CSRD Audit: What Companies should Know Now

The demands on sustainability reporting are increasing, and with them the importance of the CSRD audit for companies in Germany and throughout Europe. With the Corporate Sustainability Reporting Directive (CSRD), the European Union is creating a new standard for transparency and comparability. The goal is to systematically and comprehensibly integrate environmental, social and governance issues (ESG) into corporate reporting.

1. Why the CSRD audit is now in focus

The Omnibus package has significantly narrowed the scope of the CSRD. The Omnibus Directive has been in force since 18 March 2026: from financial year 2027, reporting obligations apply only to companies with more than 1,000 employees AND more than €450m net turnover (both criteria must be met cumulatively). Many companies that previously expected to fall in scope are now exempt.

Even so, one thing is clear: the CSRD audit will remain mandatory for companies in scope and a strategic lever for others who want to position themselves for the future. The directive requires meaningful sustainability reporting and its external verification, permanently based on limited assurance. Companies must set up processes, data, and responsibilities in a way that meets these requirements.

Until the full implementation of the CSRD in Germany, the CSR Directive Implementation Act (CSR-RUG) continues to apply. Germany's national CSRD transposition law has not yet been adopted, and there is no fixed date for its adoption (as of September 2026). Companies that adopt structured sustainability reporting early gain clear advantages: they comply with regulatory requirements and strengthen their position with investors, customers, and business partners.

2. The regulatory framework: The basis of every CSRD audit

Anyone who wants to pass the CSRD audit successfully must know the legal framework. The Corporate Sustainability Reporting Directive (CSRD) obliges companies to provide comprehensive and standardized sustainability reporting. It gradually replaces the previous Non-Financial Reporting Directive (NFRD) and, in Germany, the CSR-RUG.

Currently, the legal framework of the CSR-RUG still applies in Germany. Companies that have previously been required to report non-financial information remain obliged to do so under the relevant HGB provisions. Only with the full implementation of the CSRD will this framework be replaced. This transition phase requires careful planning, as many requirements apply in parallel or overlap in time.

Voluntary reporting as a strategic advantage

Not all companies are directly subject to reporting requirements. Nevertheless, starting structured sustainability reporting early can be strategically advantageous. A possible framework for this is the Voluntary Reporting Standard for SMEs (VSME), which EFRAG published in December 2024 as a voluntary reporting standard.

The voluntary reporting standard is not subject to mandatory external auditing. Nevertheless, external validation can be advantageous, for example for the use of environmental claims towards consumers (see EmpCo Directive) or for a better rating certificate such as EcoVadis.

Looking to the future: ESRS and European audit standards

The CSRD refers to the European Sustainability Reporting Standards (ESRS), which set uniform requirements across Europe. The revised ESRS were adopted on 3 July 2026 and published in the EU Official Journal on 21 September 2026 as Delegated Regulation (EU) 2026/1563. They apply mandatorily to financial years beginning on or after 1 January 2027; for financial year 2026, companies may choose between the previous ESRS (with or without relief) and the revised ESRS. Key changes include:

Assurance standards are evolving too: the IAASB published the international standard ISSA 5000 at the end of 2024, and the EU Commission must adopt the binding EU standard for limited assurance by 1 July 2027. Companies that follow these developments actively gain a clear implementation advantage.

3. Obligations and scope of the audit according to CSRD

The CSRD audit is not only a formal control. It is based on clearly defined obligations and standards that companies must meet. At the center is mandatory sustainability reporting, which will be as binding and audit-relevant as the classic financial report. For many companies, this means new processes, new data requirements and a significantly higher degree of transparency.

Which standards apply?

Reporting is based on the European Sustainability Reporting Standards (ESRS). They form the central set of rules for the content, structure and methodology of sustainability reporting.

Key requirements include:

• a double materiality assessment (impact and financial materiality)
• disclosure requirements on environmental, social and governance aspects (ESG)
• specification of methods, data sources and assessment bases used

Sector-specific standards, originally planned to follow, were scrapped by the Omnibus package.

External audit becomes mandatory

Sustainability reports will be subject to mandatory external audit. Auditors or other approved auditors check the information according to defined standards.

The audit obligation follows the reporting obligation. After the Omnibus package, only companies with more than 1,000 employees and more than €450m net turnover are subject to reporting, and therefore audit, from financial year 2027 (reports in 2028); non-EU groups follow from financial year 2028. For former wave 1 companies, transitional rules apply for financial years 2025 and 2026: member states may exempt companies below the new thresholds for these years (still open in Germany). In Germany, the CSR-RUG applies until the transposition law is adopted, and it does not require a substantive external audit of the non-financial statement. In addition, there is the option of voluntary audits for non-obligated companies.

For the audit of the sustainability report, the limited assurance standard applies permanently. The originally planned later move to reasonable assurance was scrapped by the Omnibus package.

4. Preparation for the CSRD audit in practice

The CSRD audit presents many companies with a new challenge. It requires not only a sustainability report, but a resilient, comprehensible and auditable information base. Clear structures built early reduce risks, save time and ensure a smoother audit process.

Create clear processes and responsibilities

A central success factor is a clearly structured internal process. Sustainability reporting must be understood as an integral part of corporate management, not a by-product. This includes:

• Definition of responsibilities: Who is responsible for which topics, data and key figures?
• Involvement of all relevant areas: Sustainability concerns ESG teams, finance, controlling, HR, purchasing, production and communications.
• Integration into existing reporting structures: With structured Green Controlling, sustainability data can be collected and audited more efficiently.

A well-structured process not only facilitates reporting itself. It makes the CSRD audit more predictable for companies.

Data quality and documentation as a basis

Auditors require complete and verifiable documentation of all relevant information. Companies should, at an early stage:

• systematically record data sources and responsibilities
• establish plausibility and consistency checks
• clearly document interpretation decisions regarding the ESRS
• clearly define external data suppliers and stakeholders

Information from the value chain is particularly critical, as it is often not fully controllable internally. A transparent approach helps here, for example through coordinated processes with suppliers and partners.

Strategically design time planning

A realistic and early time plan is essential for a successful CSRD implementation. It should include several phases:

1. Materiality assessment and strategy development
2. Data collection and internal coordination
3. Report preparation and quality assurance
4. Audit preparation and feedback loops
5. Finalization of the sustainability report

Since many processes are new, plan buffer times, especially for the first audit. Early coordination with auditors helps clarify open questions and avoid delays.

Establishment of an internal control system

To make sustainability reporting permanently auditable, the establishment of an internal control system (ICS) is decisive. This system ensures that data is collected and processed consistently, correctly and comprehensibly. It includes:

• process descriptions and control documentation
• technical systems for data collection
• clear release processes and responsibilities
• regular internal audit mechanisms

The ICS is not a "nice to have". It becomes the decisive proof of quality for the CSRD audit. Typically, controlling is responsible for such a system.

Use external expertise

Not all companies have the resources or expertise to implement CSRD audit requirements on their own. Involving external experts or CSRD consultants can turn a regulatory obligation into an opportunity to strategically anchor sustainability in the company.

5. Types of audits and requirements for the CSRD audit

The CSRD audit ensures that published ESG data is credible, reliable and comparable. The audit process draws on established standards from financial reporting with some special features.

Limited vs. reasonable assurance

The CSRD audit requires limited assurance. Auditors assess the plausibility and appropriateness of the reported information, but with a smaller scope than for a financial statement audit. Typical audit procedures include:

An audit with reasonable assurance was originally planned but was scrapped by the Omnibus package and is only possible on a voluntary basis. This standard would be more akin to a classic financial audit and would include more extensive tests, verification of internal control effectiveness, and detailed validation of key figures.

Audit standards: ISSA 5000 and ISAE 3000

The external audit of sustainability reporting is based on international standards:

The binding EU assurance standard for limited assurance must be adopted by the EU Commission by 1 July 2027.

These standards regulate the structure and methodology of the audit, requirements for audit evidence, formulation of audit opinions, and quality assurance of the audit process.

Audit opinions and their significance

At the end of the CSRD audit, an audit opinion provides information about the reliability of the reporting. With limited assurance, a negatively worded audit opinion is issued, for example:

"On the basis of the audit procedures performed and the audit evidence obtained, nothing has come to our attention that causes us to believe that the consolidated sustainability statement is not presented fairly, in all material respects, in accordance with applicable requirements."

With reasonable assurance, the opinion is positively formulated, similar to a financial audit opinion. Companies can also combine both audit types, for example if particularly sensitive topics such as climate targets or supply chain information are to be examined in more detail.

Practical implications for companies

The chosen type of audit directly influences:

• the time and organizational effort
• the depth of internal documentation required
• the resources needed
• the level of reputation with stakeholders

6. Strategic implications of the CSRD audit

The CSRD audit is far more than an additional legal requirement. If understood correctly, it becomes a strategic instrument for corporate sustainability. The transparency and structure created through sustainability reporting have an impact far beyond regulatory obligations: on financing, market positioning, competitiveness and reputation.

ESG transparency as a competitive advantage

Customers, investors, and business partners today expect more than just financial figures. Companies that disclose their sustainability strategy and have it externally audited actively strengthen trust in their business practices.

The CSRD audit provides additional credibility because the published information is not only created internally but is also externally verified. That can:

Sustainability reporting as a management tool

The CSRD means that sustainability information is being integrated into corporate management. Companies that systematically collect and use their ESG data can:

• Identify and manage risks early (e.g. climate risks, supply chain risks)
• Identify opportunities (e.g. efficiency gains, innovation potential)
• Measurably link sustainability goals with business strategy

This makes the CSRD audit a driver for professionalization and strategic development, not just a compliance exercise.

Signaling effect for stakeholders

Audited sustainability reporting sends a strong signal: "We take sustainability seriously and allow ourselves to be measured against it."

This creates trust with:

• Investors who are increasingly demanding binding ESG data
• Customers who expect sustainable supply chains
• Employees who value responsible action
• Regulatory authorities that check traceability and transparency

Companies that start early with high-quality reporting gain a first-mover advantage and position themselves as a reliable partner in the transformation.

Connection to further sustainability requirements

The CSRD does not stand in isolation. It is part of a larger regulatory framework that gradually strengthens the anchoring of sustainability, including the EU Taxonomy Regulation and the Corporate Sustainability Due Diligence Directive (CSDDD).

Good preparation for the CSRD audit therefore also means setting up reporting and control processes so that they meet several regulations at the same time.

7. Recommendations for action and checklist for CSRD audit preparation

Good preparation is the key to a successful CSRD audit. The following checklist helps companies build internal processes systematically, create transparency and minimize audit risks.

1. Set the strategic course

2. Review scope and reporting obligations

3. Set up data management and documentation

4. Implement internal control system (ICS)

5. Design the schedule realistically

6. Communication and training

7. Use external support in a targeted manner

8. Outlook and further resources

The CSRD audit will continue to gain importance in the coming years and become an integral part of corporate governance.

Companies that create solid structures now will benefit twice over: from more efficient processes and a clear advance of trust in the market. Pay particular attention to the following developments:

• Application of the revised ESRS and the upcoming EU assurance standard: Subscribe to the free CSRD Compass Newsletter to not miss updates.
• Integration with other EU regulations (e.g. Taxonomy, CSDDD)
• Digitalization of reporting through standardized data formats and platforms

For further information, we recommend the Readiness Check for the CSRD audit by the DRSC and the website of the Institute of Public Auditors in Germany (IDW).

Frequently asked questions about the CSRD audit