Quick Read
Certification (ISO/IEC 17021-1) and assurance (ISSA 5000) serve distinct purposes: the former evaluates whether a management system existed and operated during a period, while the latter determines whether reported sustainability information is materially misstated. Evidence flows one way—from a certified management system to the assurance engagement—making certification the logical prerequisite, yet most organisations procure them in reverse order driven by report publication deadlines. Sequencing certification before assurance reduces cost, duration, and risk of assurance failure, because the certified system provides evidence the assurance practitioner would otherwise have to construct independently.
IN BRIEF
Speeki Meridian™ is certification of a sustainability management system against SPK CSMS1000:2026, performed under ISO/IEC 17021-1. It asks whether a system operated during the period.
Speeki Guardian® is assurance over the sustainability statement under ISSA 5000, effective for periods beginning on or after 15 December 2026. It asks whether the report is materially misstated.
Certification operates during the reporting period; assurance operates after it. Surveillance finds a failure in March, when a year remains in which to correct it. Assurance finds the same failure in November, when it can only be disclosed.
Under ISSA 5000 the practitioner must obtain an understanding of internal control relevant to the preparation of the sustainability information. Where a management system has been independently certified, that understanding is available from documentation a third party has already examined.
The evidence dependency runs in one direction only. Certification supplies assurance. Assurance supplies certification with nothing.
Executive summary
Two engagements. Two standards. Two accreditation regimes. Two questions that sound similar and are not.
Certification, governed by ISO/IEC 17021-1, asks whether a management system conforming to a published standard exists and operated during a defined period. Assurance, governed by ISSA 5000, asks whether reported sustainability information is materially misstated. The first is about a system. The second is about a document.
Organisations procure them in whichever order the deadlines demand, which in practice means assurance first, because the report has a publication date and the management system does not.
THE ASYMMETRY
A certified management system makes the assurance engagement shorter, cheaper and more likely to conclude cleanly, because it supplies the practitioner with independently examined evidence about a period that has now closed. An assurance engagement supplies the management system with nothing, because by the time it runs, the period it describes has ended and nothing about it can be changed.
Evidence flows from Meridian to Guardian. It does not flow back. That single fact determines the sequence, the calendar, and the cost of getting it wrong.
1. What each engagement asks
Figure 1 — Certification examines the system during the period. Assurance examines the report after it.
Term | Definition |
|---|---|
Certification of a sustainability management system against SPK CSMS1000:2026, performed under ISO/IEC 17021-1 by Speeki as an accredited certification body. Recurring, with surveillance during the certification cycle. | |
Assurance over reported sustainability information under ISSA 5000, at a limited or reasonable level, performed by Speeki as an accredited body. Typically annual, conducted after the reporting period has closed. | |
The certification question | Did a system operate that was capable of producing reliable information? |
The assurance question | Is the information that was published materially misstated? |
Why they are not substitutes | A certificate is not an opinion on a number. An assurance conclusion is not evidence that a system operated. In a limited assurance engagement the practitioner is not required to test the operating effectiveness of controls at all. |
Under limited assurance, nobody is required to test whether your controls worked. Under certification, that is the only question being asked.
2. The evidence flow
Four specific things a certified system hands to the assurance practitioner, each of which the practitioner would otherwise have to construct, and one of which they cannot construct at all.
What Meridian establishes | What Guardian would otherwise do | The consequence |
|---|---|---|
An obligations register, maintained through the period | Attempt to establish, from management enquiry, what the entity is accountable for | Completeness. The practitioner can evaluate whether material matters were overlooked against a documented population rather than against management's recollection. |
A governed, minuted, evidenced double materiality determination | Request the materiality documentation and find a slide deck | This is the one that cannot be constructed. Under ISSA 5000 the practitioner must assess the determination and consider whether significant matters were overlooked. A determination for a closed period cannot be performed retrospectively. |
Named evidence owners for each material topic | Discover, over several weeks, that no individual can produce evidence without escalation | Engagement duration. Most delay in a sustainability assurance engagement is the search for an owner. |
ICSR designed, operated and tested during the period | Obtain an understanding of internal control, and — in a limited engagement — decline to test it | Independent evidence that controls operated, which limited assurance does not otherwise produce and which reasonable assurance requires. |
The row that decides the sequence
The double materiality determination is the layer ISSA 5000 requires the practitioner to evaluate.
It is also a decision made at the start of the reporting period, about the period, by people with the authority to make it.
It can be certified while it is being made. It cannot be reconstructed once the period has closed.
An organisation that obtains assurance before certification will be told this, in writing, by its practitioner, in the eight weeks before publication.
3. What certification does not do
A paper of this kind is worth very little unless it says where the argument stops.
Certification does not assure the report. It says nothing about whether a particular figure in the sustainability statement is materially misstated. It does not discharge the CSRD limited assurance requirement, which remains mandatory for in-scope entities and, following the Omnibus I directive, permanent.
Certification does not verify a claim. A greenhouse gas inventory is verified under ISO/IEC 17029, against ISO 14064-1. A certified management system that produces an inventory is not a verified inventory.
Certification of the system does not certify the numbers. It certifies that a system existed, operated, was audited internally, and improved. A well-run system can produce a wrong number, and the certificate does not say otherwise.
A certificate held by a competitor is not evidence about you. Certification is entity-specific and scope-specific. The scope statement on the certificate is the part nobody reads and the part that determines what it covers.
THE HONEST CLAIM
Certification does not make the assurance conclusion stronger. Following Omnibus I, nothing can: limited assurance is the permanent requirement and the conclusion is fixed in form. What certification does is make the conclusion mean something, by supplying independent evidence that a system was operating beneath it.
4. The integrated calendar
A single reporting year, with both engagements placed where the evidence requires rather than where the deadlines pull.
Period | Meridian (certification) | Guardian (assurance) |
|---|---|---|
Q1 | Stage 1 or surveillance. Examines the obligations register, the IRO assessment, and the double materiality determination as it is made. | Not engaged. The period has barely begun and there is nothing yet to assure. |
Q2 | Findings issued. Non-conformities raised while three quarters of the reporting period remain. | Not engaged. |
Q3 | Corrective action verified. ICSR tested for operating effectiveness during the period. | Planning discussion only. Scope, criteria, and the evidence the practitioner will require. |
Q4 | Certificate maintained or issued. The system is now independently evidenced as having operated across the period. | Engagement performed. The practitioner obtains an understanding of internal control from documentation a certification body has already examined. |
Publication | — | Conclusion issued. The findings concern the subject matter rather than the absence of process. |
Note Q2. A non-conformity raised in the second quarter can be corrected within the reporting period, and the corrected control can then operate for the remainder of it. The same finding, raised by an assurance practitioner in the fourth quarter, describes a control that did not operate during a period that has ended. One is a management action. The other is a disclosure.
The value of an engagement is not what it finds. It is when it finds it.
5. The three-year journey
Year 1 | Year 2 | Year 3 | |
|---|---|---|---|
Meridian | Initial certification. Obligations register, materiality governance, ICSR for the highest-risk material topics. | Surveillance. ICSR extended to the remaining material topics. Effectiveness review operating. | Recertification. The full system evidenced across a complete cycle. |
Lens Suite | Verify Scope 1 and 2 under ISO 14064-1. | Verify the material Scope 3 categories and the estimation control. Circularity where claims are made. | Nature claims. Product-level claims where they are made to consumers. |
Guardian | Limited assurance. Findings concern the newly built system rather than its absence. | Limited assurance, on a verified base. | Limited assurance, plus voluntary reasonable assurance on the covenant metric and the Scope 1 and 2 inventory. |
What changed | The organisation can describe its system. | The organisation can evidence its system. | A third party will state a positive opinion on the numbers somebody else prices. |
WHERE THE JOURNEY ACTUALLY ENDS
Not at a certificate. At the point where a lender asks how the company knows its covenant metric is correct, and somebody in the room can answer without leaving it.
6. One provider, two engagements, and the independence question
Speeki performs both engagements. This requires explanation, because the rest of this series has been unsparing about providers occupying more than one seat.
The objection that matters is self-review: a party cannot independently examine work it produced. Speeki does not produce the work. It does not design sustainability programmes, build management systems, prepare materiality assessments, or advise on targets. It provides no consulting services of any kind. Certification and assurance are both examinations, performed under separate accreditation regimes, of work the organisation itself produced.
The distinct engagements do apply different standards, and the practitioner performing assurance under ISSA 5000 must comply with relevant ethical requirements, including the IESBA's International Ethics Standards for Sustainability Assurance from 15 December 2026. Where reliance is placed on the work of the certification body, that reliance is disclosed.
The question an audit committee should nonetheless put, and put in writing: what would happen, commercially, if the assurance team concluded that the certified system had not in fact operated? If the answer involves the loss of a certification client, the arrangement requires examination. Speeki is an accredited certification and assurance body and does not provide consulting services; details of its accreditations and their scope are published at speeki.com.
The right response to a provider holding two seats is not to assume a conflict, and not to assume its absence. It is to ask what an adverse finding would cost them, and to require the answer in writing.
Questions this paper answers
What is the difference between Speeki Meridian and Speeki Guardian?
Meridian is certification of a sustainability management system against SPK CSMS1000:2026, performed under ISO/IEC 17021-1. It asks whether a system operated during a defined period. Guardian is assurance over reported sustainability information under ISSA 5000, at a limited or reasonable level. It asks whether the report is materially misstated. Certification examines a system across a period; assurance examines a document after the period has closed.
Why must certification precede assurance?
Because evidence flows in one direction. A certified management system supplies the assurance practitioner with independently examined evidence about the period — an obligations register, a governed materiality determination, named evidence owners, and controls tested for operating effectiveness. An assurance engagement supplies the management system with nothing, because by the time it runs the period it describes has ended and nothing about it can be changed.
Which evidence cannot be reconstructed after the reporting period?
The double materiality determination. Under ISSA 5000 the practitioner must assess the entity's determination and consider whether significant sustainability matters were overlooked. That determination is a decision made at the start of the period, about the period, by people with authority to make it. It can be certified while it is being made and it cannot be performed retrospectively once the period has closed.
Does certification of the management system satisfy the CSRD assurance requirement?
No. Certification under ISO/IEC 17021-1 examines whether a management system exists and operated. Assurance under ISSA 5000 examines whether reported sustainability information is materially misstated. In-scope CSRD entities must obtain limited assurance, which the Omnibus I directive has confirmed as the permanent requirement. No certificate discharges that obligation.
Does certification make the assurance conclusion stronger?
No — and following Omnibus I nothing can, because limited assurance is the permanent requirement and the conclusion is fixed in its negative form. What certification does is make the conclusion mean something, by supplying independent evidence that a system was operating beneath it. Two companies may hold identical clean conclusions; only one of them can demonstrate that anything was watching.
Why does the timing of a finding matter more than the finding itself?
A non-conformity raised by a certification body in the second quarter can be corrected within the reporting period, and the corrected control can operate for the remainder of it. The same finding raised by an assurance practitioner in the fourth quarter describes a control that did not operate during a period that has ended. The first is a management action. The second is a disclosure.
Is there a conflict where one provider performs both certification and assurance?
The objection that matters is self-review — a party cannot independently examine work it produced. Where the provider produces none of the work, sells no consulting services, and does not design the system, the materiality assessment or the targets, both engagements are examinations of the organisation's own work under separate accreditation regimes. The question an audit committee should nonetheless put in writing is what an adverse finding would cost the provider commercially. If the answer involves losing a certification client, the arrangement requires examination.
References and sources
SPK CSMS1000:2026, Corporate Sustainability Management System — Requirements. Speeki.
ISO/IEC 17021-1:2015, Conformity assessment — Requirements for bodies providing audit and certification of management systems, including impartiality requirements.
IAASB, ISSA 5000, General Requirements for Sustainability Assurance Engagements; effective for periods beginning on or after 15 December 2026. Requires the practitioner to obtain an understanding of internal control relevant to the preparation of the sustainability information, and to assess the entity's double materiality determination where the applicable framework requires it.
IESBA, International Ethics Standards for Sustainability Assurance (including International Independence Standards), issued January 2025; generally effective from 15 December 2026.
Directive (EU) 2026/470 (the Omnibus I directive), in force 18 March 2026 — confirming limited assurance as the permanent CSRD requirement and removing the escalation pathway to reasonable assurance.
ISO 14064-1:2018 and ISO/IEC 17029:2019 — greenhouse gas quantification and the accreditation of validation and verification bodies.
Speeki, The System Beneath the Opinion (Series 3, Paper 12); The Plan That Survives the Deadline (Series 1, Paper 02); Can They Afford to Fail You? (Series 1, Paper 04), July 2026.
About Speeki
Speeki is an accredited ESG assurance and certification body operating in more than 100 countries. Speeki provides management system certification, verification and validation, and sustainability assurance. Speeki does not provide consulting services. Its independence is structural.
For current details of Speeki's accreditations and their scope, please refer to speeki.com.
© 2026 Speeki. This paper is provided for general information and does not constitute legal, accounting or assurance advice.