📦 Table of Contents

Chapter 6. ESG Assurance — ISAE 3000, AA1000, KICPA

In Chapter 5 we examined how the Governance Pillar — board independence, executive compensation, audit committees, and internal controls — supports a firm's ESG value chain. Yet a functioning governance system does not automatically guarantee that the ESG information disclosed to outside markets is trustworthy. Chapter 6 takes the next step: it describes how disclosed ESG information is verified by an independent third party so that capital markets can rely on it for investment decisions. The core standards are ISAE_3000 (Revised) and ISAE_3410 issued by the IAASB, AA1000_AS (2020) and AA1000_AP (2018) issued by AccountAbility, and the ESG verification guides published by the Korean Institute of Certified Public Accountants (KICPA) and the Korea Accounting Standards Board (KASB).

6.1 Assurance Levels — LIMITED_ASSURANCE vs REASONABLE_ASSURANCE

ESG assurance is delivered at two levels distinguished by rigour: LIMITED_ASSURANCE and REASONABLE_ASSURANCE. The distinction is codified in ISAE 3000 (Revised) §12 and §14^[1] and is the foundational construct that the International Auditing and Assurance Standards Board (IAASB) applies to every non-financial assurance engagement.

LIMITED_ASSURANCE requires the practitioner to express a conclusion in negative form — "nothing has come to our attention that causes us to believe that the subject matter is materially misstated." The procedures rely mainly on inquiry and analytical review; sampling and recalculation are optional. The work effort is roughly 30 to 50 per cent of a reasonable assurance engagement, and the DETECTION_RISK accepted by the practitioner is correspondingly higher. As of 2024, about 70 per cent of ESG reports world-wide receive assurance at this level^[2].

REASONABLE_ASSURANCE requires the practitioner to express a positive form of conclusion — "the subject matter is, in all material respects, properly prepared." It demands the same procedural rigour as a traditional financial-statement audit: sampling, recalculation, observation, external confirmation, and reperformance. The practitioner evaluates INHERENT_RISK, CONTROL_RISK, and DETECTION_RISK together so that the overall assurance risk is reduced to an acceptably low level as required by ISAE 3000. The work effort is the 100 per cent baseline and the fees are typically more than twice those of a limited engagement.

The EU Corporate Sustainability Reporting Directive (Directive 2022/2464) mandated LIMITED assurance from fiscal year 2024 and announced a phased transition to REASONABLE assurance from 2028^[3]. The US SEC Climate-Related Disclosures Rule (2024) likewise plans a step-up to reasonable assurance. ESG assurance has therefore moved decisively from a voluntary differentiator to a statutory obligation.

6.1.1 Decision matrix for assurance level

The practitioner sets MATERIALITY at the engagement-acceptance stage. Financial-statement materiality is conventionally 5 per cent of pre-tax income or 0.5–1 per cent of revenue, but ESG materiality combines a quantitative threshold and qualitative judgement in a double-materiality construct. For GHG assurance, a typical quantitative trigger is "≥5 per cent of total emissions" while a qualitative trigger might be "omission of a material business segment." The CSRD ESRS adopts double materiality explicitly, requiring evaluation along both the financial-impact axis and the social/environmental-impact axis.

6.2 ISAE 3000 (Revised, IAASB) — Umbrella standard for non-financial assurance

ISAE_3000 (Revised) — "Assurance Engagements Other Than Audits or Reviews of Historical Financial Information" — was issued by the IAASB in 2013 and became effective in 2015^[1]. It is the umbrella standard that governs all non-financial assurance: ESG, sustainability, GHG, internal control, compliance. The standard distinguishes two engagement types: ATTESTATION_ENGAGEMENT (the responsible party prepares the subject-matter information, the practitioner attests) and VERIFICATION_ENGAGEMENT (the practitioner directly measures or evaluates the subject matter).

The attestation form is dominant for sustainability reports prepared by the company itself; the verification form is common for GHG assurance under ISAE_3410 or for green-bond use-of-proceeds verification. Both forms follow the ten-step engagement workflow codified in ISAE 3000 §17 – §49:

1. Pre-engagement — independence review under the IFAC Code of Ethics, ethical fit, and assessment of management cooperation.
2. Engagement letter — written agreement covering scope, level, criteria, reporting date, and fees.
3. Planning — materiality, risk assessment, sampling design, timetable.
4. Risk assessment — identifying and quantifying INHERENT_RISK and CONTROL_RISK.
5. Evidence gathering — inquiry, analytical, sampling, recalculation, external confirmation, observation, reperformance.
6. Evidence evaluation — sufficiency and appropriateness of the evidence collected.
7. Material-misstatement evaluation — whether identified errors exceed materiality.
8. Management representation — formal written statement from the responsible party.
9. Engagement quality review — separate-partner review under ISQM 1/2.
10. Assurance report — conclusion form (positive/negative), criteria, scope, emphasis paragraphs, assurance level, signature.

ISAE 3000 §69 – §75 prescribes the eight mandatory components of the assurance report: (1) title, (2) addressee, (3) identification of subject-matter information, (4) clear separation of practitioner and responsible-party roles, (5) applicable criteria (e.g., GRI Standards 2021), (6) summary of procedures performed, (7) the practitioner's conclusion, (8) report date and signature. The Korean Institute of Certified Public Accountants (KICPA) has translated and adopted ISAE 3000 as SAE 3000 for Korean practitioners^[4], and the Korea Accounting Standards Board (KASB) maintains the Korean-language version of the standard.

6.2.1 ISAE 3410 — A specialised standard for greenhouse-gas statements

ISAE_3410 — "Assurance Engagements on Greenhouse Gas Statements" — supplements ISAE 3000 for GHG engagements^[5]. It accepts the GHG Protocol Corporate Standard and ISO 14064-1 / 14064-3 as applicable criteria and requires the practitioner to examine: (a) completeness and accuracy of activity data, (b) appropriateness of emission factors, (c) integrity of Scope 1/2/3 boundaries, and (d) appropriateness of baseline-year recalculations.

Scope 3 assurance is particularly demanding because the underlying data are highly estimated. The practitioner follows a five-step deep-dive procedure: (1) value-chain mapping against the 15 Scope 3 categories, (2) review of the data-collection method (supplier-specific, industry average, EEIO model), (3) external confirmation to a sample of suppliers, (4) review of emission factors (IPCC AR6, DEFRA, KEI national factor tables), and (5) aggregation recalculation with year-over-year comparison. ISAE 3410 also requires the practitioner to evaluate the preparer's control activities, extending assurance scope from outputs to process.

6.3 AA1000 AccountAbility Principles 2018 + AA1000 Assurance Standard 2020

The British non-profit AccountAbility, established in 1999, maintains AA1000_AP (AccountAbility Principles 2018) and AA1000_AS (Assurance Standard v3 2020), the leading stakeholder-centric standards for ESG assurance^[6]. Where ISAE 3000 represents the professional-expert view dominated by accounting firms, AA1000 represents the stakeholder view available to non-accounting consultancies, NGOs, and certification bodies.

AA1000 AccountAbility Principles 2018 codifies four principles:

• Inclusivity — stakeholders must be able to participate in decisions and reporting. The intent is decision-making influence, not mere opinion-collection.
• Materiality — both stakeholder-material and entity-material issues are identified and prioritised under double materiality.
• Responsiveness — the entity transparently discloses how it responds to the identified material issues.
• Impact — the entity measures and manages the actual social, environmental, and economic impact of its activities.

AA1000 Assurance Standard 2020 separates Type 1 (principles assurance) from Type 2 (principles + performance-information assurance). Type 1 verifies adherence to the four principles only; Type 2 additionally verifies the accuracy of disclosed performance data. The assurance levels mirror ISAE 3000 — LIMITED_ASSURANCE and REASONABLE_ASSURANCE. Practitioners must hold an AA1000 Licensed Assurance Provider (LAP) credential issued and policed by AccountAbility. As of 2024 there are roughly 280 LAPs world-wide; the Korean LAPs include Korea Productivity Center, KMR, DNV GL Korea, and Lloyd's Register Korea.

6.3.1 AA1000 vs ISAE 3000 — different approaches, combined practice

The two standards are often applied in combination. The practitioner uses ISAE 3000 to verify the quantitative accuracy of the data and AA1000 to verify the stakeholder-engagement and materiality-determination processes. About 35 per cent of the global top-100 firms use the combined model^[7] and explicitly name both standards in the assurance report. To avoid scope overlap a clear scope delineation is essential and the procedures from the two standards must be aligned on an engagement-planning matrix.

6.4 GHG Protocol Corporate Standard + Scope 1/2/3 verification

The GHG Protocol Corporate Accounting and Reporting Standard — issued in 2004 by WBCSD and WRI, with the Scope 3 Standard updated in 2024 — is the de facto global standard for corporate greenhouse-gas inventories^[8]. It is the point of departure for almost every ESG assurance engagement.

The standard classifies emission sources into Scope 1 (direct), Scope 2 (indirect — electricity, heat, steam), and Scope 3 (other indirect — value chain). Scope 3 is further divided into 15 categories; categories 1 (purchased goods and services), 11 (use of sold products), and 4 (upstream transportation) typically account for 70 to 90 per cent of total emissions in most companies.

6.4.1 Scope-by-scope assurance procedures

1. Scope 1 assurance — fossil-fuel consumption (purchase invoices, meter readings), process emissions (cement, steel), mobile combustion (mileage, fuel economy), fugitive emissions (refrigerants, SF6). Appropriateness of IPCC AR6 default factors or the Korean Environment Institute (KEI) national factors is confirmed.
2. Scope 2 assurance — electricity, heat, steam consumption (utility bills). Both Location-based (national average factor) and Market-based (RECs, PPAs, direct contracts) methods are reviewed. RE100 members receive a separate verification of their renewable share under the Market-based method.
3. Scope 3 assurance — determination of applicable categories among the 15 → verification of data sources (primary data, industry average, EEIO model) → external confirmation with sample suppliers → aggregation recalculation. ISAE 3410 provides explicit Scope 3 guidance.

The 2024 update of the GHG Protocol Scope 3 Standard introduced (a) a Data Quality Pedigree Matrix, (b) a mandatory value-chain mapping requirement, and (c) category-level quantitative threshold guidance. CDP, the Science Based Targets initiative (SBTi), CSRD ESRS E1, and IFRS S2 all adopt the GHG Protocol as their applicable criterion, consolidating its position as the single global GHG standard.

In Korea, the Ministry of Environment's "Guideline for the GHG and Energy Target Management System" (2024 revision) mandates a GHG-Protocol-aligned accounting method. The Korea Environment Corporation maintains the "National GHG Inventory Calculation Guideline" (2024) that integrates IPCC AR6 and KEI factors. The Ministry of Trade, Industry and Energy and the Ministry of Environment jointly operate "K-ETS (K-Emissions Trading Scheme) emission verification," which is conducted on the basis of KS_Q_ISO_14064_3 (the Korean adoption of ISO 14064-3) and performed by Validation and Verification Bodies accredited by the Korea Accreditation Board (KAB).

6.5 Big-4 (Deloitte, EY, KPMG, PwC) + Korean accounting firms ESG Assurance

The global ESG assurance market is effectively dominated by the BIG_4 accounting firms — Deloitte, EY, KPMG, PwC — which together hold approximately 65 per cent of the market^[9]. About 79 per cent of S&P Global 500 companies receive ESG assurance from one of the Big-4; the remainder is divided among DNV, LRQA, Bureau Veritas, SGS, and other certification bodies.

6.5.1 The Korean Big-4 ESG Assurance Service

All Big-4 member firms operate in Korea with dedicated ESG Assurance practices:

• Samjong KPMG — pioneered ESG assurance in Korea in 2003. Applies the "KPMG ESG Assurance Methodology" for both LIMITED and REASONABLE engagements. About 38 of the top-200 KOSPI companies are Samjong KPMG ESG clients as of 2024.
• Samil PwC — operates a "Sustainability Assurance Center of Excellence" specialised in IFRS S1/S2 assurance. Publishes the Korean implementation guide of PwC global's ESG Reporting Framework. Domestic share approximately 22 per cent.
• EY Hanyoung — runs the Korean office of "EY Climate Change and Sustainability Services (CCaSS)" with strengths in ISAE 3410 GHG assurance. Domestic share approximately 18 per cent.
• Deloitte Anjin — operates "Deloitte ESG Services" focused on financial-services and manufacturing assurance. Domestic share approximately 15 per cent.

Mid-sized accounting firms — Jeongdong Accounting Corporation, Shinhan Accounting Corporation, Woori Accounting Corporation, Ichon Accounting Corporation — are entering the ESG assurance market and increasing their share in the KOSDAQ and mid-cap segments. The Korean Institute of Certified Public Accountants (KICPA) issued the "ESG Information Assurance Engagement Guide" in 2023 and revised it in 2024^[4] to standardise ESG assurance methodology across its member firms.

6.5.2 Non-accounting certification bodies

Outside the accounting profession, ESG assurance is provided by global certification bodies such as DNV (Det Norske Veritas), LRQA (Lloyd's Register), SGS, Bureau Veritas, TÜV Rheinland, and BSI. They primarily operate as AA1000 LAPs and excel in ISO-based assurance — ISO 14064-3 for GHG, ISO 14001 for environmental management, ISO 26000 for social responsibility. In Korea, the active certification bodies include Korea Productivity Center (KPC), Korea Management Registrar (KMR), DNV Business Assurance Korea, LRQA Korea, SGS Korea, and Bureau Veritas Korea. They differentiate themselves through on-site verification and supply-chain due diligence — areas where accounting firms struggle to compete.

6.6 Mandatory assurance era — EU CSRD ESRS + IFRS S2 + K-ESG disclosure

From 2024 onward, ESG assurance has entered the statutory-mandate phase across global capital markets. This section reviews the three mandatory regimes — EU CSRD, IFRS S2, K-ESG — and the response scenario for Korean issuers.

6.6.1 EU CSRD (Directive 2022/2464) — ESRS assurance requirements

The EU CSRD applies to approximately 50,000 EU-domiciled companies and to non-EU companies with EU operations whose consolidated EU turnover exceeds €150 million^[3]. The applicable disclosure standard is the European Sustainability Reporting Standards (ESRS) issued by EFRAG. Assurance is phased in as follows:

• Fiscal year 2024 (reporting 2025) — LIMITED_ASSURANCE mandatory for large listed companies (≥500 employees).
• Fiscal year 2026 (reporting 2027) — extended to all large companies (≥250 employees).
• Fiscal year 2028 (reporting 2029) — phased step-up to REASONABLE_ASSURANCE.

Among large Korean firms, those with EU subsidiaries or EU turnover above €150 million — approximately 50 issuers including Samsung Electronics, LG Electronics, Hyundai Motor, Kia, SK Hynix, POSCO, LG Chem, and Samsung SDI — are directly in scope. These groups must restructure their consolidated Korean ESG report into ESRS-aligned form and obtain assurance either from an EU-registered Approved Assurance Provider or from the EU member firm of a Korean practitioner.

6.6.2 IFRS S1/S2 (ISSB) + Assurance Guidance 2024

The International Sustainability Standards Board (ISSB) issued IFRS_S1 "General Requirements for Disclosure of Sustainability-related Financial Information" and IFRS_S2 "Climate-related Disclosures" in June 2023^[10], defining the global standard for decision-useful ESG information for investors. The standards adopt the four-pillar TCFD architecture (governance, strategy, risk management, metrics & targets) and became effective on 1 January 2024.

Korea, in cooperation with the ISSB, published KASB_S1 and KASB_S2 — the Korean-language adoption of IFRS S1/S2 — through the Korea Accounting Standards Board (KASB) in April 2024. The Financial Services Commission (FSC) announced the "ESG Disclosure Mandate Roadmap 2024-2030"^[11] with the following schedule:

• 2026 — mandatory disclosure under KASB_S1/S2 plus LIMITED assurance for KOSPI-listed firms with assets ≥ KRW 2 trillion.
• 2027 — extended to firms with assets ≥ KRW 1 trillion.
• 2029 — extended to firms with assets ≥ KRW 500 billion; phased introduction of REASONABLE assurance.
• 2030 — all KOSPI-listed firms in scope; REASONABLE assurance mandatory.

6.6.3 K-ESG Guidelines — joint MOTIE / MOE framework

The K-ESG Guidelines, first published in 2021 and revised in 2024 jointly by the Ministry of Trade, Industry and Energy (MOTIE) and the Ministry of Environment (MOE), support Korean firms in self-diagnosing and voluntarily disclosing ESG performance. The guideline structures 61 indicators across four areas (disclosure, environmental, social, governance) and primarily targets mid-cap and SME firms with assets below KRW 1 trillion. K-ESG assurance is provided by the Korea Productivity Center (KPC) and Korea Management Registrar (KMR) at LIMITED level through the "K-ESG Verification System."

6.7 Practical engagement checklist — Korean KOSPI-listed firm response

This section presents a ten-step practical checklist for a KOSPI-listed firm with assets above KRW 2 trillion preparing for the first mandatory KASB_S1/S2 disclosure year in 2026. The list distils the joint guide "ESG Assurance Preparation Guide 2024" published collectively by KICPA, Samjong KPMG, Samil PwC, EY Hanyoung, and Deloitte Anjin.

1. Governance review (H1 2025) — establish a board-level ESG committee or expand the audit committee. Document the board reporting line. Meet KASB_S1 governance-disclosure requirements.
2. Materiality assessment (H1 2025) — run a double-materiality workshop. Map stakeholders, prioritise topics, produce a materiality matrix.
3. Data-collection infrastructure (H2 2025) — deploy an IT system for Scope 1/2/3 data. Integrate with ERP, EHS, HRM. Self-assess data quality against the GHG Protocol Data Quality Pedigree Matrix.
4. Internal controls (H2 2025) — design data-entry, approval, recording, and reporting controls equivalent to SOX-grade financial controls.
5. Practitioner appointment (Q4 2025) — appoint a KICPA-registered ESG practitioner or an AA1000 LAP. Independence review. Sign engagement letter.
6. Preliminary assessment (Q1 2026) — pre-engagement phase. Preliminary evaluation of INHERENT_RISK and CONTROL_RISK. Agree on materiality.
7. Fieldwork (Q2 2026) — sampling, recalculation, external confirmation, observation, reperformance. Communicate findings to management.
8. Draft assurance report (end Q2 2026) — decide conclusion form (positive/negative), emphasis-of-matter paragraphs, other matters.
9. Disclosure (Q2 2026) — release KASB_S1/S2 disclosure either as a separate annex to the annual report or as an integrated report. Attach the assurance report.
10. Supervisory response (H2 2026) — respond to Financial Supervisory Service sample inspections. If a corrective disclosure becomes necessary, coordinate with the practitioner.

6.8 Conclusion — assurance is capital-market trust infrastructure

This chapter traversed the full landscape of ESG assurance — ISAE 3000, ISAE 3410, AA1000, KICPA, KASB, GHG Protocol, CSRD ESRS, IFRS S1/S2, K-ESG. Two key insights emerge.

First, ESG assurance has completed its transition from "voluntary differentiation" to "statutory obligation." The EU CSRD, the SEC Climate Rule, and the K-ESG roadmap will entrench LIMITED and then REASONABLE assurance as mandatory across 2024 – 2030. Korean firms that fall behind will find their access to EU and US markets restricted.

Second, the essence of ESG assurance is the capital-market trust infrastructure. Unassured ESG information is never free of greenwashing suspicion; investors will not allocate capital to such information. Assurance is therefore not a regulatory cost but a direct determinant of firm value — specifically the ESG cost of capital. Empirical studies report that a one-notch downgrade in MSCI ESG rating (MSCI_AAA → MSCI_BBB) raises the cost of capital by about 12 bps on average, while the adoption of REASONABLE assurance is associated with an 18 – 25 bps reduction^[7].

The message for Korean firms is clear: "2026 is year one." Firms that have not completed the four-axis preparation — governance, data, controls, practitioner appointment — by 2025 risk receiving a disclaimer or qualified opinion in the first mandatory year. KICPA, KASB, and the FSC are vigorously running guides, training, and pilot programmes to support this transition, and Korea's capital market has every chance to emerge as an exemplary case in the global ESG-disclosure architecture. Chapter 7 will examine how the assured ESG information actually flows into capital-market decisions through green bonds, sustainability-linked loans, and impact investing.

弘益人間 (Hongik Ingan) — Benefit All Humanity