Skip to main content
Governance Authority
Category: Sustainability and ESG

Reasonable and Limited Assurance

Also known as: Reasonable Assurance, Limited Assurance, Levels of Assurance
Simply put

Reasonable and limited assurance are two different levels of confidence a practitioner can provide over reported information, such as sustainability or ESG data. Reasonable assurance offers a high (though not absolute) level of confidence, similar to a financial statement audit, and is based on more rigorous procedures. Limited assurance offers a lower level of confidence based on a less extensive review, and its conclusion is typically expressed in a negative form.

Formal definition

Reasonable and limited assurance denote two distinct engagement levels under assurance standards. Reasonable assurance provides a high but not absolute level of assurance, requiring more extensive and rigorous evidence-gathering procedures, and results in a positively worded conclusion or opinion, described in the evidence as broadly equivalent to a financial statement audit opinion. Limited assurance provides a lower level of assurance based on a comparatively high-level review of data and fewer procedures, and results in a negatively worded conclusion, in which the practitioner typically states that nothing has come to their attention causing them to believe the reported information is materially misstated. In the context of the evidence, these levels are applied to ESG and sustainability reporting; the specific procedures, thresholds, and applicable standards depend on the engagement, framework, and jurisdiction, and this entry is educational rather than audit, legal, or compliance advice.

Why it matters

The distinction between reasonable and limited assurance directly shapes how much confidence stakeholders can place in reported information, particularly for ESG and sustainability data. Reasonable assurance provides a high, though not absolute, level of confidence, in many ways broadly equivalent to a financial statement audit opinion, while limited assurance rests on a comparatively high-level review with fewer procedures. Because these two levels are not interchangeable, treating a limited assurance conclusion as though it carried the weight of a reasonable assurance opinion can lead boards, investors, and regulators to overestimate the reliability of the underlying information.

The difference is not merely technical. A limited assurance conclusion is typically expressed in negative form, the practitioner states that nothing has come to their attention suggesting the information is materially misstated, whereas a reasonable assurance conclusion is worded positively as an affirmative opinion. Stakeholders reading a report may not appreciate this distinction, creating a gap between the confidence they believe they are receiving and the confidence the engagement actually provides. Governance professionals and those charged with oversight of reporting have an interest in ensuring that the assurance level obtained is understood and communicated clearly.

The specific procedures, thresholds, and applicable standards vary by engagement, framework, and jurisdiction, and the appropriate level of assurance depends on the entity's circumstances, stakeholder expectations, and any applicable requirements. This entry is educational and does not constitute audit, legal, or compliance advice; decisions about assurance scope and level warrant input from qualified practitioners.

Who it's relevant to

Boards and Audit or Sustainability Committees
Directors and committee members with oversight responsibility for reported information need to understand which level of assurance has been obtained, since a limited assurance conclusion and a reasonable assurance opinion do not offer the same degree of confidence. This distinction informs how much reliance the board places on assured data and how the assurance level is described to stakeholders.
Chief Compliance and Sustainability Officers
Those responsible for ESG and sustainability reporting must decide, in light of applicable requirements and stakeholder expectations, which level of assurance is appropriate. Reasonable assurance involves more rigorous procedures and a positively worded opinion, while limited assurance involves a higher-level review and a negatively worded conclusion, a trade-off between depth and effort that these officers are typically positioned to evaluate.
Investors and Other Report Users
Stakeholders relying on reported ESG or sustainability information benefit from recognizing the difference between the two levels, so they do not read a negatively worded limited assurance conclusion as though it were a positively worded reasonable assurance opinion. Understanding the level of assurance obtained helps users calibrate the confidence they place in the underlying information.
Assurance Practitioners
Practitioners performing assurance engagements apply the procedures and standards appropriate to the agreed level, gathering more extensive evidence for reasonable assurance and conducting a comparatively high-level review for limited assurance. They are responsible for wording the resulting conclusion appropriately, positively for reasonable assurance and negatively for limited assurance, consistent with the applicable standards, framework, and jurisdiction.

Inside Reasonable and Limited Assurance

Reasonable Assurance
A high, but not absolute, level of assurance typically provided in engagements such as financial statement audits. The practitioner reduces engagement risk to an acceptably low level through extensive procedures and expresses a positive-form conclusion (for example, that the subject matter is presented fairly or is compliant). It does not amount to a guarantee, because inherent limitations of any assurance process mean some risk of misstatement or error always remains.
Limited Assurance
A lower level of assurance in which the practitioner performs fewer and less extensive procedures than in a reasonable assurance engagement. It generally results in a negative-form conclusion (for example, that nothing has come to the practitioner's attention indicating the subject matter is materially misstated). The scope, nature, and timing of procedures are more restricted, so the assurance obtained is meaningful but noticeably less than reasonable assurance.
Engagement Risk and Procedure Depth
The distinguishing factor between the two levels is how far engagement risk is reduced, which in turn drives the extent, nature, and timing of evidence-gathering procedures. Reasonable assurance requires sufficient appropriate evidence to support a positive conclusion; limited assurance requires enough evidence for the practitioner's negative-form conclusion but stops short of that threshold.
Form of Conclusion
Reasonable assurance is typically expressed in positive form (an affirmative opinion), while limited assurance is typically expressed in negative form (an absence of identified issues). The wording of the practitioner's report signals which level was provided and should not be read as interchangeable.
Inherent Limitations
Neither level constitutes absolute assurance. Factors such as the use of sampling, the exercise of professional judgment, the possibility of collusion or management override, and the nature of the underlying subject matter mean residual risk remains even after a reasonable assurance engagement.
Scope and Applicability
The appropriate level depends on the purpose of the engagement, the needs of intended users, the subject matter, and any applicable standards or requirements. The choice between reasonable and limited assurance is generally a matter of engagement design and agreement rather than a universal rule, and requirements vary by jurisdiction, standard-setter, and reporting context.

Common questions

Answers to the questions practitioners most commonly ask about Reasonable and Limited Assurance.

Does limited assurance mean the engagement was low quality or that the auditor found problems?
No. Limited assurance is not a comment on quality or a signal of adverse findings; it reflects a deliberately different scope of work than reasonable assurance. In a limited assurance engagement, the practitioner typically performs fewer and less extensive procedures, often primarily inquiries and analytical procedures, and expresses a conclusion in a negative form, stating that nothing has come to their attention indicating the subject matter is materially misstated. A reasonable assurance engagement involves more extensive procedures and supports a positive-form opinion. The choice between them generally reflects the level of assurance the engaging party has requested and the nature of the subject matter, not the diligence or competence of the practitioner. These are general descriptions; the specific standards and terminology vary by framework and jurisdiction, and this entry is educational rather than professional advice.
Is reasonable assurance the same as absolute assurance or a guarantee that the subject matter is free from error?
No. Reasonable assurance is a high but not absolute level of assurance. Even in a reasonable assurance engagement, inherent limitations, such as the use of selective testing, the possibility of collusion or management override, the exercise of judgment, and the practical constraints of examining evidence, mean that some risk of undetected material misstatement typically remains. Reasonable assurance supports a positive-form opinion but does not amount to a guarantee or a certification of perfection. Describing an engagement as providing reasonable assurance is different from asserting that the subject matter is error-free. The precise meaning depends on the applicable assurance framework.
How do we decide whether to request reasonable or limited assurance for a given report?
The decision generally depends on the intended use of the report, the needs and expectations of the users, the level of confidence sought, cost and timing considerations, and any applicable requirements. Where a higher level of confidence is important, for example, for information relied upon heavily by external stakeholders, reasonable assurance may be preferred despite greater cost and effort. Where a moderate level of confidence is acceptable, or where the subject matter is emerging or evolving, limited assurance may be appropriate as a starting point. This is typically a judgment made by the engaging party in consultation with the practitioner, and any mandatory requirements applicable to the specific report or jurisdiction should be confirmed. This entry does not constitute assurance, legal, or audit advice.
How should the assurance report make clear which level of assurance was provided?
Assurance standards generally require the report to state the level of assurance and to express the conclusion in a form consistent with that level. A reasonable assurance conclusion is typically stated in a positive form (an opinion that the subject matter is presented fairly or in accordance with the applicable criteria), while a limited assurance conclusion is typically stated in a negative form (that nothing has come to the practitioner's attention causing them to believe the subject matter is materially misstated). Reports also generally describe the scope of procedures performed, the applicable criteria, and the respective responsibilities of the responsible party and the practitioner. Users should read the conclusion and scope wording carefully rather than assuming a level of assurance, and the specific reporting requirements depend on the applicable standard.
Can an engagement combine reasonable and limited assurance across different parts of the same report?
In some circumstances a single report may cover multiple elements at different assurance levels, for example, reasonable assurance over certain metrics and limited assurance over others, depending on user needs, data maturity, and cost. Where this occurs, the report generally needs to clearly delineate which subject matter or which specific information is covered at which level, so users are not left to infer a uniform level of assurance across the whole report. Whether and how to structure such an engagement is a matter of professional judgment and applicable standards, and the boundaries should be defined in the engagement terms. This description is general; the permissibility and mechanics vary by framework.
What does the choice between reasonable and limited assurance mean for the practitioner's procedures and evidence?
Generally, a reasonable assurance engagement requires the practitioner to obtain sufficient appropriate evidence to reduce engagement risk to an acceptably low level, involving more extensive procedures such as tests of controls, substantive testing, and corroboration, in addition to inquiry and analytical procedures. A limited assurance engagement typically involves fewer procedures, often concentrated on inquiries and analytical procedures, and a correspondingly lower, though still meaningful, evidence threshold. Because the objective differs, the nature, timing, and extent of procedures differ, and this is a core reason the two engagements are not interchangeable. The precise procedures depend on the subject matter, the applicable criteria, the practitioner's risk assessment, and the governing standard, and remain a matter of the practitioner's professional judgment.

Common misconceptions

Reasonable assurance is the same as a guarantee that the subject matter is free from error or misstatement.
Reasonable assurance is a high but not absolute level of assurance. Inherent limitations of any assurance process, including sampling and judgment, mean some risk always remains, so it should never be presented as a guarantee.
Limited assurance is simply a lighter version of the same conclusion as reasonable assurance.
The two differ not only in the depth of procedures but also in the form of conclusion. Limited assurance generally uses a negative-form conclusion (nothing came to attention), while reasonable assurance uses a positive-form conclusion. Treating the negative-form statement as equivalent to a positive opinion overstates the assurance obtained.
The choice between reasonable and limited assurance is a fixed rule that applies uniformly across all engagements.
The appropriate level depends on the engagement's purpose, the intended users, the subject matter, and any applicable standards, which vary by jurisdiction and context. It is generally a matter of engagement design and agreement rather than a single universal mandate.

Best practices

Clarify and document the intended level of assurance at engagement acceptance, ensuring the practitioner, management, and intended users share a common understanding of what reasonable versus limited assurance will and will not deliver.
Align the extent, nature, and timing of procedures to the agreed level of assurance, recognizing that reasonable assurance demands sufficient appropriate evidence for a positive conclusion while limited assurance supports only a negative-form conclusion.
Use conclusion wording that accurately reflects the level of assurance provided, avoiding positive-form language in limited assurance reports that could mislead users into inferring a higher level.
Explicitly communicate the inherent limitations of the engagement, including that no level of assurance amounts to a guarantee and that residual risk remains even under reasonable assurance.
Confirm the applicable assurance standards and any jurisdiction-, sector-, or entity-specific requirements before finalizing engagement scope, since the appropriate level and reporting form can differ across contexts.
Ensure users understand which function performed the engagement and the boundaries of its scope, so that the assurance conclusion is not read as covering matters outside the agreed subject matter.