What is limited assurance?
Ask a senior on a review engagement what they're actually doing and you'll often hear something like "ticking and bashing the analytics, running the inquiries, writing it up." That's not wrong, but it masks the conceptual point that regulators care about. Limited assurance isn't an audit with fewer hours. It's a different engagement type with its own logic and its own evidence threshold.
ISAE 3000.12(a)(ii) defines limited assurance as a level of assurance that is meaningful but less than reasonable assurance. The practitioner reduces engagement risk to a level that is acceptable in the circumstances but higher than for a reasonable assurance engagement. The conclusion is expressed in negative form: “nothing has come to our attention that causes us to believe…”
For financial statement (FS) reviews, ISRE 2400.37 limits primary procedures to inquiry and analytical procedures. For non-financial assurance engagements under ISAE 3000, the practitioner has more flexibility in selecting procedures, but the nature and extent will be less than for reasonable assurance. ISAE 3000.A109 explains that the difference lies primarily in the nature and extent of procedures, not in their quality.
ISAE 3000.50 still requires sufficient appropriate evidence regardless of the assurance level. “Limited” describes the level of assurance conveyed to the user, not the amount of care the practitioner applies. The CSRD initially requires limited assurance on sustainability statements. The Omnibus I Directive removed the planned transition to reasonable assurance, making this distinction practically important for every firm building sustainability assurance capabilities.
Key Points
- Limited assurance is meaningful assurance. ISAE 3000.12(a)(ii) defines it as less than reasonable but still significant.
- The negative-form conclusion reflects the scope of procedures, not a lower standard of care.
- ISAE 3000.50 still requires sufficient appropriate evidence regardless of the assurance level.
- The CSRD starts with limited assurance on sustainability statements, making this the entry point for most sustainability assurance engagements.
Why it matters in practice
The most common failure is performing insufficient procedures on the assumption that the “limited” label covers the gap. Practitioners hear “limited assurance” and interpret it as “limited work.” ISAE 3000 does not support that interpretation. The evidence must still be sufficient and appropriate. What changes is the level of assurance the procedures are designed to provide, not the practitioner’s obligation to do the work properly.
A second common error is issuing limited assurance reports using positive-form language. Writing “in our opinion, the sustainability statement is prepared in accordance with ESRS” in a limited assurance report overstates the assurance provided and misleads the reader. The conclusion must use negative form: “nothing has come to our attention.”
With CSRD sustainability reporting now requiring limited assurance, the distinction between limited and reasonable assurance has moved from a theoretical concept to a daily practical question. Firms that have only performed audits need to understand that limited assurance is a different engagement type with its own logic. In our experience, the teams that struggle most are those who just cut hours from a reasonable assurance programme and call it done. That approach fails the first time an inspector opens the file.
Key standard references
- ISAE 3000.12(a)(ii) defines limited assurance as meaningful assurance that is less than reasonable assurance.
- ISAE 3000.50 requires sufficient appropriate evidence regardless of the assurance level.
- ISRE 2400.37 limits primary procedures in FS reviews to inquiry and analytical procedures.
- ISAE 3000.A109 explains the differences in nature and extent of procedures between limited and reasonable assurance.
Related terms
Related tools
Related reading
Frequently asked questions
Does 'limited' mean less work is acceptable?
No. ISAE 3000.50 still requires sufficient appropriate evidence regardless of the assurance level. 'Limited' describes the level of assurance conveyed, not the rigour of the work. A sloppy limited assurance engagement does not become acceptable because the assurance level is lower.
Is limited assurance the same as a review?
A review engagement is one type of limited assurance engagement. Limited assurance is the broader concept under ISAE 3000 that also covers non-financial engagements like CSRD sustainability assurance.