Quick Read
When financial statements and sustainability statements sit in the same annual report but are audited under different standards by separate teams, inconsistencies between them—such as conflicting asset life assumptions or transition timelines—go undetected because no engagement letter covers their relationship. This whitepaper identifies four intersection points where the documents touch and proposes a coordination protocol to assign clear ownership of the boundary between financial and non-financial audit, closing a gap that currently allows companies to publish contradictory information on the same material assumptions.
IN BRIEF
Under the CSRD the sustainability statement forms part of the management report — the same document that contains the financial statements. Connected information is therefore a single-document problem, not a coordination courtesy.
The financial statements receive reasonable assurance under the ISAs. The sustainability statement receives limited assurance under ISSA 5000. The consistency between them receives neither.
Four intersection points recur: climate assumptions in impairment testing, provisions against disclosed environmental incidents, differing consolidation boundaries, and forward-looking targets that move a financial number.
The Omnibus I directive removed the CSDDD obligation to adopt a Paris-compatible climate transition plan. Published transition plans are therefore now voluntary forward-looking claims that continue to inform impairment assumptions.
The coordination protocol is a one-page interface between the CFO, the CSO, the financial auditor and the assurance provider. Its purpose is to make the seam somebody's responsibility before somebody else finds it.
Executive summary
A company publishes an annual report. On page 84, the notes to the financial statements set out the value-in-use calculation supporting the carrying value of a refinery: a discount rate, a production profile, an assumed carbon price, an asset life ending in 2045. On page 142, the sustainability statement publishes a climate transition plan in which the same refinery is repurposed by 2035.
Both pages are in the same document. The first was audited to reasonable assurance under the International Standards on Auditing. The second was assured to a limited level under ISSA 5000. Neither engagement was asked to read the other page.
WHAT CONNECTED INFORMATION MEANS IN PRACTICE
The financial statements and the sustainability statement describe the same company, using the same assumptions, in the same document, to the same readers. Where they disagree, the disagreement is visible to anybody holding both pages open, and invisible to both assurance providers, because neither was engaged to compare them.
This is not a hypothetical failure mode. It is the ordinary condition of a large multinational annual report, and it exists because the boundary between the two documents falls between two engagement letters. The CFO owns the financial statements. The CSO owns the sustainability statement. The financial auditor examines one. The assurance practitioner examines the other. Nobody owns the relationship.
This paper identifies the four places the documents touch, sets out who is responsible for each, and provides a coordination protocol to be adopted as a standing arrangement.
1. Four intersection points
Figure 1 — Where the financial statements and the sustainability statement touch, and who examines the join.
Intersection one — Climate assumptions in impairment testing
Impairment models rest on assumptions about the future: demand, price, asset life, and increasingly carbon cost and transition pathway. Those assumptions are audited. The transition plan published in the sustainability statement rests on assumptions about the same future, and is assured to a limited level.
Where the impairment model assumes an asset operates to 2045 and the transition plan implies it closes in 2035, one of the two is wrong, and the company has published both. This is the single most consequential connected-information failure, because the financial consequence — a write-down — is large and immediate.
The Omnibus I directive sharpens it. The obligation under the CSDDD to adopt and put into effect a Paris-compatible climate transition plan has been removed. A published transition plan is therefore now a voluntary forward-looking claim. It is not less consequential for being voluntary: it continues to inform the assumptions in the impairment model, it continues to be read by lenders, and it is now made without any regulatory requirement to have made it.
A transition plan the company chose to publish, contradicting an impairment assumption the company was required to audit, is not an inconsistency. It is a document a plaintiff's lawyer would like to have.
Intersection two — Provisions and disclosed incidents
The sustainability statement discloses an environmental incident: a spill, a breach, an enforcement notice, a remediation programme. The financial statements carry a provision, a contingent liability disclosure, or nothing.
Where the sustainability statement describes a remediation programme and the financial statements carry no provision, the reader is entitled to ask which document is accurate. The financial auditor examined the provision against the evidence presented to them. The assurance practitioner examined the incident disclosure. Neither was asked whether the two were consistent.
Intersection three — The consolidation boundary
The financial statements consolidate on the basis of control. The greenhouse gas inventory consolidates on operational control or equity share. The circularity assessment covers sites where material flows can be metered. The biodiversity disclosure covers sites with significant impacts.
Four populations. One company. One annual report. Joint ventures, tolling arrangements, contract manufacturing, leased assets and franchised operations fall differently under each, and the differences are almost never disclosed.
Intersection four — Targets that move a financial number
A sustainability-linked loan applies a margin ratchet keyed to a KPI disclosed in the sustainability statement. The interest expense arising sits in the financial statements.
The KPI receives limited assurance: a negative conclusion, on a bounded scope, without controls testing. The interest expense receives reasonable assurance. The mechanism connecting them — that this number, assured to the weaker standard, determines that number, assured to the stronger — receives no examination at all.
THE GENERAL FORM OF THE PROBLEM
Wherever a number assured to a limited level determines a number assured to a reasonable level, the reasonable assurance is only as good as the limited assurance beneath it. Financial audit has no framework for this, because until recently no audited number depended on an unaudited one.
2. Who is responsible for what
Party | Owns | Frequently assumes somebody else owns |
|---|---|---|
Chief financial officer | The financial statements, the assumptions within them, and the coordination of both assurance engagements | The sustainability data feeding the assumptions |
Chief sustainability officer | The sustainability statement, and assurance readiness of the evidence beneath it | The consistency of that statement with the financial statements |
Financial auditor | The financial statements under the ISAs; responsibilities in respect of other information in the annual report | That the assurance practitioner has examined the sustainability statement's consistency with the financial statements |
Assurance practitioner | The sustainability statement under ISSA 5000 | That the financial auditor has examined the financial statements' consistency with the sustainability statement |
Non-Financial Audit Function | The seam — if it exists | Nothing. It is the only party whose scope is defined as the space between the others. |
Audit committee | Requiring that somebody own the seam, and asking each provider what they did not look at | That the absence of a finding means the absence of a problem |
Read the fourth column of the middle rows. Each professional reasonably assumes the other has performed a comparison that neither has been engaged to perform. This is not negligence. It is what happens when two engagement letters share an edge that neither describes.
3. The CFO's role: evidence coordination
The CFO already owns an architecture for making numbers believable. Applying it across the boundary requires five things, none of which requires a new team.
Sequence the engagements. GHG verification completes before the financial auditor assesses climate-related assumptions in impairment models, so that the carbon numbers underlying those assumptions have been independently examined rather than asserted.
Coordinate the controls work. Internal controls over sustainability reporting and internal control over financial reporting share systems, owners and evidence. Testing them under two unconnected programmes duplicates cost and leaves the overlap untested.
Reconcile the assumptions, in writing, before publication. A single schedule listing every forward-looking assumption that appears in both documents — carbon price, asset life, transition pathway, production profile — with the value used in each and an explanation of any difference.
Establish one evidence repository. Both the financial auditor and the assurance practitioner draw from the same source. Where they draw from different sources, the sources will differ, and nobody will know until somebody compares the published outputs.
Own the schedule of connected information. Not the sustainability team. The CFO signs the financial statements, and it is the financial statements that carry the consequence of a contradicted assumption.
4. The CSO's role: assurance readiness
The CSO's obligation is to ensure that the sustainability programme generates evidence that will survive examination — and to know, before the practitioner arrives, which parts of it will not.
Evidence that persists. Controls that operate during the period and leave a trace, rather than a control matrix drafted for the engagement describing controls that were not in place.
A documented materiality determination. Matters considered, matters rejected, evidence for each, approver, date. Under ISSA 5000 the practitioner must evaluate whether significant matters were overlooked, and this is the only artefact that permits them to.
Disclosure of estimation. Which figures are estimates, of what character, and which value chain data could not be corroborated at source under the Omnibus I value chain cap.
Narrative substantiation. Every assertion of progress or leadership, with its evidence. Narrative is within assurance scope, and it is where enforcement concentrates.
Advance notice of contradiction. The CSO is usually the first person to know that the transition plan and the impairment model disagree, and the last person expected to say so. Say so, in Q3, in writing, to the audit committee.
The chief sustainability officer who tells the audit committee in September that the transition plan cannot be reconciled to the impairment model has done more for the company than any assurance engagement will.
5. The coordination protocol
One page. Signed by the CFO, the CSO, the financial auditor and the assurance practitioner. Adopted as a standing arrangement, reviewed annually, tabled at the audit committee.
Clause | Content |
|---|---|
Scope | Identifies, by name, the matters on which the financial statements and the sustainability statement touch. At minimum: climate assumptions in impairment and asset lives; provisions and contingent liabilities against disclosed incidents; consolidation boundary differences; and any KPI that determines a financial amount. |
Ownership | Names one individual accountable for reconciling each identified matter. Not a department, and not a committee. |
Sequencing | GHG verification completes before the financial auditor's assessment of climate-related assumptions. The materiality determination is documented before the assurance engagement begins. |
Information sharing | Each provider may see the other's scope, planning materials and findings relevant to the identified matters, subject to their respective professional obligations. Neither relies on the other's work without saying so. |
Escalation | Any unreconciled difference in an identified matter is reported to the audit committee before publication, whether or not either provider considers it material to their own engagement. |
Review | The schedule of identified matters is refreshed each cycle. Any new assumption appearing in both documents is added at the point it appears, not at the point it is discovered. |
The single test of the protocol
The external financial auditor signs it.
If they will not, the reason will be instructive: either the seam falls outside their engagement — which is the finding — or they are unwilling to be seen to have looked at something they will not opine on, which is a different finding, and a more interesting one.
6. What to do this cycle
Build the schedule of connected information. Every forward-looking assumption appearing in both documents, with the value used in each. It will fit on one page and it has never been written down.
Identify the differences. Expect the carbon price, the asset life and the transition pathway to differ. Expect nobody to have noticed.
Name an owner for each difference, and require either reconciliation or disclosure of the difference and its reason.
Reconcile the consolidation boundaries. Financial control, GHG operational control or equity share, circularity metered sites, nature significant-impact sites. Disclose the differences.
Table the schedule at the Q4 audit committee meeting, before publication, alongside the narrative substantiation file.
Ask the financial auditor, in the private session, what they observed in the sustainability statement that they were not engaged to examine.
THE LAST ITEM IS FREE AND NOBODY DOES IT
The financial auditor reads the whole annual report. They have responsibilities in respect of other information within it. They have formed views about the sustainability statement that appear in no report, because forming them was not what they were paid for. Ask.
Questions this paper answers
What is connected information?
The relationship between the financial statements and the sustainability statement, which under the CSRD sit within the same management report and describe the same company using the same assumptions. Connected information includes climate assumptions used in impairment testing, provisions against disclosed environmental incidents, differences in consolidation boundaries, and any sustainability KPI that determines a financial amount such as an interest expense under a sustainability-linked loan.
Who is responsible for consistency between the financial statements and the sustainability statement?
In most organisations, nobody. The CFO owns the financial statements, the CSO owns the sustainability statement, the financial auditor examines the first and the assurance practitioner examines the second. Each professional reasonably assumes the other has performed a comparison that neither was engaged to perform. The boundary falls between two engagement letters, and the only party whose scope is defined as the space between the others is the Non-Financial Audit Function — where one exists.
Why does the difference in assurance level matter for connected information?
Because the financial statements receive reasonable assurance under the International Standards on Auditing while the sustainability statement receives limited assurance under ISSA 5000, and the Omnibus I directive has made limited assurance the permanent CSRD requirement. Wherever a number assured to a limited level determines a number assured to a reasonable level — as a sustainability-linked loan KPI determines an interest expense — the reasonable assurance is only as strong as the limited assurance beneath it.
How did the Omnibus I directive change transition plans?
It removed the obligation under the CSDDD to adopt and put into effect a Paris-compatible climate transition plan. A published transition plan is therefore now a voluntary forward-looking claim. It remains consequential: it continues to inform the assumptions in impairment models, continues to be read by lenders and insurers, and is now made without any regulatory requirement to have made it — which removes the defence that it was legally required.
What should a coordination protocol contain?
Six clauses on one page, signed by the CFO, the CSO, the financial auditor and the assurance practitioner. A scope clause naming the matters on which the two documents touch. An ownership clause naming one individual accountable for reconciling each. A sequencing clause requiring GHG verification to complete before the financial auditor assesses climate-related assumptions. An information-sharing clause. An escalation clause requiring any unreconciled difference to reach the audit committee before publication. And a review clause refreshing the schedule each cycle.
What is the test of a good coordination protocol?
The external financial auditor signs it. If they will not, the reason is instructive: either the seam falls outside their engagement, which is the finding, or they are unwilling to be seen to have looked at something they will not opine on, which is a different and more interesting finding.
What is the easiest connected-information action an organisation can take this year?
Ask the financial auditor, in the audit committee's private session, what they observed in the sustainability statement that they were not engaged to examine. They read the whole annual report and have responsibilities in respect of other information within it. They have formed views that appear in no report, because forming them was not what they were paid for. The question costs nothing and nobody asks it.
References and sources
Directive (EU) 2026/470 (the Omnibus I directive), in force 18 March 2026 — narrowing CSRD scope, confirming limited assurance as the permanent requirement, removing the escalation pathway to reasonable assurance, removing the CSDDD obligation to adopt and put into effect a Paris-compatible climate transition plan, and introducing the value chain cap.
Directive (EU) 2022/2464 (the Corporate Sustainability Reporting Directive), as amended — requiring the sustainability statement to form part of the management report.
IAASB, ISSA 5000, General Requirements for Sustainability Assurance Engagements; effective for periods beginning on or after 15 December 2026.
International Standards on Auditing, including ISA 720 (Revised), The Auditor's Responsibilities Relating to Other Information.
IAS 36, Impairment of Assets, and IAS 37, Provisions, Contingent Liabilities and Contingent Assets.
ISO 14064-1:2018, Greenhouse gases — Part 1: organisation-level quantification and reporting; ISO/IEC 17029:2019, validation and verification bodies.
Speeki, The Non-Financial Audit Function (Series 1, Paper 01); The Plan That Survives the Deadline (Series 1, Paper 02); The Meeting That Nobody Holds (Series 1, Paper 05); Where the Seams Are (Series 4, Paper 18), July 2026.
About Speeki
Speeki is an accredited ESG assurance and certification body operating in more than 100 countries. Speeki provides management system certification, verification and validation, and sustainability assurance. Speeki does not provide consulting services. Its independence is structural.
For current details of Speeki's accreditations and their scope, please refer to speeki.com.
© 2026 Speeki. This paper is provided for general information and does not constitute legal, accounting or assurance advice.