What ISSA 5000 Will Actually Test, and How to Use the Time Before 2028

Most teams will meet their sustainability assurer for the first time with figures that have never been tested. That is where the surprises happen.

ISSA 5000, the IAASB's standard for sustainability assurance, applies to assurance of sustainability information for periods beginning on or after 15 December 2026. In Malaysia, the Securities Commission has named it the sole recognised standard for independent assurance under the National Sustainability Reporting Framework, and ISAE 3000 (Revised) and ISO standards are no longer recommended for this purpose.

For preparers, the deadline matters less than a more practical question: what will an ISSA 5000 engagement actually look at, and how much of that can you fix before it starts?

When Assurance Arrives

Phasing in Malaysia follows the NSRF groups announced by the Advisory Committee on Sustainability Reporting.

The Six Questions an Assurer Will Ask

ISSA 5000 is a principles-based standard, but in practice an engagement on greenhouse gas figures comes down to six questions. If your team can answer them for every material number, the engagement goes smoothly. If it cannot, the gaps appear in the assurer's findings rather than in your own review.

• Source: where did each figure come from? The assurer will want to trace a sample of figures back to invoices, meter readings and supplier records.
• Ownership: who owns the figure at each site and legal entity? A number with no owner is a number nobody can explain.
• Method: how was it calculated, and was the same method and emission factor applied consistently across sites and years?
• Review: who reviewed and approved it before it reached the report, and is there a record of that review?
• Assumptions: where estimates were used, are the assumptions documented and reasonable?
• Reproducibility: could someone else rebuild the number from the evidence and get the same answer?

Assurance tests the trail behind a number, not just the number.

Where Teams Get Caught Out

In our work with listed companies, the risk is rarely the figures themselves. It is the trail behind them. When someone asks who approved an emission factor or where a meter reading came from, the answer often sits in one person's inbox or in a spreadsheet that has been overwritten since.

Those are not data problems that a new tool solves on its own. They are ownership, method and evidence problems, and they take time to fix because they involve people across finance, operations and sustainability.

How to Use the Time Before Your First Assured Period

For Malaysian Group 1 companies, 2028 is the first assured year, which makes the current and next reporting cycles the practical window to prepare. Other groups and markets have a little longer, but the steps are the same:

• Scope it: confirm which metrics will be assured first, starting with Scope 1 and 2, and which entities and sites are material.
• Trace a sample: walk a handful of figures back to source documents, exactly as an assurer would, and record where the trail breaks.
• Fix the controls: name an owner for every metric, document methods and emission factors, and introduce a recorded review and sign-off.
• Run a dry run: report one full cycle under the new controls before the assured year, so the first real engagement is not the first test.
• Brief the board: share the gaps, the owners and the timetable, so assurance readiness is governed rather than left to one team.

This is the approach behind the ESG Disclose ISSA 5000 Readiness Review, which typically takes three to four weeks and produces a readiness scorecard, a gap register with an owner for every gap, and a roadmap to the first assured period. A readiness review is not an assurance engagement, and it is independent of your assurer.

If your assurer asked you to rebuild one Scope 2 figure from source evidence tomorrow, how long would it take your team?

Sources: IAASB, ISSA 5000 General Requirements for Sustainability Assurance Engagements; Securities Commission Malaysia and the Advisory Committee on Sustainability Reporting, announcement of 17 September 2026; AUASB, ASSA 5000. Status as at October 2026.