Does CSRD Reporting Need to Be Audited for SMEs?

No — since the Omnibus I directive (in force March 2026), no SME reports under the Corporate Sustainability Reporting Directive (CSRD), so no SME needs a CSRD audit. Only companies in CSRD scope — those with more than 1,000 employees and over €450 million net turnover — must obtain limited assurance on their sustainability reports. SMEs reporting voluntarily under the VSME Standard have no legal assurance requirement at all.

That said, many SMEs choose voluntary assurance anyway because it builds trust with clients, banks, and investors. Businesses responding to supplier questionnaires from CSRD-reporting clients increasingly find that assured data is worth more than unassured data.

This article explains how assurance works under CSRD, why SMEs are not covered, what “limited assurance” means in practice, and how to prepare your business for voluntary verification — even if you are starting with voluntary reporting under the VSME Standard (EFRAG, 2024). For who can carry out verification, see Who Can Verify My CSRD Report?

1. What CSRD Requires on Assurance

The CSRD Directive (EU 2022/2464) requires all sustainability information disclosed under the European Sustainability Reporting Standards (ESRS) to be subject to assurance — meaning it must be reviewed by an independent auditor.

This assurance requirement applies as follows:

1. Limited assurance (from the first reporting year) – Auditors confirm the data is plausible, traceable, and consistent with other information (not a full audit).
2. Reasonable assurance (possible later phase) – A transition around 2028–2030 was planned before the Omnibus I directive; the reworked assurance provisions mean this is no longer a confirmed schedule.

Auditors check:

• Whether the company applied ESRS correctly.
• If data sources and methods are documented.
• Whether key disclosures are free from material misstatements.

The goal is credibility, not perfection — the same principle that guides financial assurance.

2. Which SMEs Need to Be Audited (and When)

Since Omnibus I, none. The listed-SME reporting track was eliminated, so no SME — listed or not — has a CSRD assurance obligation.

In practice:

• SMEs using the VSME Standard can publish unaudited reports.
• Only companies with more than 1,000 employees and over €450 million net turnover need limited assurance by their statutory auditor (or another qualified assurance provider).

Even without a legal obligation, voluntary assurance can improve credibility, especially if you supply to larger CSRD-reporting companies.

3. What “Limited Assurance” Means in Practice

Limited assurance is not a full audit — it’s a reasonableness check. The auditor reviews your systems and data at a moderate level of detail.

They will:

• Review your data sources and methods (not every single number).
• Check that estimates and emission factors are logical and documented.
• Ensure internal controls exist (e.g. how data is approved).
• Verify that the report matches your financial statements.

Example expectation:

If you estimated emissions using spend-based methods and cited EEA factors, the auditor ensures the calculation is traceable and the assumptions are reasonable — not that they recalculate every factor.

Under both CSRD and VSME, the focus is on consistency, transparency, and improvement, not precision.

For more on data expectations, see How Accurate Does CSRD Data Need to Be?.

4. Who Can Perform the Audit or Assurance

Member States can allow assurance by:

• Statutory auditors (the same firm that audits financial statements), or
• Independent sustainability assurance providers accredited by national authorities.

The assurance engagement must follow ISAE 3000 (Revised) — the international standard for non-financial information assurance.

SMEs choosing voluntary assurance under the VSME Standard should ensure the provider meets basic professional independence and competence requirements.

5. How SMEs Can Prepare Now

Even if assurance isn’t mandatory yet, preparing early will save time and effort later. Key steps:

1. Document your data sources – invoices, surveys, and estimation methods.
2. Keep calculation spreadsheets traceable – include units, factors, and assumptions.
3. Assign internal data owners – clarify who validates energy, waste, or HR data.
4. Use consistent methods year to year.
5. Store evidence securely – auditors may sample files to verify traceability.

Many small and growing businesses already collect most of the needed information for client requests or certifications — assurance just formalises that process.

6. Benefits of Voluntary Assurance for SMEs

Even if not required, assurance can add real value:

• Builds trust with large customers who must report value chain data.
• Strengthens ESG credibility for banks and tenders.
• Reduces future costs if your business grows into CSRD scope or clients ask for assured data.
• Improves internal confidence in your sustainability metrics.

Voluntary assurance can be scoped — for example, verifying only GHG emissions or energy data in early years.

Frequently Asked Questions

Is external assurance mandatory for VSME reports?

No. It’s optional, but encouraged for credibility. You can still follow assurance-ready practices like keeping documentation and using reliable data sources.

What’s the difference between “limited” and “reasonable” assurance?

Limited assurance means the auditor checks for plausibility; reasonable assurance involves in-depth verification, closer to a financial audit.

Can I use my financial auditor for sustainability assurance?

Yes, if they’re accredited and qualified. Many accounting firms are expanding services to cover CSRD assurance.

What happens if my data isn’t perfect?

That’s fine. Auditors don’t expect perfection — they expect transparency and continuous improvement.

Key Terms

• Limited assurance – Moderate-level audit confirming plausibility and traceability.
• Reasonable assurance – Full verification comparable to financial auditing.
• ISAE 3000 (Revised) – International standard for non-financial information assurance.
• VSME Standard – Simplified sustainability reporting framework for SMEs.
• Material misstatement – Significant inaccuracy affecting report interpretation.

Conclusion

SMEs do not need a CSRD audit — since Omnibus I, none reports under CSRD at all. Still, assured data is increasingly valued by the large customers and banks that do report, so focus on collecting reliable, traceable data and documenting your estimation methods.

By adopting assurance-ready practices early, your small and growing business will be well prepared for voluntary verification while building trust with clients and stakeholders.

For who can carry out verification, read Who Can Verify My CSRD Report?

To help prepare your data for audit or assurance, use our checklist generator to ensure all necessary documentation is in place:

This tool will help you identify all the data points and documentation you need to collect to prepare for audit or assurance review.