The Draft That Redefines What an Auditor’s Signature Means

On 20 May 2026, ICAI released a document that almost everyone scrolled past. It was an exposure draft, the least glamorous thing the profession produces, titled Standard on Sustainability Assurance (SSA-5000). No press cycle, no celebration, just a draft quietly opened for comment.

It deserved more attention than it got, because that draft is India’s entry point into the biggest change to the meaning of an auditor’s signature in a generation. But to see why a draft standard matters at all, you have to start further back, with how the world arrived at the problem this standard is trying to solve.

How we got here

For roughly a century, the bargain between business and society ran on a single, quiet mechanism: the auditor’s signature. A company reported what it earned, an independent auditor examined the books, and if the auditor signed, the numbers could be trusted enough to lend against, invest behind, and build an economy on. That signature carried weight for one reason above all. It rested on a common rulebook, applied the same way in Mumbai, Manchester, and Manhattan, so that “audited” meant the same thing everywhere.

Then the questions the world asked of companies grew larger than money. Investors, regulators, and the public began demanding a second account: not just how much profit a company made, but how it treated the planet and the people around it. How much carbon it emitted. Whether its supply chain rested on exploited labour. Whether its board reflected the society it served. Driven by climate law, investor pressure, and a growing intolerance for greenwashing, sustainability reporting exploded from a voluntary nicety into a core corporate disclosure, in many places now mandatory.

And here lies the gap that defines this whole story. The reporting arrived, but the signature did not follow. There was no shared global rulebook for verifying sustainability claims the way financial claims had been verified for a hundred years. Assurance providers did their best, stretching a general-purpose standard called ISAE 3000 to cover terrain it was never designed for. The result was uneven and, in places, hollow. A sustainability report could be marketing dressed as fact, and the word “assured” stamped on it could mean almost anything, or almost nothing. A claim that moved markets carried less independent scrutiny than a line item in the same company’s accounts.

ISSA 5000 is the profession’s answer to that gap, and SSA-5000 is how the answer reaches India.

The standard the world built

ISSA 5000 was issued by the IAASB, the international body that writes auditing standards, and it is the first comprehensive global standard built specifically to assure sustainability information. It takes effect for periods beginning on or after 15 December 2026, with early adoption permitted, and it is deliberately framework neutral, meaning it can sit on top of whatever reporting framework a company uses rather than locking the world into one. The IAASB also chose not to reinvent the wheel, building ISSA 5000 on the foundations of existing assurance standards, an approach it described as “no greenfielding,” so that practitioners begin on familiar ground.

That familiarity, though, only goes so far. The moment you apply audit discipline to sustainability information, the subject matter starts misbehaving in ways financial numbers never do. Understanding ISSA 5000 properly means understanding four places where it bends to accommodate that difference, and they connect into a single argument: this is not a financial audit wearing a green coat.

The first is that the standard offers two levels of assurance, and the gap between them is real. A limited assurance engagement designs procedures responsive to risk at the disclosure level and ends in the negative form, nothing came to our attention to suggest the information is materially misstated. A reasonable assurance engagement pushes down to the assertion level for each disclosure, requires the practitioner to build a genuine understanding of the entity’s system of internal control in a way deliberately aligned with ISA 315 (Revised), and ends in the positive form, the information is fairly stated. Limited is a screening; reasonable is a full diagnosis. The standard lets the market begin with limited and walk toward reasonable as systems mature, which is precisely the phased path regulators are choosing.

That choice of depth leads directly to the second and most misunderstood feature: materiality, which in this standard is split in two and shared between two parties. The entity runs its own materiality process to decide what is worth reporting, and in many frameworks that process is double materiality, weighing both how sustainability issues affect the company financially and how the company affects the world. That is the preparer’s job. The practitioner does not perform double materiality; the practitioner evaluates whether the entity has a sound process for it. The practitioner’s own materiality is the familiar assurance concept, the absence of material misstatement judged against the information needs of intended users, applied in a split way: considered for qualitative disclosures, and determined, including performance materiality, for quantitative ones. The counterintuitive part worth holding onto is that this materiality does not change between a limited and a reasonable engagement, because it is anchored to user needs, not to the depth of work. The depth changes; the yardstick does not. Collapsing the entity’s double materiality into the practitioner’s misstatement materiality is the single most common error in commentary on this standard, and not making it is a quiet sign of someone who has read it.

The third difference is the hardest, and it follows from what sustainability information actually is. A financial audit lives in the past, where transactions have already happened and left a trail of receipts. Sustainability reporting is thick with estimates, scenarios, and forward-looking targets resting on assumptions that may carry heavy uncertainty or management bias. A net-zero pathway issues no invoice. A scope 3 emissions number may depend on supplier data the company does not even control. ISSA 5000 confronts this directly and places the burden on professional judgement: the practitioner must decide what sufficient appropriate evidence even looks like when the subject matter is a projection rather than a transaction. This is where assurance stops resembling box-ticking and becomes genuine expertise.

The fourth difference is one of scope, in every sense. Because no single auditor commands climate science, human rights, and emissions accounting at once, the standard formally contemplates multidisciplinary teams and the use of experts, while keeping the practitioner responsible for the conclusion. It carries requirements for responding to fraud and to non-compliance with laws and regulations, the same instincts that govern financial audit, and it sits alongside a dedicated ethics code for sustainability assurance and the profession’s quality management standards. Its reach extends into the value chain, beyond the entity’s own walls, which is exactly where a great deal of sustainability risk lives. Professional skepticism runs through all of it.

Taken together, those four features explain why this could not simply be the old standard with new vocabulary. It borrows the rigor of audit and applies it to information that is softer, more forward-looking, and harder to pin down.

And so, back to India

All of which gives that quiet exposure draft its real weight. ICAI’s Sustainability Reporting Standards Board released SSA-5000 on 20 May 2026, alongside a companion draft on the overarching Framework, and ran an outreach programme on both in early June. It is the domestic mirror of ISSA 5000, travelling the same road that carried us from IFRS to Ind AS: take the global benchmark, shape it to local law and practice, and make it our own.

One precision matters here, because it is where people overstate the position. SSA-5000 is still a draft. It is open for comment, not finalised and not yet mandatory. What binds Indian practitioners today is the interim standard already in force, SSAE 3000. So the honest description of the moment is this: SSAE 3000 is the law of the room right now, and SSA-5000 is the next-generation standard, aligned to the global one, being finalised to replace it.

This is not academic, and the reason is BRSR. Listed companies in India already file Business Responsibility and Sustainability Reports, and BRSR Core already pulls assurance into the picture under SEBI’s mandate. As that assurance requirement deepens and reaches further down the market, SSA-5000 is the rulebook that will tell the assurer how the work must actually be done. The reporting obligation is already here; the assurance standard is arriving to meet it.

Why a draft is worth your attention

It is easy to dismiss an exposure draft as procedural noise. It is the opposite. For the first time, the sentence “this company is sustainable” is being engineered to carry the same evidentiary weight as “this company is profitable.” Sustainability is moving out of the marketing deck and into the assurance file, and the professionals who learn to speak both languages, the rigor of audit and the substance of ESG, will find themselves standing exactly where the financial auditor stood a century ago: as the person whose signature is the reason a claim can be believed. The quiet draft of 20 May was the starting gun. The only open question is who will be ready to run.