Verification, validation and assurance: how do they differ in ESG and carbon footprints?

Verification, validation, assurance, and also audit, certification and accreditation — several similar words surround environmental data, and it is easy to get lost. In one project, a customer asks for a "carbon footprint audit". The supplier replies with an offer for verification, and the finance team asks when the assurance will be done. It sounds like an argument about names, but it ends with the wrong document being ordered.

• Verification vs validation: verification checks data about what has already happened; validation assesses a plan or a target for the future.
• Assurance: an independent opinion on a company's sustainability report, given by a statutory auditor or an approved provider.
• Audit, certification, accreditation: a method of checking, a certificate for a system, and the right of a body to check.

Where do three separate terms come from?

The terms come from three different systems, which is why they are so hard to match:

1. Conformity assessment. Verification and validation are two kinds of conformity assessment. ISO/IEC 17029:2019 describes them. Time separates them. Validation concerns claims about intended, future use. Verification concerns a state that already exists.
2. Audit law. Assurance of ESG reports is a term from the EU's CSRD directive and from national audit law. Only auditors may provide it, and in some countries also approved independent firms.
3. Everyday language. All of the above is often called an "audit", which is the most common source of confusion. An audit has its own, narrower meaning, which we explain at the end.

Verification: checking what has already happened

Verification is an independent check of a statement: a document in which an organisation claims something about its data. The verifier checks whether the statement meets the agreed criteria, whether the data is complete and whether it has material errors. The verifier does not calculate for the company. It checks what the company calculated.

For a carbon footprint, the base standard is ISO 14064-3:2019, "Specification with guidance for the verification and validation of greenhouse gas statements".

A typical verification runs like this:

1. agree the scope, the criteria and the level of assurance;
2. analyse the risk of material misstatement: where errors are most likely;
3. check source data, emission factors and calculations, usually on a sample;
4. visit the site, if the risk or the programme requires it;
5. report findings, and the organisation makes corrections;
6. issue a verification statement with a stated level of assurance.

The level of assurance appears twice in this process, at the start and at the end. It is not a formality: it sets how deep the whole check goes.

You set the level of assurance at the start, and it decides how much the verifier really does. It sets the size of the data sample, whether there is a site visit and how much evidence the verifier asks for. It also sets how strong the final statement sounds. There are two levels:

• Limited assurance: the work is narrower, and the conclusion is negative. It says that nothing came to the verifier's attention that suggests a material error. In voluntary verification, this is the default and the most common level.
• Reasonable assurance: the work is wider, and the conclusion is positive: "the statement has been prepared, in all material respects, in accordance with…". It costs more and takes longer, but it has the highest value as evidence.

The difference is not cosmetic. For the same subject, cost and time grow with the level of assurance, and so does the weight of the document for its reader. If a customer asks for "verified data", ask which level they expect. This is the most common reason why offers do not match expectations.

For ESG reports under the CSRD there is no such choice. The CSRD set limited assurance and kept it, because the Omnibus package dropped the planned move to a higher level. So reasonable assurance stays where it has always been: in the audit of financial statements.

Validation: checking what is yet to happen

Validation differs from verification in one basic way: it looks at the future. It does not check facts. It checks whether the assumptions, the method and the input data are sound enough to trust the expected result.

Three typical cases need validation:

1. an emission reduction project: a plan that should bring a set reduction. The project document is validated before anything is built, and later results are verified;
2. climate targets: the check of targets submitted to the Science Based Targets initiative. The SBTi uses the word "validation", because it assesses a goal for 2030 or 2050. We handle SBTi target submission and validation;
3. forecasts and scenarios: for example the designed performance of a new building or the expected effect of a retrofit.

So the same project goes first through validation and then through verification. First someone assesses the plan, and years later the real results.

The ISO 14064 family: where is validation, and where is verification?

Most of these terms meet in one family of standards. ISO 14064 is a set of rules for managing and reporting emissions. It has three parts, and each answers a different question:

1. ISO 14064-1: how to make an inventory of greenhouse gas emissions and removals for an organisation. It covers boundaries, emission sources, emission factors and data accuracy;
2. ISO 14064-2: how to describe a project that should cut emissions or increase removals, and how to monitor its effects;
3. ISO 14064-3: how to verify and validate greenhouse gas statements, whether they were made under part 1 or part 2.

So the structure is simple: parts 1 and 2 say how to calculate and describe, and part 3 says how to check. Two more standards complete it: ISO 14065 sets requirements for the bodies, and ISO/IEC 17029 sets the general rules of conformity assessment. For greenhouse gas verification, this set is the basis of most services on the market, including ours.

This explains a common buying mistake: there is no such thing as an ISO 14064 certificate in the sense of a management system certificate. You confirm greenhouse gas work in a different way: through validation and verification. Reduction projects are validated under part 2, and calculated emissions are verified under ISO 14064-3. The result is a verification statement, not a certificate with an expiry date. Keep this in mind when an offer names its service "ISO 14064 certification".

The GHG Protocol works separately. It is the reporting standard most companies use, but it has no rules for verification. So a result calculated under the GHG Protocol is usually checked under ISO 14064-3.

Why do companies order greenhouse gas verification if the law rarely requires it? There are three reasons:

1. a customer in the supply chain: checks the supplier as part of due diligence;
2. a bank or an investor: looks at sustainability reporting;
3. the company itself: wants certainty before it announces a reduction or net zero target.

Assurance: an independent opinion on sustainability reporting

In short, assurance is a check of a finished report, not a calculation for the company. The assurance provider receives the finished sustainability statement and checks whether it meets the rules. It then signs its own, separate report that tells the market how far the statement can be trusted. It does not judge whether the company is "green", does not correct its data and does not calculate its emissions. It judges how reliable the company's own description of itself is.

Assurance first applied only to financial statements: an auditor checked the accounts and gave an opinion to shareholders. The CSRD applied the same idea to ESG reports. The profession, the oversight and the independent signature stay the same, but the subject is the ESG report.

A report under the European Sustainability Reporting Standards (ESRS) needs assurance, just as accounts need an audit. In practice it works like this:

• Who. A statutory auditor or an audit firm. The CSRD allows member states to also approve independent assurance services providers. Some countries used this option, others, such as Poland, did not.
• Under which standard. Until the European Commission adopts an EU standard for limited assurance, national standards apply, often based on ISAE 3000. The International Auditing and Assurance Standards Board (IAASB) published ISSA 5000 in 2024: a global standard for assurance of sustainability information.
• What is checked. Whether the disclosures meet the ESRS and the Taxonomy Regulation, and whether the report has the right digital tags.
• The result. A limited assurance report, published together with the sustainability statement.

This document is mainly for investors and banks. For them, reliable ESG data matters as much as reliable financial data. Outside the EU duty, companies also report under GRI or ISSB standards. Then the scope and form of assurance follow from the contract, not from EU rules.

The assurance process itself looks like a financial audit and runs in four steps:

1. planning based on an understanding of the company and its context;
2. a review of how the company carried out its double materiality assessment;
3. testing of selected disclosures and source data;
4. forming a conclusion.

Among other things, the auditor checks whether the company correctly identified its stakeholders and material topics. These decide what should be in the report at all.

So the request "we need assurance of our carbon footprint" is usually a mistake. The carbon footprint itself is verified. Assurance covers the whole ESG report, in which the footprint is one item.

Who must have assurance after the Omnibus package?

The scope changed in 2026, and this is the most common source of outdated information online. The duty to report, and with it the duty of assurance, now covers far fewer companies than the first version of the CSRD.

• Omnibus I directive: Directive (EU) 2026/470 of 26 February 2026 limited the duty. It now covers mainly companies and groups with over 1,000 staff and over €450 million in net turnover a year.
• Level of assurance: it stays limited. The planned move to a higher level was dropped.
• Timeline: the European Commission should adopt the EU assurance standard by 1 July 2027. Member states must transpose the directive by 19 March 2027.
• Transition: some member states, such as Poland, have exempted companies that fell out of the new scope from reporting for 2025 and 2026.

It helps to remember where this came from. The NFRD directive introduced non-financial reporting. The CSRD widened and unified it with the ESRS. The Omnibus package reversed part of that expansion. Companies below the threshold are still asked for data, not by law but by customers, banks and large companies in the supply chain. For them, voluntary verification of data, described above, remains.

In the UK, the CSRD does not apply. Assurance of sustainability information is voluntary. In 2025, the government consulted on UK Sustainability Reporting Standards based on the ISSB standards, and on an oversight regime for assurance providers.

Verification, validation and assurance: a comparison

The table sets the three activities side by side:

Five situations in which these terms are confused

These are the cases we see most often:

1. Corporate carbon footprint. The result for a closed year needs carbon footprint verification, not assurance. The same result may go into the report of a company covered by the CSRD. Then the auditor's assurance also covers it, as one disclosure, not as a separate document.
2. EPD. Before publication, an independent verifier checks the declaration under the programme rules and ISO 14025. This is classic verification of past data. We describe it in our EPD verification service, and we check the model itself in LCA report verification.
3. SBTi targets. A submitted target goes through validation, because it concerns 2030 or 2050. Years later, whether the company met the target is checked by verifying data.
4. EU ETS. An accredited verifier checks the annual emissions report of an installation under Implementing Regulation (EU) 2018/2067. Here the word "verification" is a legal term, not a matter of contract.
5. Environmental claims. The slogan "100% recycled" on a pack is neither assured nor validated. It is checked for conformity with ISO 14021, that is verification of environmental claims. The article on environmental labels and declarations: Type I, II and III describes the legal context.

Audit, certification, accreditation: three more terms that add confusion

Three more terms often appear next to the others:

• Audit: a systematic check of whether an activity meets set criteria. In practice, it usually concerns a management system, not a single statement with figures. ISO 19011 gives guidance on auditing management systems.
• Certification: confirmation by a certification body that a system or a product meets a standard, for example ISO 14001. It ends with a certificate valid for a set time, not with a statement about specific data.
• Accreditation: confirmation of the competence of the body itself. A national accreditation body grants it, for example UKAS in the UK, DAkkS in Germany or PCA in Poland. For validation and verification bodies, the basis is ISO/IEC 17029 and related standards, including ISO 14065.

In short: accreditation says who may check, certification is about a system, and an audit is a way of checking. Verification and validation are about a statement with data, and assurance is about a company's report.

What do you need? Three questions that decide

Before you order a service, answer three questions. The answers point to the right path:

1. Who requires it? If a law does, check which word it uses. The CSRD speaks of assurance, the EU ETS and EPD programmes of verification, and the SBTi of validation. If a customer or a tender requires it, ask which standard or programme they mean.
2. What does the document cover? Data for a closed period: verification. A plan, a forecast or a target: validation.
3. What level of assurance does the reader expect? Limited assurance is enough for most market uses. Reasonable assurance is sometimes required in reporting and in cases where more is at stake.

Frequently asked questions

Do you need verification that will hold up with your customers?

We check corporate carbon footprints and product carbon footprints, EPDs and LCA reports, with critical review. We also check environmental claims under ISO 14021. All services in one place: verification and validation.

If you are only preparing your data, start with a corporate carbon footprint or an LCA study.