Assurance on sustainability information works the same way as assurance on financial information: two levels, materially different amounts of work, and a large difference in what your systems need to support.
Understanding the distinction matters because the preparation burden falls on you, not on the practitioner, and the gap between the two levels is wider than the language suggests.
The two levels
Limited assurance produces a negative conclusion: nothing has come to our attention that causes us to believe the information is materially misstated. The practitioner performs procedures, primarily enquiry and analytical work, sufficient to reduce risk to a level that is meaningful but not low.
Reasonable assurance produces a positive opinion: the information is fairly stated in all material respects. The practitioner gathers sufficient appropriate evidence, which means testing, sampling, and an understanding of the controls that produce the data.
The wording difference looks modest. The work difference is substantial, and the difference in what your data infrastructure must support is larger still.
What each requires of you
For limited assurance, you need a documented method, an identifiable data source for each metric, and someone who can explain how the number was produced. A practitioner can work with reasonably good spreadsheets provided the logic is clear and the source data can be seen.
For reasonable assurance, you need controls: evidence that the method was applied consistently, that data was reviewed, that changes were authorised, and that the figure reported is the figure that came out of the process. Spreadsheet-based collection without version control will not support reasonable assurance, however accurate the underlying numbers happen to be.
This is the practical crux. Moving from limited to reasonable assurance is rarely about the practitioner doing more. It is about you having built a control environment around sustainability data comparable to the one around financial data.
How to decide
What is required of you? Where a regime mandates assurance, it specifies the level. Start there.
Who is asking, and what will they do with it? A large customer’s procurement process, a lender’s sustainability-linked facility, or an investor’s screening each have different tolerances. Some are satisfied by limited assurance; some price on it.
How good is your data today? If the honest answer is that your figures live in spreadsheets maintained by one person, reasonable assurance is not achievable this year at any price. Limited assurance is, and the process of obtaining it will tell you exactly what to fix.
What is the trajectory? If you expect to need reasonable assurance within three years, build for it now. Retrofitting controls onto an established reporting process is harder than designing them in.
A sensible sequence
Year one: limited assurance on a narrow scope. Pick the metrics that matter most, usually Scope 1 and 2 and perhaps one or two others. A tight scope is credible, clearly disclosed, and achievable.
Year two: widen the scope. Add the material Scope 3 categories and any social metrics that matter to your stakeholders, still at limited assurance.
Year three: build for reasonable. Formalise controls, move off manual collection for the significant metrics, and separate preparation from review with documented evidence.
The alternative, attempting reasonable assurance immediately across everything, tends to end with the scope being cut mid-engagement, which is a worse outcome than a modest scope well delivered.
The part worth internalising
Assurance does not improve your data. It reports on it. Everything that determines whether an engagement goes well happens before the practitioner arrives: whether the figure can be traced to a source, whether the method is written down, whether someone independent checked it.
Organisations that find sustainability assurance painful are almost never the ones with poor environmental performance. They are the ones who cannot demonstrate how they arrived at the number.