ISSA 5000 readiness, figure by figure: every number an assurer will test, traced and fixed before fieldwork
Every figure an assurer will test, traced and fixed before fieldwork starts.
See one case, screen by screen ↓ESG Data Assurance Readiness traces every reported ESG figure to its source evidence and controls for ISSA 5000 assurance. Seven agents trace each figure through five layers, test controls, re-perform samples, collect evidence and write the findings an assurer would likely raise. The ESG Controller decides each finding, approves verified fixes and signs readiness with Internal Audit before fieldwork.
How to choose AI solutions for back-office and enterprise work →
Updated
From periods beginning on or after 15 December 2026, ISSA 5000 assurers look past the printed total to the reporting process, the systems and the controls behind each sustainability figure. They ask how a number was calculated, which system it came from, which control checked it and what evidence proves it. Most groups still prepare with spreadsheets and email, and the tie-out a week before publication stops at the workbook.
So the weak spots surface in fieldwork. A December estimate that was never replaced by the invoice, a monthly review done but never signed by the reviewer, evidence chased request by request across sites and owners. The findings arrive weeks before publication, when correcting a figure means a restated table under deadline, and a control without a signature cannot be relied on for the quarter.
Estimated split for preparing one year's sustainability statement for limited assurance, by hand and with the solution.
Seven agents trace, sample, test and write the findings an assurer would raise, and check each other; the ESG Controller decides and signs with Internal Audit.
Kestrel & Vane Group's FY2026 sustainability statement is in draft. Ashby Quill Assurance starts limited-assurance fieldwork in 21 days, applying ISSA 5000 early as agreed in the engagement letter. Here is Monday 1 February, screen by screen, in the working solution.
Readiness is 87%: 127 of 146 figures ready, 14 weak, 5 gaps, up 3 points since 25 January against a target of 95% by 19 February. In the overnight thread the Tracer reports that it re-traced 41 figures on 6 statement pages and one changed: Scope 2 location-based, 48,210 tCO2e, is now weak at the source. Five items need her, from two new likely findings to an expired HR system connection.
“Next: Scope 2 location-based is weak at the source. The agents traced it, re-checked 25 site-months and drafted two fixes.”
She works from page 41 as it will be published, E1-6 Gross Scopes 1, 2, 3 and total GHG emissions, with every figure marked Ready, Weak or Gap. Clicking 48,210 opens its five layers: the figure ties out, the Scope 2 workbook v7 re-computes, and the source system is the first weak layer. 741 of 744 site-months come from invoices or meter reads; three December values are estimates whose invoices arrived after the 10 January cut-off.
Tracer · confidence 96% — read-only on every system, it never changes a reported figure.
She asks under the figure, in plain words. The Tracer answers with the three sites and their numbers: Ostrava plant 1,840 MWh against an invoice of 2,112, Monterrey DC 1,210 against 1,166, Pune service centre 960 against 1,128. Each value carries a numbered citation that opens the passage it was read from. Above it, the Mock assurer's two proposed fixes wait for her decision.
“All three invoices arrived after the 10 January cut-off.”
Run RN-0412 took 14 minutes. Each agent shows its plan, what it read, how sure it is and who it handed to. The Tracer read the statement, the workbook, the grid factor set and the three sites' energy records in 2 min 40 s, then handed the control and evidence layers to the Sampler and the Control tester.
“Agents read only; people decide.”
From a population of 744 site-months and 117,450 MWh, the Sampler picked 22 items by MWh-weighted random selection and added the 3 estimates as targeted items, the sample size Ashby Quill used last year. The 22 agree within 1%. The 3 targeted items differ by +272, −44 and +168 MWh: +396 MWh, or +223 tCO2e, 0.46% of the figure.
It reports every difference, however small, and never replaces the assurer's own sampling.
EN-C04 says the regional reviewer signs each monthly meter and invoice review within 10 working days. The Control tester followed one site end to end, then inspected every Q4 instance: October and November are signed by Tomasz Wilk. For December the 62 site reviews were done, but no reviewer sign-off is recorded. Design effective; operating effectiveness deficient for December.
Control tester · confidence 94% — it proposes the conclusion; Internal Audit confirms it.
F-01, a misstatement: December estimates at 3 sites were not replaced by invoices, +223 tCO2e, below performance materiality of 5% but a step the assurer will test. F-02, a control deficiency: EN-C04 has no reviewer sign-off for December. Each carries its basis, the figures it touches, its confidence and the likely outcome. Ingrid can accept, edit or dismiss each one with a reason.
F-01: “Likely raised as a misstatement the assurer asks you to correct; not a modified conclusion.”
X-9, replace the December estimates with invoices at Ostrava, Monterrey and Pune, goes to Mateo Lindqvist, due 5 February. X-10, record the December EN-C04 reviewer sign-off with evidence, goes to Tomasz Wilk, due 4 February. Before she confirms she sees what they are worth: 6 figures ready, readiness 87% → 91%. The Evidence collector notifies both owners.
“The agents re-run the trace and the sample when each owner marks the fix done.”
In the assurer room the Assurer liaison has assembled a pack for each of Ashby Quill's 18 requests: 12 released, AQ-07 waiting on X-9 and X-10. Ingrid previews AQ-11, water withdrawal by site with meter evidence: five documents, each read from its source and fingerprinted. She releases it to Ashby Quill read-only.
“Read-only for the assurer · every view is logged.”
The Readiness scorer checks the conditions: every likely finding accepted or dismissed, every figure in scope traced through five layers, and readiness at 95% or a reason code on each remaining exception. Nineteen figures are not yet ready, each with its finding and a fix due before 22 February. Once each has a reason code, Ingrid signs as ESG Controller and Priya Raman as Internal Audit Lead.
Signature meaning: “Ready for limited assurance fieldwork, exceptions recorded.”
The same statement, seen by four of the people who carry it into fieldwork — what the weeks before looked like, and what they look like now.
Seven agents trace, sample, test and write the findings an assurer would raise, and check each other; the ESG Controller decides and signs with Internal Audit.
Builds the path of every reported figure: statement, calculation, source system, control and evidence. It re-computes the workbook from its inputs, reads every input in its system of record and marks the first weak layer, with a confidence and the source passage for each.
Tests control design by walkthrough and operating effectiveness by inspecting real instances, the way an ISSA 5000 assurer would.
Picks a risk-weighted sample from each figure's population and re-performs every item against its source document.
Asks each owner for the exact document, reminds them, and checks that what comes back is for the right site, period and amount.
Writes the findings an ISSA 5000 assurer would probably raise: the basis, the evidence, the effect against materiality and the likely outcome, with a drafted fix for each.
Computes readiness, explains every movement, projects the effect of each fix before anyone accepts it, and checks the sign-off conditions.
Assembles an evidence pack for each of the assurer's requests from cited sources, and drafts answers to the assurer's questions from the record.
Decide and sign. The agents propose; a named person decides.
Ask in plain words on any screen. The agents answer with citations to the passage they read, and act on what you ask — nothing is sent without you.
Why is Scope 2 location-based weak?
The figure itself ties out: 48,210 tCO2e on page 41 matches the workbook. The weakness is the source: Ostrava, Monterrey and Pune kept a December estimate after the invoices arrived, and the invoices show 396 MWh more. That is +223 tCO2e (0.46%). December's EN-C04 review also has no reviewer sign-off.
What would Ashby Quill find if fieldwork started today?
The Mock assurer expects 10 findings: 3 misstatements, 3 control deficiencies, 2 evidence gaps and 2 method points. None is above performance materiality of 5% per metric. The largest is F-05: 4,500 tCO2e of credits with no retirement record. The most likely to change the conclusion's wording is F-04, the unapproved category 11 method.
Remind every owner with an overdue evidence request
Two requests are overdue: ER-0388 contractor hours (Ravi Shah, 3 days) and ER-0385 Halden HR export (Grace Mbeki, 2 days). I selected both and drafted the reminders. Press Send to send them; nothing goes out without you.
Draft our answer to Nadia's question on December estimates
Nadia asked how December estimates are replaced by actuals and who checks it. The close calendar says estimates are replaced before the statement is final, but three were not. I drafted a plain answer that says so, names fixes X-9 and X-10, and promises AQ-07 with all 25 sampled invoices. It is in the assurer room for you to edit and send.
13 screens from the working solution, on its sample data. Pick one to see it large.
Materiality, sampling and the rules that mark a layer weak are settings. Saved changes apply from the next run and are logged.
| Setting | Default | Choose from |
|---|---|---|
| Performance materiality per figure | 5% | From the engagement letter; any value |
| Clearly trivial | 0.2% | Differences below it are listed, not raised |
| Readiness target | 95% | Sign-off without reason codes needs this |
| Agent confidence for a person to review | 80% | Below it, a person reviews before it counts |
| Sample size per high-risk figure | 25 items | Last year's assurer sample size, or your own |
| Framework and assurance level | ESRS (CSRD) · limited | ESRS (CSRD) · ISSB IFRS S1/S2 · GHG Protocol only — limited or reasonable |
| An estimate still used 20 days after period end | Source layer is Weak | On · Off |
| A sample difference above clearly trivial | Off | On: the Sampler widens the sample by 10 items · Off |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, measured in the live solution · “estimated” = our estimate · “typical” = published figures (IAASB, ISSA 5000 — effective for periods beginning on or after 15 December 2026; IFAC, State of Play in Sustainability Assurance, 2024 data — 75% of large companies obtain some assurance; Accountancy Europe CSRD practice forum, 2026 — sustainability controls less robust than financial reporting). People, companies, sites and systems named on this page are fictional — characters and sample data in the working solution.
ESG Data Assurance Readiness traces every reported ESG figure to its source evidence and controls for ISSA 5000 assurance. Seven agents trace each figure through five layers, test controls, re-perform samples, collect evidence and write the findings an assurer would likely raise. The ESG Controller decides each finding, approves verified fixes and signs readiness with Internal Audit before fieldwork.
ISSA 5000 applies to assurance on periods beginning on or after 15 December 2026, and its assurers look at the reporting process, systems and controls behind each figure, not only the printed total. Being ready means each figure in scope can be followed from the statement to its calculation, source system, control and evidence, with the weak points fixed before fieldwork starts.
The Tracer finds the figure's calculation, re-computes it from its inputs, reads every input in its system of record read-only, and links the control and the evidence. Each of the five layers gets a status, a confidence and the source passage, and the first weak layer is marked — for example, three December site-months still on estimates.
No. The agents prepare you the way an assurer would test you. The Sampler never replaces the assurer's own sampling, and the Mock assurer never contacts the real assurer; it writes the findings it expects, with its confidence, for the ESG Controller to accept or dismiss.
Only the evidence packs the ESG Controller releases, read-only. The Assurer liaison assembles each pack from cited sources and drafts answers to the assurer's questions, which the Controller edits and sends. Every release and every view is logged.
Yes. The agents read, draft and propose; they never approve. The ESG Controller accepts, edits or dismisses each finding with a reason code, approves a fix only after the agents verify it, and signs readiness with the Internal Audit Lead. Below 80% confidence, a person reviews before anything counts.
The scope is set in Settings: ESRS (CSRD), ISSB IFRS S1/S2 or GHG Protocol only, for limited or reasonable assurance. Performance materiality, clearly trivial, sample size and the readiness target come from your engagement letter and are settings too.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your draft statement, calculation workbooks, control register and engagement letter — and it goes live once every quality gate has passed. We will walk you through it on your own statement first.
Every shipment cleared for the EU with a statement no deforested plot can reach.
1-min demoCBAM ReportingReal supplier data, not punitive defaults: a lower certificate bill, every number cited.
1-min demoESG ReportingOne cited dataset for CSRD, ISSB, lenders and investors, checked before anyone signs.
1-min demoWe'll run ESG Data Assurance Readiness on your own draft statement, its workbooks and the systems behind them.