An audit-readiness checklist for your first ESG assurance

External assurance on ESG data is becoming standard rather than optional, and it rewards preparation. An assuror doesn't just check whether a number looks right; they test whether you can demonstrate how it was produced and controlled. Here's a practical checklist to get there — framework-agnostic, so it holds whether you report against GRI, ISSB/IFRS S1 & S2 or CBB guidelines.

1. Every number traces to its source

For each reported figure you should be able to produce the source document behind it — the bill, receipt or meter reading — without a search party. If evidence lives in inboxes disconnected from the numbers, that's the first thing to fix.

2. Factors and methods are documented

Assurors will ask which emission factor you applied and where it came from. Keep factors in a maintained library, record the method used for each calculation, and make sure the same activity is calculated the same way across every team.

3. There's a review step, not just an entry step

A figure entered by one person and never checked is a weak point. Maker/checker separation — where a second person reviews and signs off before a record locks — is precisely the control an assuror looks for.

4. Changes are logged

An immutable audit trail that records who entered a figure, who approved it and what changed is what lets you answer “has this been altered?” with evidence rather than reassurance.

5. The report maps to the framework

Keep a clear index showing which disclosure answers which requirement of the framework you're reporting against. It speeds the assuror's work and surfaces gaps before they do.

6. Numbers are internally consistent

The figure in the board pack should equal the figure in the detailed report and on the dashboard. Draw them from the same approved records and they can't quietly disagree; re-key them between systems and you'll need to reconcile.

7. You have a restatement position

Decide in advance how you'll handle a correction found after publication. A documented restatement approach signals maturity rather than panic.

Most of this comes down to one habit: treating each number as a record with evidence and accountability attached, not a value in a cell. That's the foundation Susmatic ESG is built on — role-based access, approvals and an immutable audit log behind every figure.