Dutch Regulator Maps Out Four Pillars for Stronger CSRD Assurance After First-Year Review

Key Takeaways

• First CSRD Assurance Cycle Completed: Dutch PIE audit firms provided assurance in 2025 on sustainability reports prepared voluntarily under the CSRD and ESRS for the 2024 reporting year.
• Substantial Progress Since 2023: The AFM found clear improvements in capacity, expertise and quality control systems compared to its earlier exploratory review.
• Four Pillars Identified: The regulator outlined four foundational elements to safeguard CSRD assurance quality, covering systems, team competence, client understanding and risk-based execution.
• Sustainability Assurance Is Structurally Different: CSRD assurance involves non-financial metrics, value chain data and greater reliance on estimates, requiring different expertise from financial audit.
• Omnibus Directive Narrows Future Scope: Legislative changes reduce the number of companies subject to CSRD, prompting audit firms to reassess strategic and capacity decisions.

Deep Dive

The first year of sustainability assurance under the Corporate Sustainability Reporting Directive is now in the books in the Netherlands, and the country’s financial regulator says audit firms have made real strides, but the work is far from over.

In a new analysis report, the Authority for the Financial Markets said the six largest public interest entity audit firms (BDO, Deloitte, EY, Forvis Mazars, KPMG and PwC) took “substantial steps” in preparing for and delivering CSRD assurance in 2025. The regulator is now setting out four pillars it believes are essential to embedding a durable, high-quality approach.

The message is measured, but clear. Sustainability assurance is no longer theoretical. It is operational. And it must mature quickly.

Voluntary Reporting, Real Consequences

Technically, the CSRD had not yet been implemented into Dutch law in 2025. In practice, however, almost all large listed Dutch companies voluntarily prepared their 2024 sustainability reports in line with the European Sustainability Reporting Standards. That first “wave” of reporting triggered the first cycle of CSRD assurance.

For the first time, PIE audit firms were asked to provide limited assurance over sustainability disclosures that reach well beyond the financial statements.

Those reports, the AFM noted, are meant to show a company’s “place in the world”, that is its impact on the environment, people and society. The role of assurance is to enhance reliability, understandability and consistency, helping investors and the wider public make informed decisions.

The regulator’s review looked not only at firm-level quality control systems but also at engagement-level work. It examined how teams approached complex areas such as double materiality analyses and greenhouse gas emissions.

In several cases, the AFM observed that assurance teams prompted improvements in reporting, including corrections to ensure the completeness of emissions disclosures and the proper application of the ESRS. For a first year, that is not insignificant. It suggests assurance is already influencing reporting quality in tangible ways.

Not Just Financial Audit With a New Label

CSRD assurance may be “limited” in formal terms, but the underlying work is anything but simple.

Unlike financial reporting, sustainability reporting lacks a double-entry accounting backbone. It spans non-monetary metrics, value chain information, long-term targets and qualitative judgments. Estimates are more frequent. External data sources are common. Stakeholders extend far beyond investors.

The AFM underscored that these differences require a different mindset and different expertise. Limited assurance under the CSRD is a lower level of assurance than the reasonable assurance provided in statutory financial audits. But in practice, the breadth and complexity of subject matter can demand deeper, more nuanced engagement.

That reality was already visible in 2023, when the AFM conducted an exploratory review of Deloitte, EY, KPMG and PwC. At the time, it concluded that significant progress was still needed, particularly in capacity, expertise and organisational structure.

Two years later, the regulator says substantial progress has been made on those fronts.

Four Pillars for the Next Phase

To prevent early momentum from stalling, the AFM has distilled its expectations into four core pillars:

• Maintain a robust quality control system specifically tailored to CSRD assurance
• Ensure a competent assurance team and effective project management
• Develop a deep understanding of the client and its processes to design an appropriate assurance plan
• Tailor execution procedures to assessed assurance risks and materiality

None of these concepts are new to auditors. All are familiar from statutory financial audits. What is new is the context. The AFM is effectively saying that these fundamentals must now be translated, recalibrated and operationalised for sustainability reporting, not simply copied across.

A Narrower Scope, Harder Choices

Complicating matters is the evolving legislative landscape.

The Omnibus Directive narrows the scope of companies subject to the CSRD and postpones reporting obligations for large companies and listed SMEs by two years. Once implemented, a significant portion of companies initially expected to fall into the second and third reporting waves will no longer be subject to the directive.

That means fewer engagements than originally anticipated.

From the 2027 reporting year onward, the CSRD will apply to large companies with more than 1,000 employees and turnover exceeding €450 million. At that point, assurance will not be limited to PIE audit firms. Firms holding a regular licence will also be able to perform CSRD assurance.

For audit firms, that raises strategic questions. Does the reduced scope justify continued investment in specialised teams and systems? Do firms expand into this market or step back? And how do they maintain competence in a field that remains both evolving and fundamentally different from financial assurance?

The AFM’s report is, in part, an invitation to make those decisions deliberately.

For now, the regulator’s tone is cautiously positive. It encourages firms, both PIE and non-PIE, to build on the progress made and to continue developing a sound, resilient approach to CSRD assurance.

The first year may have been a trial run. The next phase will test whether sustainability assurance can become embedded, systematic and credible, not just compliant.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey.