Ready for limited assurance

As many companies are already aware, sustainability reports covering the 2026 reporting period, which will be published in 2027, will once again need to be prepared under the ISSB Standards in Mexico. This time, however, the sustainability information will need to be subject, at a minimum, to limited assurance performed by an external auditor. In subsequent reporting periods, the requirement will advance toward reasonable assurance, a topic we will address in greater detail in future publications.

Building the systems, processes, and controls required to successfully undergo an assurance review is not something that can be achieved overnight. It is therefore important to begin preparing now and to understand what the process involves, which gaps are most common, and what actions need to be implemented.

What does limited assurance mean?

 Limited assurance involves a review of the processes, controls, and frameworks used to generate and manage the reported information. Its purpose is to increase confidence in sustainability data, although it provides a lower level of assurance than reasonable assurance.

Unlike a traditional financial audit, the auditor does not issue a positive opinion on the information. Instead, the auditor provides a conclusion expressed in negative form, stating that, based on the procedures performed, nothing has come to their attention that would lead them to believe that the information contains material misstatements.

This does not mean that the review is superficial. The auditor may request evidence regarding data sources, the individuals responsible for each data point, calculation methodologies, validation controls, and the documentation supporting the reported figures.

Why are many companies falling behind?

 Although there are still several months before companies will be required to undergo this assurance process, significant bottlenecks are already common in practice. Some of the most frequent gaps include information being dispersed across different departments without clear oversight of who manages each data point or how it is handled; a lack of data traceability; the absence of controls for updating and validating information; and processes that depend on the knowledge of a single individual or are not properly documented.

These types of weaknesses are often among the first issues identified by an auditor and, at the same time, among the most time-consuming to address. The main risk of starting late is not only missing a deadline, but discovering too close to the publication date that the information lacks sufficient supporting evidence to undergo assurance.

What should you do today to prepare on time?

 1. Define information governance. Identify the department and individual responsible for generating, reviewing, approving, and retaining each sustainability data point.

2. Conduct a gap assessment. Evaluate which metrics already have adequate processes and controls, which require adjustments, and which still cannot be traced back to their original source.

3. Document data traceability. Record the information sources, calculation methodologies, assumptions, estimation criteria, reporting periods, and individuals responsible for each indicator.

4. Formalize internal controls. Establish review and approval procedures, reconciliations, validation checklists, change controls, and mechanisms for correcting errors.

5. Align the relevant departments. Maintain ongoing coordination among Sustainability, Finance, Internal Audit, Human Resources, Operations, Legal, and all other teams involved in generating information.

6. Organize supporting evidence. Create a centralized and well-structured repository that demonstrates how each figure was obtained and facilitates access to invoices, reports, databases, approvals, and other supporting documentation.

Preparation for assurance should not begin once the report has already been drafted. It should be embedded from the moment the information is collected, calculated, and validated. Companies that begin today will be better positioned to reach 2027 with robust processes, sufficient supporting evidence, and fewer last-minute adjustments.

I hope you found this interesting. As usual, if there is anything we can help you with, or if there is an ESG topic you would like to know more about, please let us know.

Best,

Marimar

CEO, Miranda ESG