of assurance is not specific to CSRD; assurance with a limited level of assurance can also be provided for financial information – for example, in an engagement to review interim financial information. However, sustainability reports deal with different subjects. For instance, there are many different subjects, with various non-monetary units without a double-entry bookkeeping system, often with external information focusing on the value chain, a broad stakeholder group, and short- and long-term goals. Consequently, there is often more reliance on estimates. This can make CSRD assurance work more extensive and in-depth.

The AFM considers it important that OOB accounting firms control the quality of CSRD assurance. This means, at the very least, that the assurance is performed in accordance with laws and regulations, that sufficient and suitable assurance information is obtained, and that a suitable assurance report is provided with the sustainability reports. In 2023, we conducted an exploration into the preparation of the four largest OOB accounting firms (Deloitte, EY, KPMG, and PwC) for providing CSRD assurance in 2025. This exploration revealed that significant steps were still needed in capacity, expertise, and the organization of accounting firms in preparation for the arrival of the CSRD. We see in the current research that significant steps have been taken in these three aspects.

The Omnibus Directive has an impact on the further development of the CSRD. Through Omnibus, the scope of enterprises subject to the CSRD is reduced. Also, the reporting obligation for large companies (the second wave) and listed SMEs (the third wave) has been delayed by two years. Once the Omnibus Directive is implemented, the obligation for most of the second wave and the entire third wave will lapse. As a result, the expected increase in the number of CSRD engagements will decrease significantly. This requires companies and accounting firms to revise strategic choices to, among other things, align capacity with the new, slimmed-down scope of the CSRD.

This report shows how accounting firms arrived at CSRD assurance for the first wave of enterprises. For the six OOB accounting firms (BDO, Deloitte, EY, Forvis Mazars, KPMG, and PwC), we gained insight into the control of CSRD assurance in the quality control system and the work performed for these first-year CSRD engagements. The purpose of our exploration was to gain insight into how these accounting firms control the quality of providing CSRD assurance. At the file level, we gained insight, among other things, into the work performed on the double materiality analysis (DMA) and greenhouse gas emissions. The AFM is positive about the effort made by OOB accounting firms to provide this CSRD assurance. In our research, we saw examples where interventions by assurance teams resulted in improvements in CSRD reporting, for example regarding the DMA, corrections to the completeness of reported greenhouse gas emissions, and the correct application of the ESRSs. This highlights the importance of CSRD assurance.

The AFM sees 4 key pillars that help accounting firms and the accountants associated with them to control the quality of CSRD assurance:

1. Ensure a robust quality control system for CSRD assurance.
2. Ensure a skilled assurance team and good project management.
3. Understand the client and their processes for a good assurance plan.
4. Align the work to be performed with the estimated assurance risks and assurance materiality.

These pillars are also important in statutory audits. It is important to make them concrete for CSRD assurance. These four pillars form the basis of this report. In the following chapters, we share our observations per pillar on how OOB accounting firms have set up their quality control system for CSRD assurance and how they provided CSRD assurance in 2025. We have included examples to inspire the sector to (further) work on a good approach to CSRD assurance engagements. We encourage accounting firms to continue the positive line of a robust approach, using the insights in this report.

2. Ensure a robust quality control system for CSRD assurance 3 CSRD: No time to lose! Exploration of the application of new sustainability regulation in the annual report (CSRD) for listed companies and accounting firms, AFM 2023.

CSRD assurance requires a suitable quality control system to guarantee the quality of CSRD engagements. The importance of structurally embedding measures in the quality control system increases as more CSRD engagements are performed.

2.1 Setting up a quality control system is no sinecure A good design is essential for setting up a quality control system for CSRD engagements. The starting point for the design can be the structure of the quality control system for statutory audits. This structure can then be made specific for CSRD engagements. Most accounting firms have established a steering group for the implementation of CSRD assurance. Such a steering group is involved in the development of policy and in strategic choices regarding the provision of CSRD assurance. Most accounting firms also have ESG panels or working groups for the further elaboration of this policy and for supporting assurance teams.

2.2 Ensure sufficient capacity and expertise In our 2023 research 'CSRD: No time to lose!', we emphasized the importance of accounting firms having sufficient capacity and expertise in time to provide CSRD assurance. Our current exploratory research shows that the accounting firms involved at that time have made significant strides in terms of capacity and expertise. We are positive about this effort.

All accounting firms state that their responsible accountants and staff possessed sufficient professional competence. They state that assurance teams followed a mandatory CSRD curriculum in time. This curriculum was largely adjusted to the job level. CSRD-related accreditations are centrally registered and monitored. Responsible accountants and staff also learn through involvement in CSRD engagements and through informal consultations. Furthermore, teams learn from each other, including through intervisions facilitated by accounting firms. In these sessions, experiences are shared regarding obstacles, dilemmas, and learning points. Through news updates, they stay informed about the latest (professional) developments.

All accounting firms state that they had sufficient experts. Most accounting firms have the necessary experts, and if not, arrangements have been made to engage external experts. Most accounting firms also have an overview of (internal) experts. Given the nature of the subjects on which CSRD assurance is provided, different expertise is often required compared to a statutory audit. We consider it important that sufficient expertise is available internally or externally, aligned with the CSRD engagements to be performed.

All accounting firms state that they had sufficient capacity to provide CSRD assurance for the first wave of enterprises. A significant increase in the required capacity for the second wave of enterprises was expected; accounting firms were already scaling up for this. However, the number of CSRD engagements will rise much less, due to the Omnibus Directive. This impacts the re-evaluation of strategic choices, such as the required capacity and determining who is trained for CSRD engagements. Where the plan was previously to train the entire assurance practice, it can now be chosen to assign the work to a team of specialists, thereby preserving knowledge and experience.

Accounting firms state that they monitor the deployment of capacity and the progress of CSRD engagements. The manner in which this is done varies, as does the steering information this yields. It is important to monitor the deployment of capacity both individually and in total, but also over time. If one engagement shifts in time, that may still be manageable. It becomes more difficult if it concerns a larger number of engagements. Accounting firms state that responsible accountants and staff are not scheduled for too many engagements simultaneously to build in flexibility.

Inspiration: A dashboard can help monitor CSRD engagements One accounting firm regularly analyzes planned versus actual hours across all CSRD engagements using a dashboard. This provides insight at both individual and total levels into progress and potential bottlenecks, allowing for timely follow-up.

2.3 Make client and engagement acceptance specific All accounting firms have adapted their client and engagement acceptance procedures (hereinafter: CEAC procedures) for CSRD engagements. The existing CEAC procedures for statutory audit engagements are used as a basis and expanded with specific points of attention for CSRD engagements. For example, some accounting firms involve an ESG specialist in the CEAC process. For instance, to assess whether an expert should be engaged if an enterprise reports on specific and complex material subjects.

Inspiration: Specific CSRD questions support decision-making in engagement acceptance One accounting firm has developed a specific CEAC form for CSRD engagements. This form includes specific CSRD questions – for example, regarding material subjects. This helps to make a good assessment of the complexity of the engagement, as well as the required time, experience, and resources to perform the engagement. The form requires explicit documentation of the considerations regarding this, such as the engagement of ESG experts. ESG-specialized team members are involved in drafting and reviewing the form. This way of working ensures a professional-critical and consistent execution of the CEAC procedures.

All accounting firms classified the CSRD engagements for the first wave of enterprises in the highest risk category. The primary reasons for this are that the involved enterprises are organizations of public interest (OOBs) and that CSRD assurance is being provided for the first time for these enterprises. For the second wave of enterprises, most accounting firms still need to develop criteria to assess the risk of the CSRD assurance engagement. The risk category is an important parameter for determining which quality safeguards are implemented.

Most accounting firms perform both CSRD assurance and the statutory audit for the same client, although we see that it is also possible to provide only CSRD assurance. In the latter case, additional assessments are necessary as part of the CEAC. The complexity of the intended client and the impact on the effectiveness and efficiency of the assurance engagement are examples of such assessments. It must also be considered what prerequisites are needed to enable adequate alignment with the external accountant responsible for the statutory audit.

The AFM sees a threat to independence due to self-review when non-audit services are provided that influence the sustainability report. This may be the case, for example, if advice is given on developing the DMA. For the first wave of enterprises, this usually does not apply due to a prohibition provision from the statutory audit for OOBs regarding the provision of non-audit services. For the second wave of enterprises, most accounting firms can further concretize their independence policy to adequately identify threats and take measures.

2.4 Develop a methodology with associated work programs and explanations All accounting firms have developed a methodology with associated work programs and explanations for CSRD assurance. This was largely developed at the international level and subsequently supplemented for the Netherlands. The latter is to comply with specific Dutch regulations, such as the additional requirements for audit and other standards (NV COS) 3810N.

All accounting firms have prepared extensive work programs for the assessment of the DMA. The DMA forms the basis of sustainability reporting. Therefore, a good assessment of it is very important. The DMA work programs support assurance teams in the execution and documentation of the assessment. These work programs contain all relevant ESRS requirements, with extensive explanations. A table is often included for documenting the questions asked and other important discussions with the client.

We see differences in the manner of assessing and documenting risks. We consider it important that the assessment is made sufficiently specific and that tendencies are recognized – this to guide the content of the assurance plan. Most accounting firms use assertions for this. Additionally, some accounting firms have standardly included the risk of management override of controls and/or the risk of fraud (for example, due to greenwashing) in the risk assessment – which is then specifically made by the assurance team for the client in question.

Inspiration: Summarizing overviews help in maintaining a helicopter view At one accounting firm, the file documents what the identified risks entail and to which assertions these risks are linked. Based on this, the risk is assessed. Once all steps have been completed, a summarizing screen is automatically generated in the file, showing how the risk assessment and the planned assurance work per theme relate to each other. This helps the assurance team to assess with a professional-critical attitude whether the assurance plan as a whole is suitable.

We see differences in the manner of determining and documenting materiality. Materiality is determined at different levels, such as per subject or per KPI, taking into account qualitative and quantitative factors. Additionally, we see different bandwidths for determining the materiality percentage. We consider it particularly important to professionally and critically determine which materiality is appropriate for the respective client at which level, and to document considerations regarding this well.

We see differences in the depth and documentation of the engagement-specific quality assessment (OKB). The work programs of some accounting firms explicitly prescribe which parts of the CSRD engagement must be assessed at a minimum. Sometimes the work programs contain examples of questions an OKB reviewer can ask the assurance team. Some accounting firms encourage an OKB reviewer to explicitly document their considerations and material discussions. We consider it important to properly document the work performed and the considerations of the OKB reviewer.

All assurance reports are based on the NBA template and contain one or more paragraphs emphasizing matters. The paragraphs used for emphasizing matters differ, also in the degree to which they are specifically tailored to the respective CSRD assurance engagement.

At most accounting firms, many work programs are prepared in MS Excel and MS Word. All accounting firms facilitate the documentation of CSRD engagements in their files. The degree of automation varies. This can involve generating relevant work steps for work that must be performed. It can also involve providing overviews for the assessment of the completeness, consistency, and suitability of the assurance plan and the outcomes of assurance work. Automation can positively influence the quality of assurance work; it can ensure more efficient execution of the steps in the assurance process. The AFM encourages accounting firms to take further steps in automation.

2.5 Implement the right mix of safeguards and ensure sufficient support for assurance teams All accounting firms have implemented an OKB (Engagement Quality Review). According to the accounting firms, an OKB reviewer must have followed a mandatory CSRD curriculum. By asking critical questions, an OKB reviewer provides – according to assurance teams – a valuable contribution to the quality of CSRD assurance. In our research, we see that in most CSRD engagements, the same OKB reviewer is used for both the CSRD engagement and the statutory audit. Teams state that the OKB reviewer can thus pay attention to the connectivity between financial reporting and the sustainability report. This is also more efficient, teams state. Where necessary, specific ESG expertise has been added to the OKB team. We encourage incorporating connectivity and adding necessary ESG expertise to the OKB function.

All accounting firms have mandatory consultations, largely based on the consultation policy of the statutory audit. We see consultations primarily in adapted assurance reports; the consultation policy contains few mandatory consultations on CSRD-specific parts. At some accounting firms, it is mandatory to consult on the engagement letter...