CSRD in practice: 5 steps to assurance-ready reporting

Directive (EU) 2026/470 has narrowed the scope of companies required to comply with the CSRD, but those that remain within its scope — and those opting for voluntary reporting under the VSME framework — need a defensible process, not just a well-written report. Here are the five steps to prepare your organisation for independent verification (limited assurance).

A new, more restrictive regulatory framework

Since Directive (EU) 2026/470, which has been in force since 18 March 2026, the mandatory scope of the CSRD has been significantly reduced: broadly speaking, only companies or groups that simultaneously exceed 1,000 employees and €450 million in annual net turnover are now covered. Member States have until 19 March 2027 to transpose the Directive. At the same time, the Commission further simplified the ESRS on 3 July 2026, with application scheduled for the 2027 financial year (optional use already permitted in 2026).

In practice, this means two things: fewer companies are subject to the CSRD, but those that fall within its scope face the same core requirement — a sustainability report subject to independent external verification (limited assurance). And those outside the scope are not left without demand for ESG reporting: banks, investors and customers continue to request information, now primarily through the voluntary VSME reporting framework.

The role of iCompliance — and what we don’t do

iCompliance supports the organisation throughout virtually the entire preparation process: assessing applicability, dual materiality, mapping data to the ESRS, designing controls and evidence, and preparing for the external audit. We do not issue the independent assurance opinion — that is the responsibility of a ROC or another legally authorised assurance service provider. Our role is to prepare the organisation so that this audit runs smoothly, first time round.

Step 1 — Check whether the CSRD applies, and from when

Identify the entity or consolidation group, the number of employees, the turnover and the financial year to which the new criteria apply (1,000 employees + €450M). Also check the national transposing legislation, which may contain transitional rules for companies already in the process of preparing for the changes.

Step 2 — Carry out the dual materiality assessment

Map stakeholders, impacts, risks and opportunities (IROs); assess impact materiality and financial materiality separately; document criteria, thresholds and decisions. Dual materiality remains the central pillar of the revised ESRS and determines which disclosures are actually required.

Step 3 — Map the material topics to the ESRS requirements and data

Translate the results of the materiality assessment into specific disclosure requirements: identify the relevant data points, the data owners, the sources, the calculation methodologies and any existing information gaps.

Step 4 — Establish controls, documentation and an audit trail

This is the key differentiating factor: a repository of evidence, clear responsibilities (RACI), documented calculation methodologies, formal approvals, version control and validation by management. The aim is not simply to ‘write an ESG report’, but to build a reporting system that can stand up to scrutiny by an external auditor.

Step 5 — Prepare for the independent review (limited assurance)

Before the ROC or assurance provider arrives: carry out a dry run, review the evidence, check for consistency between sections of the report, address any gaps identified and obtain formal validation from management regarding the completeness of the disclosures. It is this preparatory work — not the report itself — that determines whether the audit proceeds smoothly.

Outside the scope of the CSRD? VSME is the way forward

Being outside the mandatory scope does not remove the pressure to report on ESG — particularly from banks, investors and clients in the value chain. The voluntary VSME standard, adopted by the Commission in 2026, was designed specifically for SMEs and companies outside the mandatory scope, with requirements proportionate to their size.

Assess your readiness for the CSRD

A 30-minute discussion to confirm the scope, identify gaps and set out the next steps leading up to the independent audit.

From risk registration to resilience with ISO 31000

VSME explained: a practical guide for SMEs

Frequently Asked Questions

Common questions about the CSRD and independent review

To whom does the CSRD currently apply?

Under Directive (EU) 2026/470, this generally applies only to companies or groups with more than 1,000 employees and an annual turnover of more than €450 million. National transposition by 19 March 2027.

Does iCompliance issue an assurance opinion?

No. We prepare the scope, dual materiality, data, controls and evidence; the independent limited assurance opinion is issued by a registered auditor or an authorised assurance provider.

What if my company is not subject to the CSRD?

You can opt for the VSME voluntary reporting scheme, which is increasingly sought after by banks, investors and customers throughout the value chain.

Build resilience. Make better decisions.

Let’s assess your priorities and draw up a practical plan — together.