ESG engagement teams spend their fieldwork weeks tracking down where the data actually lives, whether the systems holding it have controls, and how to test disclosures that aren't standardized the way financial statements are. By the time scoping is done, the timeline is half gone and substantive testing hasn't started. This article covers the deadlines, the service lines, and the technology that make ESG engagements work.
ESG stands for environmental, social, and governance. It started as an investment framing: a way to look at companies beyond their financial statements. Over the last decade it's grown into a corporate reporting category, with public companies disclosing things like greenhouse gas emissions, workforce diversity, board governance, and supply chain practices. A growing share of those disclosures now require independent assurance, which is where audit and advisory firms come in.
ESG assurance is the same discipline as a financial audit applied to different subject matter. Instead of testing the trial balance, teams test emissions calculations, supplier certifications, and the systems behind the disclosures. The evidence sits in operational systems like utility bills, HR records, and supplier questionnaires rather than the general ledger, and the frameworks setting the rules are still being settled.
What applies to a particular client depends on where they operate, how large they are, and which jurisdictions touch their business. Three rules are shaping most of the work right now:
Assurance-ready ESG reporting is no longer optional for a meaningful slice of the client base.
Demand for ESG assurance is real, but client readiness lags. A 2024 KPMG survey found 90% of organizations planned to increase investment in ESG reporting over the following three years, with 31% planning to spend more on external assurance specifically. Only 29% of companies say they're ready for that assurance work.
That gap is the opportunity. It defines a pre-assurance advisory market: readiness assessments, controls design, metric definition, data system architecture, and internal control documentation. Firms that lead with advisory work are better positioned to capture the formal attestation mandate that follows.
Your clients face ESG compliance risks across several categories, and each one maps to a service your firm can deliver.
ESG disclosures don't yet have the kind of internal controls financial reporting has spent decades building. Companies are figuring out who owns the data, how it's reviewed, and what gets sign-off, often after the disclosures are already going out. The auditing standards for those controls are still catching up: the AICPA's Auditing Standards Board has proposed updates to attestation standards specifically for sustainability information.
California is where this is playing out first. SB 253's August 2026 deadline is creating engagement work now, while the profession is still addressing assurance standards for California's climate laws.
Controls only work if the underlying data is reliable.
ESG data lives in operational systems like utility billing, HR, supply chain platforms, and environmental monitoring tools. These systems rarely have the controls a general ledger has, which is where IT audit work earns its keep. ISACA's IT Audit Framework, ITAF 5th Edition, gives teams a current frame for evaluating governance, data lineage, and AI tools in those systems.
Even with internal controls in place, a growing share of ESG disclosures depends on data from outside the organization.
Supplier sustainability certifications, Scope 3 emissions from contract manufacturers, and value chain impact claims all need independent verification. Most clients have nothing close to assurance-ready evidence for them.
The firms winning ESG work have picked a standards baseline and are building services that match where clients actually are today.
ISSA 5000 is the practical baseline. The IAASB issued it in November 2024, effective for engagements covering periods beginning on or after December 15, 2026, with early adoption permitted. ISAE 3410, the prior greenhouse gas assurance standard, will be withdrawn the same day as ISSA 5000 absorbs that work. In the U.S., practitioners operate under existing AICPA AT-C sections, with proposed AT-C Sections 325 and 330 still moving through the standard-setting process. Methodology built to ISSA 5000's evidentiary direction will hold up as U.S. rules settle.
Firms that win this work tend to lead with advisory, then graduate clients into assurance. A workable model is to build sustainability expertise through non-assurance services and then apply that expertise to assurance work. Mid-market firms can replicate this progression without Big Four resources by starting with readiness assessments and controls advisory, then scaling into formal attestation as client maturity and firm capabilities grow.
The competency question is real. Nearly three-fourths of firms cite gathering internal resources and expertise as their biggest challenge for ESG assurance engagements. AICPA training, including sustainability assurance attestation courses and an ESG and Sustainable Financial Strategy course developed with Oxford, is available through CPA.com to help close the gap.
Most firms don't need to build ESG assurance methodology from scratch. The discipline is the same; the subject matter is what changes. The major standards-setting bodies have already extended their frameworks to ESG:
For risk advisory teams accustomed to ICFR work, the shift to emissions data, social metrics, and governance disclosures is mostly familiar territory.
Three constraints are shaping how firms scope and price ESG work today:
All three point in one direction. Only a different operating model works at scale: technology doing the procedural work, practitioners doing the judgment.
ESG engagements generate more documents and evidence than teams can handle manually. Firms that lean on technology for gathering and validation free practitioners for the judgment calls.
Three places where technology matters most on ESG engagements:
With deadlines already here, pushing the procedural work onto technology is the most practical way to close the gap between required engagements and available practitioners.
ESG engagements carry a higher administrative burden than traditional financial audits, with evidence scattered across operational, HR, environmental, and supply chain functions, and frameworks that keep shifting. Fieldguide is an end-to-end AI-native platform purpose-built for audit and advisory firms, with the engagement workflow, evidence management, and multi-framework architecture that emerging service lines need. Field Agents execute procedures across the engagement lifecycle, while practitioners review, approve, and apply professional judgment to every output. That operating model is how firms scale into new service lines without scaling headcount at the same rate. See how Fieldguide AI works in a live demo.