The institutionalisation of sustainability information assurance: preparing for upcoming obligations in the EU

While the extensive publishing of sustainability information is now a de facto standard when it comes to corporate disclosure – at least for large and listed companies – external verification of this information has not yet reached the same degree of dissemination in business practice (Alsahali and Malagueño, 2022; Cho et al., 2015). However, an increasing number of companies are currently engaging independent third-party assurance for their sustainability information. For example, within the group of G250 companies, the proportion of those who conduct assurance has risen steadily to over two-thirds over the past few years (KPMG, 2024).

This increase is not surprising, as societal expectations are growing and influential stakeholders are exerting pressure on companies to ensure the accuracy of their published sustainability information (Maroun, 2019; Cuadrado-Ballesteros et al., 2017; Farooq and de Villiers, 2017a). While the decision regarding assurance has to date been made on a voluntary basis, this is set to change significantly within the European Union (EU) with the implementation of the corporate sustainability reporting directive (CSRD – Directive (EU) 2022/2464). This directive was introduced in December 2022 and should have been implemented into national law by 6^th July 2024. The CSRD mandates the disclosure of sustainability information and requires certain companies to undergo mandatory assurance ^[1] (European Commission, 2021). As a reaction to the coercive pressure from the legislation, a sharp increase in the proportion of companies within the EU that have their reporting assured can be regarded as certain. The resulting increase in demand for assurance services will also have a substantial effect on the market for sustainability assurance services and the assurance providers themselves.

In recent years, the topic of sustainability information assurance has become increasingly relevant not only in practice but also in the academic debate. Literature has examined it from different perspectives (Farooq et al., 2024). However, for the most part, these investigations were conducted in an institutional environment where there is no assurance obligation and companies decide to carry out an audit voluntarily.

From an institutional theory perspective, differences in institutionalisation can be assumed between voluntary and mandatory environments, both for companies and assurance providers. Institutional theory suggests that coercive pressure stemming from obligations can significantly influence the development and establishment of new practices (Deegan, 2014; DiMaggio and Powell, 1983; Fernandez-Feijoo et al., 2018). Additionally, it highlights how social actors engage in institutional work to create new institutions (Farooq and de Villiers, 2019a; Lawrence and Suddaby, 2006).

Against this background, our study investigates the institutionalisation process of sustainability information assurance from the perspective of assurance providers considering the ongoing introduction of mandatory external verification based on the requirements of the CSRD. To study this, the following research questions are posed:

To answer the research questions, 23 expert interviews were conducted with people from auditing companies or accreditation bodies at varying hierarchical levels. Of the interviewed auditors, 17 work in Austrian accounting firms, whereas the remaining three work in German firms.

The Austrian-German setting of the study is fitting for several reasons. As member states of the EU, Austria and Germany are obliged to implement the CSRD into national law. Therefore, obligatory assurance of sustainability reporting will be introduced, which will influence the market. Studies on audit market concentration show an upward tendency with respect to the market concentration of the Big 4 (Elbardan et al., 2023). The market concentration in Germany is average (Francis et al., 2013). Austria also has a rather average market concentration, although it is higher than that of Germany (Gunn et al., 2019; Francis et al., 2013). Regarding the market position of the Big 4, both countries, therefore, are a good representation of the European market. In contrast to other EU countries, Austria and Germany have not already introduced mandatory external assurance as part of implementing the non-financial reporting directive (NFRD) (Elbardan et al., 2023) ^[2]. Therefore, the implementation of the CSRD in 2024 is the initial introduction of mandatory assurance for non-financial information.

The findings reveal that the new obligations exert high institutional pressure and that there is a need for action in many areas. It is noted that assurance providers have not yet become as actively involved in the institutionalisation process as the institutional theory perspective would suggest, or that there is still room for institutional work. Given the impact of the CSRD, assurance providers could have been expected to position themselves more actively. Apart from the expected obstacles or challenges, such as the deployment of necessary personnel resources (Flasher et al., 2018) the persisting uncertainties surrounding the implementation of obligatory sustainability assurance represent a barrier to proactive positioning in the business field. With this approach, the study contributes to the field of research by introducing a new perspective to the debate. It provides initial insights into how assurance providers are preparing for the upcoming obligations, which has been largely neglected in previous research. The study uses the theoretical perspective of institutional theory and is conceptually based on the model of Farooq et al. (2024), which enables a theory-based and systematic discussion of the institutionalisation process.

This paper is structured as follows. Section 2 reviews the literature on the assurance of sustainability information and presents the theoretical perspective for the study. Section 3 presents the methodology and sample in detail followed by the presentation and discussion of the results in Section 4. Finally, Section 5 draws a conclusion, outlines the limitations and highlights the need for further research.

This section is divided into three parts, first, presenting the theoretical lens applied to this study, institutional theory, before the literature on this topic and the conceptual foundations in the area are depicted. Finally, a model that serves as a framework for discussing the findings is presented.

Institutional theory helps to understand how institutionalisation processes take place and what relationships exist between institutions and actors (Scott, 1995; DiMaggio and Powell, 1983). Over time different schools of thought have been established within this theoretical framework. Institutional theory has been and is often used to explain how institutions exert isomorphic pressures that cause actors to change their behaviour or structures and processes to secure their legitimacy and thus ensure their continued existence (Deegan, 2014; DiMaggio and Powell, 1983). This perspective is often used in the context of the disclosure of sustainability information when it comes to explaining how coercive pressure from standards or obligations affects the reporting behaviour of the companies affected (e.g. Traxler et al., 2023; Pedersen et al., 2013).

Other work from the perspective of institutional theory focuses on the role of actors in the institutionalisation process by examining how actors work to create, maintain and weaken or abolish institutions (Lawrence and Suddaby, 2006). This perspective is particularly relevant in this study, as it attempts to uncover the role that assurance providers play in the institutionalisation process or what institutional work is undertaken in preparation for the upcoming obligations in the EU. Lawrence and Suddaby (2006) distinguish between four different types of institutional work when it comes to creating institutions, i.e. advocacy, changing normative associations, mimicry and educating. Based on this framework and the existing literature, Farooq and de Villiers (2019a) developed a model for analysing institutional work in the context of sustainability information assurance. Institutional pressure, such as the directive, is thereby seen to be a trigger that influences the actions of social actors. Given the significant impact that the CSRD will have on the companies affected as well as the providers of sustainability information assurance, it is expected that they will engage in different types of institutional work. It can be assumed that assurance providers use various mechanisms and mobilise other social actors to achieve their goals or promote their interests, thus playing a pivotal role in shaping the institutionalisation of sustainability assurance (Farooq and de Villiers, 2019a; Lawrence and Suddaby, 2006).

The literature on the assurance of sustainability information is still in its infancy (Farooq et al., 2024). Nevertheless, the existing literature has already identified various motives and factors that encourage companies to provide assurance for their published sustainability information as well as reasons for assurance providers to develop this business segment. Additionally, several obstacles have also been revealed (Farooq et al., 2024; Free et al., 2024). Increasing the (perceived) credibility or reliability of published information (e.g. Farooq and de Villiers, 2017a; Al-Shaer and Mahbub Zaman, 2018; Hodge et al., 2009) and meeting stakeholders or societal expectations are often mentioned (e.g. Maroun, 2019; Farooq and de Villiers, 2017a) as factors that increase the demand for assurance. On the supply side, competition and the expectation or opportunity of establishing a new profitable business area with growth potential are genuinely the driving forces. Competition in this business area exists not only within the auditing market but also between accounting and non-accounting assurance providers (Farooq et al., 2024).

The existing literature also suggests factors that have an inhibiting effect on the demand for sustainability assurance or are seen as barriers. These include the costs or effort involved, as well as the assumption that the added value is not sufficiently given (e.g. Haider and Nishitani, 2020; Farooq and de Villiers, 2017a). Different challenges are also identified on the supply side, with the subjective and dynamic nature of the information to be assured presenting a particular difficulty (Free et al., 2024). However, the institutional environment in which a company operates – particularly regulations mandating the assurance of sustainability information – is a key factor, with the absence of legal obligation being considered to inhibit demand (Farooq et al., 2024; Ruiz-Barbadillo and Martínez-Ferrero, 2020b). While in many countries or regions both the reporting itself and the accomplishment of an assurance can be decided on a voluntary basis, the EU pursues a comparatively ambitious obligation policy in this regard. The CSRD (Directive (EU) 2022/2464), which substantially expands the existing reporting obligations on sustainability information, came into force on January 5, 2023. Compared to the NFRD (Directive 2014/95/EU), it not only extends the reporting requirements but also significantly expands the group of companies affected (European Commission, 2020, Article 5). The CSRD allows for sustainability assurance to be offered by accounting and non-accounting sustainability assurance providers (NASAPs) such as statutory auditors, other audit firms or independent sustainability assurance providers, depending on the transposition of the directive into national law (European Commission, 2020, Article 29d). Statutory auditors and other audit firms carrying out statutory audits can be subsumed into the category of accounting sustainability assurance providers (ASAPs), whereas independent assurance service providers can be categorised as NASAPs (Farooq and de Villiers, 2019a; Edgley et al., 2015; Manetti and Toccafondi, 2012). In general, there is a certain dynamism regarding the types of assurance providers and their market share. Although audit firms dominate, there are also engineering and consulting firms among the providers whose market shares are currently changing, with the market share of engineering firms increasing rapidly (Alsahali and Malagueño, 2022).

In addition to the motives or drivers and challenges or inhibitors, the literature provides insights into the assurance process itself. Thereby, literature suggests that the conduct of the assurance process is often based on the International Standards on Assurance Engagements (ISAE) 3000 the recognised standard for assurance engagements (Alsahali and Malagueño, 2022; Ruiz-Barbadillo and Martínez-Ferrero, 2020b; Farooq and de Villiers, 2019a), which was revised by the International Auditing and Assurance Standards Board (IAASB) in 2013. ISAE 3000 differentiates between reasonable and limited assurance engagement. A reasonable assurance engagement reduces the risk of the practitioner’s conclusion being incorrect to an acceptably low level. A limited assurance engagement also aims to reduce this risk , but with the risk remaining higher than with a reasonable assurance engagement (IAASB, 2013). In August 2023, the IAASB published the proposed International Standard on Sustainability Assurance (ISSA) 5000 “General Requirements for Sustainability Assurance Engagements” (IAASB, 2023). The proposed standard can be used by all assurance practitioners complying with relevant ethical requirements. The proposed ISSA 5000 is principle-based and can be used for the assurance of information prepared in accordance with any sustainability reporting framework or standard (IAASB, 2023).

With regard to the assurance process, in addition to the level of assurance, the applied materiality and procedure of risk assessment are of importance. The depth of understanding that the assurance provider has to obtain depends on the level of assurance. Yet the importance of gathering evidence and understanding the systems, including controls, is an important part of the assurance process. The provision of engagement documentation is important in the context of assurance engagement. These processes and aspects existed in the assurance of sustainability information before the introduction of the assurance obligation through the CSRD and will be transferred to the mandatory assurance engagements (ISAE 3000 (revised), ISSA 5000).

The literature indicates that regulations play a crucial role in the field of sustainability assurance (Farooq et al., 2024; Ruiz-Barbadillo and Martínez-Ferrero, 2020b) and that examining the interplay between various contextual forces, such as legal obligations and the role of social actors such as assurance providers, can help to understand the developments in this field and thus the transition from voluntary to mandatory assurance (Farooq and de Villiers, 2019a; Scott, 2008; Greenwood et al., 2002). However, despite its importance, to date, little is known about how the institutionalisation of sustainability assurance occurs in an environment characterised by such obligations. Against this background, and given the comprehensive requirements of the CSRD, the large number of companies affected, and the associated pressure on assurance providers to respond to this changing environment, the study attempts to address this gap.

As a conceptual framework, the model developed by Farooq et al. (2024) is used, which assumes that actors and institutions exert pressure on other actors and institutions. In this context, the macro-level, the government, the meso-level, such as standard setters or non-governmental organizations (NGOs), and the micro-level, the assurance providers and the reporters to be assured, must be taken into account. Our study focuses on the perspective of the assurance providers in an environment characterized by the upcoming CSRD. In other words, as a legal institution, the CSRD exerts coercive pressure on various actors, and thus also on assurance providers. It aims to help understand their role in the institutionalisation process, what institutional pressures they face, the types of institutional work they perform or intend to carry out, and the implications this has for the institution of sustainability information assurance (see Figure 1).

The aim of the study was to understand the institutionalisation process and exploring the institutional work undertaken by focusing on the views of our interviewees (Schwandt, 1994). For the investigation, 23 semi-structured interviews were conducted, with experts from auditing companies or accreditation bodies from varying hierarchical levels ^[3] located in Austria and Germany who are involved in the assurance of non-financial information in 2021 and 2022, or will be involved in the future. For an overview of the interviewees, refer to Table 1.

In line with our research questions, the interviews focused on the interviewees’ opinions regarding the motivation for providing or the drivers or opportunities and obstacles or challenges related to the assurance of sustainability information. An interview guide with guiding questions was used to ensure that all the important topics were covered (Kallio et al., 2016). Moreover, the interviewees were asked to explain the current process, and which changes they expected due to regulatory requirements. For an overview of the topics covered in the interviews and the interview questions, refer to Table 2.

The interviewees were chosen by collecting data from the auditor’s report of voluntarily audited non-financial reports of Austrian public-interest entities (PIEs), defined as companies with transferable securities listed on an EU-regulated market and governed by law. PIEs were chosen, as they already have the obligation to report sustainability information under the NFRD. From these auditors, we compiled a sample consisting of experts from different Big 4 firms. Further, we contacted auditors from medium-sized non-Big 4 audit firms ^[4] and accreditation bodies ^[5]. We chose to include auditors from accreditation bodies because independent assurance service providers may be allowed to assure sustainability reporting depending on the implementation of the member state option of the CSRD. The interviewees chose the communication channels used for the interviews. In total, 21 interviews were conducted via video calls, one by phone and one was held in person. Studies comparing the collected data using telephone or video calls in semi-structured interviews with in-person interviews indicate that the quantity and quality of the collected data do not show noteworthy deviations (Farooq and de Villiers, 2017b; Holt, 2010; Sturges and Hanrahan, 2004). The application of different data collection techniques also provides the possibility to collect data that is only available through specific techniques (De Villiers et al., 2022). The interviews lasted from 20 to 60 min. Three interviewees were interviewed together ^[6], and all the other interviews were conducted separately. Prior to the interviews, the interviewees were informed about the objective of the study and were ensured that their anonymity would always be maintained.

The interviews were audio-recorded with the consent of all participants and transcribed using transcription guidelines to ensure consistency. As the interviews were conducted in German, the transcripts were translated into English afterwards. As difficulties might arise due to different meanings for certain translations, back-translation was used to generate a better result (Triandis and Brislin, 1984). Nevertheless, it should be noted that translation carries the risk of subjectivity and loss of certain meanings (Lee, 2014). The transcribed interviews were analysed using the thematic analysis approach by Braun and Clarke (2006). The analysis was performed using the Qualitative Data Analysis (QDA) software MAXQDA2022 to categorise and sort the qualitative data. The first step was familiarisation with the collected data by reading and re-reading the translated transcriptions and generating initial codes by coding the identified themes within the data. The codes were then collated into potential themes that were reviewed, defined and named.

Asked about the reasons for entering the business field of the assurance of sustainability information, the interviewees stated that the relevancy of the business field has increased and will do so in the future with the regulatory changes that are still to come, thus offering a relevant business opportunity, as mentioned in the quotes from I.10, I.15 and I.18:

From the perspective of institutional theory, legal requirements lead to coercive pressure, leading companies to subject their sustainability information to third-party verification (Deegan, 2014; DiMaggio and Powell, 1983). It was highlighted that following the trends that clients are exposed to is an important factor for the future success of the company. This aligns with the perspective of institutional theory, which suggests that in a mandatory assurance setting, the legitimisation (Michelon et al., 2019) and advocacy (Lawrence and Suddaby, 2006) for the service itself may not be necessary, but the coercive pressure influences assurance providers to offer services in this business field (Deegan, 2014). Although the basic demand no longer needs to be created, the assurance providers not only respond to the needs of the clients but also initiate trends, as stated by I.3. Thus, as suggested in the model, a reciprocal influence can be identified among the social actors (Farooq et al., 2024).

Entering this business field is also seen as an opportunity to make contact with new customers:

Another reason for entering the field of sustainability information assurance is to sustain the legitimacy of auditing providers’ business activities, as interviewees view the provision of sustainability information assurance as necessary to legitimise their standing as assurance providers. In alignment with the perspective of pragmatic legitimation strategies, the response to needs can promote legitimacy (Suchman, 1995) and position the assurance of sustainability information as an extension of financial auditing (Farooq and de Villiers, 2019a). As mentioned in the quotes from I.13 and I.18:

The clients expect financial assurance providers to also offer those additional assurance services, as coercive pressure leads them to seek sustainability assurance services, which in principle, no longer require legitimisation (O’Dwyer et al., 2011). Regarding the conceptual model (Farooq et al., 2024), not only the coercive pressure triggered by the CSRD but also the pressure from clients causes assurance providers to act.

Although the demand itself no longer needs to be created, the literature suggests significant differences in the positioning approaches among the providers. While ASAPs try to position the assurance of sustainability information as an extension of financial auditing, NASAP wants to qualify assurance as a means of promoting corporate sustainability (Farooq and de Villiers, 2019a). The view that assurance should be offered because the provider is already performing the financial audit suggests that hese considerations may sometimes play a role. This is also supported by the view that it generally has a positive effect on the relationship between auditor and client and further strengthens and expands it, as mentioned by I.5 and I.9:

One interviewee compared this to the current developments with standard setters, as requirements for non-financial information are included in ongoing and new standard-setting efforts:

These developments might lead to competitive thinking between the ASAPs and NASAPs, which is also found in existing literature (Farooq and de Villiers, 2019a). It also shows the complexity of the interactions between individual social actors and the recognition that institutional work must be carried out continuously in this dynamic process in order not to be left behind (Farooq et al., 2024).

In addition to the relevance of the business field and ensuring legitimacy, the interviewees also see the support of societal advancements as a relevant factor:

Another motivational factor is that it enhances the attractiveness of the assurance provider as sustainability assurance can help to fulfil the need of existing and potential employees for meaningful work (Gaudy and Malsch, 2023). Corporate engagement in sustainability behaviour enhances employee satisfaction, which can ensure human capital retention (Zhang et al., 2024) and, therefore, remediate the increasing shortage of qualified personnel (Daugherty et al., 2012):

The following figures and the statements in the next section illustrate how important it is to attract new talent. A study shows that more than 80% of senior leaders in the US report a shortage in accounting talent (Controller Council, 2024). The Austrian Court of Audit published its stocktaking report on skills shortages where an increase in the shortage of skilled labour supply in Austria is highlighted (ACA, 2024). The German ifo – Institute for Economic Research published in 2024 the results of its business survey that shows a decrease in the number of companies suffering from a shortage of skills from 38.7% to 36.3% which is still significantly higher than before 2020 (IFO, 2024).

When asked about the main obstacles or challenges regarding the developments in the business field of sustainability assurance, the interviewees agreed that it is challenging to find enough qualified people to ensure that there are no resource shortages:

The retention and increase of human capital are critical factors for maintaining or achieving a certain market position (Flasher et al., 2018). As the developments are relatively new to the companies, they need more guidance, and the assurance is also taking up more resources:

In addition to providing the necessary resources, ensuring the required competencies was mentioned as a major challenge. The field of sustainability assurance requires complex and multifaceted competencies (Boiral et al., 2020). As this business field is not yet as well established, finding people with the necessary know-how or ensuring that they stay with the company after training them accordingly is seen as a huge challenge:

There is also a need for qualified organisational staff to support the assurance teams (I.2; I.3). As the retention of human capital is a critical factor for maintaining market position (Flasher et al., 2018), assurance providers must not neglect human capital retention. The literature suggests that the education and training of actors in skills and knowledge is seen as an essential field of institutional work when it comes to the creation of new institutions (Lawrence and Suddaby, 2006). This means that institutional work must not only be carried out externally but that assurance providers, at the micro-level, must also take appropriate action within the organisation.

Another challenge mentioned by the interviewees was the lack of implementation of the appropriate systems and legal requirements:

These uncertainties can be challenging for assurance providers, as the implemented assurance standards do not provide clarity on professional aspects such as the qualification of assurance providers (Boiral et al., 2020). Sustainability assurance standards, as referred to in the CSRD, still need to be developed and published. Assurance providers could become proactive and start institutional work towards the standard setters to influence normative associations and help create clarity (Farooq et al., 2024; Lawrence and Suddaby, 2006).

Certain companies are also obliged to disclose information in the context of the EU Taxonomy Regulation (Regulation 2020/852), therefore this represents a further development of interest to clients and assurance providers alike. Another development in the context of sustainability reporting is the Corporate Sustainability Due Diligence Directive (CSDDD):

There is also a focus on international developments outside of the EU. The International Sustainability Standards Board also developed standards for sustainability reporting, and the interviewees and their clients recognise the relevance of international developments, as companies can be affected by both (I.12; I.16).

The interviewees described the expansion of the business field as the main opportunity. The number of companies obliged to disclose sustainability information is expected to increase rapidly:

With the CSRD, the number of Austrian companies obliged to disclose sustainability information is expected to increase from approximately 150 to 2,000 (Senycia et al., 2024). In Germany, the number of companies is expected to increase from 500 to 15,000 (DRSC, 2021). The increased number does not take into account the reduction in the number of companies by adjusting the size criteria for small, medium-sized and large undertakings or groups (Commission Delegated Directive (EU) 2023/2775) and the exemption from the reporting obligation for companies that are included in the consolidated management report of their parent undertaking, nonetheless, the expected increase is still significant. Moreover, the topic of sustainability reporting and assurance is seen as an opportunity to further differentiate the services provided, as was the case with e.g. “business mediation” (I.13) and “business valuation” (I.10).

It was also stated that there is an opportunity to take advantage of synergies, especially with companies that are already assured or certified:

Research shows evidence of knowledge spillover from financial auditing to sustainability assurance, which increases assurance quality (Ruiz-Barbadillo and Martínez-Ferrero, 2020a). Previous research findings suggest that employees with a background in financial auditing are staffed on sustainability assurance, showing possibilities for knowledge transfer and human capital retention, as employees can be offered new career opportunities (Flasher et al., 2018).

As stated in recital 61 of the CSRD, the assurance of sustainability information by auditors would ensure connectivity between financial data and sustainability information. As financial statement audit is a business field that auditors know well, there is an opportunity to benefit from synergies. I.15 stated that “in this respect, a great number of synergies would be lost” if the statutory auditor would not be able to also provide the sustainability assurance. However, knowledge of the company’s situation is not the only advantage that financial auditors bring to the table. They also view their knowledge of the audit processes and their implementation at the customer's premises to be an advantage. As mentioned by I.7, the annual audit process has similarities to the sustainability assurance process:

Additionally, it is viewed as a door opener for future projects and engagements, as sustainability assurance providers can promote further services to their clients:

Being an early adopter within this business field has a major advantage, as it allows the participation in working groups of national standard-setting bodies or national chambers of public accountants ^[9] and contributing with know-how and experience. Taking up institutional work in these committees can help mobilise key actors and play an important role in the development of methods and standards (Farooq et al., 2024; Farooq and de Villiers, 2019a):

Currently, the ISAE 3000 (Revised) standard is applied for assurance of sustainability information. The auditing standard provides guidance for assuring non-financial information. It was nationally implemented by KFS/PG 13 ^[10] in Austria, yet most of the auditors interviewed stated that they use ISAE 3000 (Revised) in its original form, as most of their audit clients operate internationally:

As the CSRD refers to European sustainability assurance standards that still need to be developed and published (Recital 69 CSRD), some of the interviewees are monitoring the developments regarding those new standards (I.2; I.12).

Regarding the scope of the assurance, we found that most of the clients request a full assurance scope, yet, as the level of assurance is limited, the assurance entails less verification of source documents and is less detailed in the understanding of processes and controls:

Some clients commission the auditor to only provide assurance on specific key figures or sections of the sustainability information, such as information on carbon emissions. In another case, the clients asked for an analysis to determine whether the disclosed information was presented according to the requirements of the NFRD (I.4). As the NFRD does not provide sufficient regulation on sustainability assurance, assurance providers are flexible in the decision of the scope that they are offering. Farooq and De Villiers (2019b) found three reasons for the use of flexible engagement scopes by sustainability assurance providers: narrow-scoped engagements might attract new clients; users of sustainability information reporting cannot differentiate between different assurance scopes and information that is not suitable for an external audit (e.g., due to weaknesses in the processes) can be excluded from the assurance scope.

As sustainability assurance is not identical to a financial audit, other skills are needed to ensure the quality of the assurance and a reasonable input of resources on the assurors’ side (Channuntapipat et al., 2020). As set forth by I.9 regarding the know-how, future employees need know-how in business administration and sustainability:

It is acknowledged that there is still a need to further develop environmental and technical knowledge and skills among existing employees and thus educate the actors to support the creation of the institution (Farooq et al., 2024; Lawrence and Suddaby, 2006), specifically among those with an auditing background:

The process of ensuring the auditability of a new subject area is linked to creating a consensus on a knowledge base and an environment in which knowledge can be applied (Lawrence and Suddaby, 2006; Power, 1999).

Accounting and auditing know-how is a further skill set that is considered important by the interviewees. However, these skill sets can be provided by members of their financial audit teams and therefore, the development of such skills is not seen as a problem:

The importance of knowledge regarding accounting topics and financial auditing is seen as especially relevant, as financial ratios and sustainability information need to be integrated into the same context in the future:

This is consistent with recital 61 of the CSRD, which states that the assurance of sustainability information by auditors would ensure connectivity between financial data and sustainability information. Therefore, it is important to have a knowledge base for both topics.

The findings of this study shed light on the motives for entering the business field (RQ1), examine drivers or opportunities and obstacles or challenges for the assurance of sustainability information (RQ2) and the impact of CSRD on the assurance procedure (RQ3), thus revealing how assurance providers are engaging in institutional work and preparing for the obligations ahead. Despite the high number of interviews, the overall perceptions collected were mostly homogeneous.

Although the conceptual model of Farooq et al. (2024) suggests that not only regulatory pressure but also other institutions influence the institutionalisation process, the CSRD was seen as the starting point in our study. In the context of the provision of sustainability information, the generally higher societal requirements and the momentum in this regard in societal and political discourse can be mentioned here. Nevertheless, the findings of our study show that the legal institution of the CSRD and the associated coercive pressure have a significant influence on the institutionalisation process and lead to the involvement of assurance providers as social actors in the development process of the new institution by undertaking various types of institutional work (Lawrence and Suddaby, 2006). Even if the legal framework is initially seen as fixed, the development of normative regulations or the creation of a cultural-cognitive framework can change the normative associations and thus help to ensure that one’s own interests can be asserted (Farooq and de Villiers, 2019a; Lawrence and Suddaby, 2006; Scott, 2008).

The interviews conducted showed that the motives for entering this new or emerging business field are largely based on strategic or economic considerations. Positioning oneself as a legitimate provider in this market is of central importance since the assurance providers assume that this business area will grow in the future due to it becoming an obligation and thus it is crucial for them to secure a certain market share. The interviewed assurance providers consider it essential to position themselves as professionals in this new business field, since otherwise, disadvantages may arise for the established business areas of financial auditing and other services.

In addition to these two motives, moral reasons are also cited at times. Several interviewees emphasised that they also want to contribute to society with this new service, which suggests that there is a value system in place that indicates offering this service out of a sense of moral duty. From a theoretical perspective, this means that, in addition to regulation, the cultural value system can also be seen as a driver of this development and the institutionalisation process, as suggested by the conceptual model (Farooq et al., 2024). Unlike in a voluntary environment, in which companies opt for assurance of the published sustainability information voluntarily and thus the service itself must be legitimized, making the creation of demand through advocacy a key task, this no longer needs to be done in a mandatory environment (Aliyu, 2024; Michelon et al., 2019; O’Dwyer et al., 2011). Assurance providers feel pressure from their clients to offer this additional service because they are exposed to this coercive institutional pressure.

However, since the publication of the draft CSRD, it was obvious that the regulatory requirements would result in a significant increase in demand for assurance services once they came into force. Therefore, one might have expected assurance providers to take the initiative by engaging in various types of institutional work and trying to establish a common understanding of how the assurance process should be established to ensure legitimacy and gain positioning advantages. From an institutional perspective, this implies that while the normative assessment of the situation regarding what is appropriate or the perceived responsibility of the profession is fundamentally driving the decision to enter the market, assurance providers have not yet fully embraced a proactive approach by undertaking the necessary institutional work.

Although the expected increase in demand for such assurance services due to the CSRD is seen as an opportunity, assurance providers also face a wide range of significant challenges. Central in this context is how to attract personnel with the required qualifications. Assuring non-financial information requires skills from a wide variety of areas and thereby, professionals who are not typically represented in auditing firms, such as process engineers or experts in the field of human rights, are also needed. In addition to the capacity and skill challenges, the interviewees also highlighted technical challenges. Consequently, it will be necessary to develop the required skills and knowledge among the social actors.

Regarding the assurance process, the results show that the Global Reporting Initiative guidelines have become established as a framework for reporting in addition to the legal requirements. ISAE 3000 (Revised) has established itself as the auditing standard. However, assurance providers are monitoring the development of the European assurance standard announced as part of the CSRD. As this standard is currently under development, assurance providers have the opportunity to participate in the process and thus become involved as social actors. Engaging in institutional work is particularly relevant given the dynamic in this field and the fact that the obligation regarding the assurance of the published sustainability information in its current form allows for leeway and thus institutional work can lead to preferred developments (Michelon et al., 2019; Hickman and Cote, 2018) thus, institutional work can lead to institutionalisation leading to the preferred result (Farooq and de Villiers, 2019a).

At present, companies requesting assurance mostly require a full assurance scope, however, audits are still primarily performed with limited assurance. Although the depth of assurance is currently not comparable to that of financial reporting, many parallels can be identified in the assurance process. Audit providers are also attempting to draw on synergies from their established financial auditing profession. From an institutional perspective, this means that established work norms from existing business areas or normative associations exert a significant influence on the institutionalisation process of the assurance of sustainability information.

In summary, the findings of this study show that the pending obligations of the CSRD are a major concern for assurance providers. Both drivers or opportunities and obstacles or challenges are observed here. Thereby, the findings allow implications to be derived, not only for assurance providers, but also for companies and standard setters. In any case, there is institutional pressure and the need for action or institutional work in many areas of the assurance of sustainability information – from the provision of training and education of human resources to the design of the assurance process itself –, which will significantly impact the assurance market in the coming years. In view of these challenges and the tasks required, providers should not only respond reactively to the changing environment but could also take a more proactive role in the institutionalisation process. However, requirements do not only exist on the side of the providers of assurance services. On the one hand, companies may also have to adapt their structures and processes to meet the new requirements. On the other hand, the standard setters are also required to provide clarity in areas that are still open, so that the necessary adaptations can be implemented on time. From a theoretical point of view, however, one would have expected that the assurance providers, as social actors, would have already prepared themselves much more strongly for this new business area, given the high regulatory pressure by undertaking different types of institutional work.

As with any other study, this study is subject to limitations. The main limitations are the selection of the sample and the timing of the analysis. Future research could investigate whether assurance providers are already playing a more active role in other EU countries. Furthermore, the results imply that assurance providers need further guidance on how to implement the structures necessary to provide sustainability assurance, as a mere transfer of known financial audit structures is not feasible or sufficient. Further research could investigate the guidance required to support providers of assurance services. In general, further studies are necessary to monitor developments over time and to investigate what changes will occur in the future, particularly given the dynamics in this area.

Authors are very grateful to the interviewees from Austrian and German assurance providers that participated in this study.