Navigating regulatory ambiguity: evolving challenges and the sustainability expectation gap in assurance under the corporate sustainability reporting directive Open Access

The European Union (EU) has redefined sustainability reporting through the Corporate Sustainability Reporting Directive (CSRD) [Directive (EU) 2022/2464]. At its core stands the principle of double materiality, requiring companies to disclose both how sustainability issues affect enterprise value (financial materiality) and on how corporate activities impact society and environment (impact materiality). For the first time, such disclosures are subject to mandatory assurance throughout Europe [CSRD 30, 36].

The European Sustainability Reporting Standards (ESRS), developed by the European Financial Reporting Advisory Group (EFRAG), translate the requirements on double materiality into a binding framework. These embed stakeholder inclusivity, comparability and transparency as principles (EFRAG, 2025a) ^[1].

Beginning with sustainability reports published from 2025 onward, companies subject to the CSRD are required to obtain independent limited assurance. However, the EU has not yet adopted a binding sustainability assurance standard. Until the European Commission (EC) adopts a dedicated standard, Member States may apply national assurance standards. During this interim period, engagements are therefore conducted under existing national frameworks and the International Standard on Assurance Engagements (ISAE) 3000 (Revised). This transition phase is needed to establish auditable processes before reasonable assurance becomes feasible. While the CSRD initially envisaged the introduction of reasonable assurance – comparable to the level of financial audits – around 2028, it becomes clear that this prolongation depends on the maturation of reporting practices and the establishment of an assurance standard [CSRD 60, 69].

These regulatory developments reshape the work of auditors. As the relevance of double materiality assessments (DMA) increases, professional judgment becomes a more complex component of audit practice. However, the inconsistent application of double materiality, constrained by unclear guidance, fragmented standards, and limited stakeholder inclusivity, creates significant challenges for auditors (Accountancy Europe, 2024). Judgment in this context entails elements of subjectivity, even when applied in line with standards, principles, and transparent reasoning. Moreover, its scope and boundaries remain inconsistently defined across standards, adding uncertainty for stakeholders (IAASB, 2015a, 2015b; Knechel, 2016). Impact materiality is widely recognized as judgment-intensive, comprising forward-looking assessments, value-chain information and qualitative disclosures (EFRAG, 2023; IAASB, 2015a, 2015b; Knechel, 2016).

In financial auditing, well-established assurance standards define the exercise of professional judgment. The International Standards on Auditing (ISA), issued by the International Auditing and Assurance Standards Board (IAASB), conceptualizes professional judgment in ISA 200 as the application of relevant training, knowledge and experience. ISA 200 further embeds professional judgment within the methodology of the risk-oriented audit approach [ISA 200.13 (k), A23–27, A31–32].

The sustainability assurance standard-setting context further contributes to uncertainty. The International Auditing and Assurance Standards Board (IAASB) has released the exposure draft of the International Standard on Sustainability Assurance (ISSA) 5000 as a prospective global framework for sustainability assurance. At the time of this study, ISSA 5000 remained in draft form. Consequently auditors continue to apply ISAE 3000 (Revised) as the formally recognized standard for sustainability assurance engagements (IAASB, 2024). In contrast to ISAE 3000 (Revised), ISSA 5000 advances beyond the generic architecture by specifying assurance levels, professional judgment and evidence requirements tailored to sustainability assurance (IAASB, 2015a, 2015b). The ESRS merely acknowledge the need for judgment in determining material impacts, risks and opportunities (IROs) (IAASB, 2013, 2023).

Recent policy developments reveal the fragility of the ongoing transition. The 2025 Omnibus Proposal and the “Stop-the-Clock” Directive [Directive (EU) 2025/794] signal a period of regulatory volatility characterized by postponements and deregulatory tendencies. Proponents claim that these adjustments reduce administrative burden, whereas critics warn that postponing implementation and narrowing assurance expectations risks weakening the robustness of sustainability reporting (Business and Human Rights, 2025; Eurosif, 2025a, 2025b).

The CSRD implementation diverges across Europe. Italy transposed the CSRD through Decreto Legislativo n. 125 / 2024, while Germany published a draft implementation law in early 2025 (Referentenentwurf zum Gesetz zur Umsetzung der Richtlinie (EU) 2022 / 2464 in der durch die Richtlinie (EU) 2025 / 794 geänderten Fassung). Most recently, Austria completed the national transposition with the adoption of the Nachhaltigkeitsberichtsgesetz (NaBeG) in January 2026 (BMJV, 2025; Parlament Österreich, 2025, 2026) ^[2]. Germany and Austria offer distinct cases for examining these dynamics given their historically minimal assurance requirements, in contrast to countries such as France, Spain and Italy, where more mature assurance practices existed prior to the CSRD (Accountancy Europe, 2020; La Torre et al., 2018) ^[3].

Beyond the regulatory context, sustainability assurance operates within the governance architecture of sustainable development. The United Nations Sustainable Development Goals (SDGs) provide a global framework emphasizing transparency and accountability (United Nations, 2025). Prior research shows that externally assured sustainability reports are more likely to disclose SDG-related performance and suggests that assurance may enhance the credibility of such disclosures (Sierra García et al., 2022). However, this literature focuses primarily on disclosure and credibility outcomes rather than on how assurance practices shape legitimacy.

Despite increasing scholarly attention, substantial research gaps persist. Existing studies are largely quantitative and focus on whether assurance enhances credibility, even though sustainability assurance may require conceptual departures from financial audit paradigms (Adams, 2002; Arian and Sands, 2024; Boido et al., 2022; Chong, 2015; Gao et al., 2022; Knechel, 2021). Empirical evidence on how auditors navigate double materiality remains limited, particularly for qualitative, forward-looking and value-chain-oriented disclosures under regulatory ambiguity (Aprile et al., 2023; Bomheuer et al., 2020; Farooq et al., 2024; Gillet-Monjarret, 2022; Venter and Krasodomska, 2024).

Moreover, little is known about how the absence of a unified assurance standard affects legitimacy and professional judgment (Abhayawansa, 2022; Adams et al., 2021; Baumüller and Sopp, 2022; Botica Redmayne et al., 2023; Correa-Mejía et al., 2024; Dilla et al., 2023; Oll et al., 2025). This research gap becomes more salient when considering whether assurance is conducted using a plausibility-based or risk-oriented audit approach.

This study addresses these gaps by extending the Audit Expectation Gap (AEG) into the sustainability domain through the Sustainability Expectation Gap (SEGAP). The SEGAP provides a conceptual lens to examine how regulatory ambition, professional practice and stakeholder expectations interact under the CSRD (Liggio, 1974; Liggio; Porter, 1993). Building on prior research examining legitimacy in sustainability assurance, this study advances the field by deliberately centering on auditors as key actors in navigating regulatory ambiguity (Aliyu, 2024). It engages directly with the normative challenge of reconceptualizing materiality as an accountability mechanism extending beyond investors to encompass societal and environmental interests (Abhayawansa, 2022). By situating double materiality within the SEGAP framework, this study investigates how auditors navigate double materiality under evolving regulatory ambiguity and procedural uncertainty (Arian and Sands, 2024; Hazaea et al., 2022).

The remainder of this paper is structured as follows. Section 2 outlines the institutional evolution and identifies the research gap. Section 3 establishes the theoretical foundation and introduces the SEGAP. Section 4 details the methodology and section 5 reports the empirical findings. Section 6 discusses these findings in relation to double materiality, legitimacy dynamics and broader sustainability governance context. Section 7 concludes the paper.

The evolution of sustainability reporting and assurance is discussed and the emerging research gap elaborated.

Over the past three decades, sustainability reporting has evolved from voluntary frameworks toward a codified regulatory regime. The Global Reporting Initiative (GRI), in 1997, formalized stakeholder inclusivity and societal impact as guiding principles for materiality. The United Nations Global Compact (UNGC), launched in 2000, encouraged corporate strategy alignment with ten principles of responsibility. Released by the International Organization for Standardization (ISO) in 2010, ISO 26000 provided guidance on social responsibility. IFRS (2014) connected disclosures to long-term value creation across multiple capitals.

A significant milestone in the sustainability governance architecture was the adoption of the SDGs in 2015. The 17 SDGs and their 169 associated targets provide a comprehensive framework for addressing ESG challenges (United Nations, 2025). Although the SDGs are not designed as corporate reporting standards, they increasingly influence how organizations frame sustainability strategies and communicate their societal contributions.

Several SDGs are particularly relevant in the context of corporate sustainability reporting and assurance. SDG 16 (Peace, Justice and Strong Institutions) emphasizes transparency, accountability and the development of effective institutions, thereby linking sustainability disclosures to broader governance objectives. Environmental disclosure practices are closely related to SDG 13 (Climate Action), while corporate disclosures on production systems, supply chains and innovation strategies connect to SDG 9 (Industry, Innovation and Infrastructure) and SDG 12 (Responsible Consumption and Production). Social dimensions of sustainability reporting may also indirectly reflect objectives associated with SDG 5 (Gender Equality).

Parallel to these developments, sustainability reporting has gradually moved from voluntary initiatives forward formal regulation. Investor-oriented reporting advanced with the release of the Sustainability Accounting Standards Board (SASB) industry-specific sustainability accounting standards in 2018. In contrast, the European Green Deal (European Commission, 2019a) reinforced the EU’s broader ambition by linking corporate transparency to sustainability objectives (European Commission, 2019a).

A decisive transition occurred when sustainability reporting entered formal regulation. The Non-Financial Reporting Directive (NFRD) [Directive (EU) 2014/95/EU], adopted in 2014, introduced mandatory disclosures on environmental, social, and governance (ESG) matters. However, the directive did not establish standardized disclosure requirements or an assurance framework. Companies retained discretion to choose among various voluntary reporting frameworks.

The European Commission attempted to improve comparability through nonbinding guidelines. In 2017, the EC published guidelines on climate-related reporting, and in 2019 it issued updated guidelines aligned with the recommendations of the Task Force on Climate-related Financial Disclosures (TCFD), established by the Financial Stability Board (European Commission, 2017, 2019b).

This regulatory momentum culminated in the CSRD. The CSRD formalizes double materiality, mandates assurance, and delegates reporting standard-setting authority to EFRAG. EFRAG is described as an independent advisory body developing high-quality, technically robust and stakeholder-informed reporting standards [CSRD 20, 30, 36, 38, 39, 40, 60]. While the NFRD introduced principled-based reporting without substantive prescriptions, the CSRD shifts to a standard-based regime built on the ESRS.

At a global level, the International Financial Reporting Standards Foundation (IFRSF) established the International Sustainability Standards Board (ISSB) in 2021. The ISSB released the International Financial Reporting Standard (IFRS) S1 (General Requirements) and IFRS S2 (Climate-related Disclosures), in 2023, both anchored in a financial-materiality perspective. In contrast GRI, SDGs and ESRS follow an impact-materiality orientation. In 2024, EFRAG released Implementation Guidance (IG) 1, providing guidance on identifying IROs. Yet, the assurance criteria for DMA remain contested, as ISA 320’s judgment-based materiality translates poorly to sustainability (Baumüller and Sopp, 2022; Chong, 2015).

EFRAG’s 2022 elevation to EU standard-setter situates it between political ambition, professional practice and stakeholder expectations. Its hybrid funding model (two-thirds public, one-third private) heightens scrutiny regarding independence and the feasibility of judgment-intensive requirements. This positions EFRAGvis-à-vis global standard-setter such as the International Accounting Standards Board (IASB) and the USA (US) Financial Accounting Standards Board (FASB), underscoring Europe’s ambition to influence global norms beyond investor orientation (EFRAG, 2025b).

Assurance standards have evolved alongside sustainability reporting, yet they rest on differing conceptual foundations. The AA1000 Assurance Standard (AA1000AS), issued by Accountability, embedded stakeholder engagement, inclusivity and forward-looking responsiveness as core principles to strengthen accountability (AccountAbility, 2025).

By contrast, ISAE 3000 (Revised), issued by IAASB, in 2013, was designed as a subject-matter agnostic standard applicable to a broader range of assurance engagements. It predates the institutionalization of double materiality and does not specifically address the structural complexity of sustainability (IAASB, 2013).

A structural shift occurred with the issuance of ISSA 5000, approved by the IAASB in late 2024 and effective with December 2026. ISSA 5000 is the first standard covering both limited and reasonable assurance. It strengthens risk assessment, the identification of material misstatements and omissions, and the application of professional judgment (IAASB, 2024). Until ISSA 5000 is widely applied in practice, ISAE 3000 (Revised) remains the de facto baseline for sustainability assurance under the CSRD [CSRD 60].

At the EU level, in the absence of a binding sustainability assurance standard, the Committee of European Auditing Oversight Bodies (CEAOB) provided nonbinding guidance to promote consistency in limited assurance engagements across Member States (CEAOB, 2024).

Recent developments indicate early alignment with ISSA 5000 at the national level. In Austria, auditors operate under the Wirtschaftstreuhandberufsgesetz (WTBG), with the Kammer der Steuerberater und Wirtschaftsprüfer (KSW) highlighting the judgment-intensive challenges associated with double materiality (KSW, 2025). The NaBeG amends statutory training and qualification requirements in § 239 b (2) WTBG and establishes limited assurance as the mandatory baseline. In Germany, formal CSRD transposition remains pending. The Wirtschaftsprüferkammer (WPK) has proposed amendments to the Wirtschaftsprüferordnung (WPO). Across both countries, sustainability assurance continues to rely on ISAE 3000 (Revised).

Over the past two decades, sustainability assurance research has expanded in line with regulatory development. Early studies primarily examine the type of assurance provider and its effects on assurance, while later work examine assurance motivations and materiality (Channuntapipat et al., 2019; Cohen and Simnett, 2015; Farooq and Villiers, 2019; Jones et al., 2015; Junior et al., 2014; Manetti and Toccafondi, 2012; Maroun, 2022; O’Dwyer and Owen, 2005; Simoni et al., 2020; Wong and Millington, 2014). They show that sustainability assurance operates as a voluntary and heterogeneous practice, marked by diverse providers, inconsistent assurance levels, fragmented standards and mixed motivations spanning stakeholder engagement, legitimacy, risk management and symbolic credibility. Under the NFRD, research shows that fragmented practice and divergent national approaches limited comparability, while the legitimacy of assurance remains underexplored (Farooq et al., 2024; Hazaea et al., 2022; Hosp et al., 2023; Venter and Krasodomska, 2024).

Recent studies scrutinize limited assurance against the rising bar of double materiality, showing that qualitative, forward-looking and value-chain disclosures require more professional judgment than financial audits typically deploy (Abhayawansa, 2022; Aprile et al., 2023; Arian and Sands, 2024; Bolt and Tregidga, 2023; Correa-Mejía et al., 2024; Oll et al., 2025). Other research shows that users’ struggle to distinguish between limited and reasonable assurance, creating renewed credibility concerns (Aliyu, 2024; Farooq et al., 2024; Gaudy and Malsch, 2023; Isack and Aschauer, 2025; Kühle and Quick, 2025).

Frameworks are often discussed abstractly, while lived auditor praxis under ambiguity is underexplored (Abhayawansa, 2022; Canning et al., 2019; Farooq et al., 2024; Richard and Odendaal, 2020; Yan et al., 2022). Critical studies emphasize the symbolic use of assurance to legitimize reporting but rarely examine how vague standards and limited procedures create systemic legitimacy risks (Bhaskar et al., 2024; Boiral and Heras-Saizarbitoria, 2020; Free et al., 2024; Hickman and Cote, 2019; Isack and Aschauer, 2025). Reporting remains fragmented, with investor- and impact-oriented disclosure systems coexisting (Aprile et al., 2023).

Much of the literature adopts a single-stakeholder lens, which is misaligned with the CSRD’s principle of double materiality (Aliyu, 2024; Arian and Sands, 2024; Boiral and Heras-Saizarbitoria, 2020; Correa-Mejía et al., 2024; Farooq et al., 2024; Larrinaga et al., 2020; Oll et al., 2025; Tyson and Adams, 2019; Venter and Krasodomska, 2024; Vigneau and Adams, 2023). This literature finds assurance to be symbolic, and identifies stakeholder integration as partial and materiality as contested.

Despite this progress, qualitative, context-sensitive studies remain scarce. Much research relies on quantitative approaches that test credibility effects rather than examining the underlying dynamics of audit practice (Adams, 2002; Arian and Sands, 2024; Boido et al., 2022; Chong, 2015; Farooq et al., 2024; Gao et al., 2022; Simnett, 2012; Venter and Krasodomska, 2024). The shift toward sustainability auditing may require a fundamental rethinking of the scope and depth, extending beyond financial audit routines (Knechel, 2021).

While scholars note the symbolic nature of assurance and the risk of managerial capture, far less attention is paid to how auditors navigate DMA during the current transitional phase (Boiral and Heras-Saizarbitoria, 2020; Free et al., 2024; Manetti and Toccafondi, 2012).

While AEG theory is applied to sustainability, little attention has been paid to how the absence of a unified framework – pending ISSA 5000 – exacerbates uncertainty and affects legitimacy (Deepal and Jayamaha, 2022; Heltzer et al., 2023; Quick, 2020; Quick and Inwinkl, 2020). EFRAG’s evolving role remains underexplored, particularly how it balances regulatory ambition, auditor practice and stakeholder expectations – a tension that creates both legitimacy opportunities and reputational risks (Aliyu, 2024; Arian and Sands, 2024; Farooq et al., 2024; Venter and Krasodomska, 2024). The coexistence of EFRAG’s ESRS and the ISSB’s investor-focused standards adds comparability challenges and increases legitimacy risks when assurance outcomes diverge.

Finally, little is known about how auditors navigate contested notions of materiality in practice, especially for qualitative, forward-looking and value chain-oriented disclosures (Abhayawansa, 2022; Adams et al., 2021; Baumüller and Sopp, 2022; Botica Redmayne et al., 2023; Correa-Mejía et al., 2024; Dilla et al., 2023; Oll et al., 2025).

Overall, research has advanced toward the complexities of CSRD-aligned disclosures, yet key blind spots persist. It remains unclear what challenges auditors face under the CSRD and how the new requirements affect their work. This includes how professional judgment must adapt to a more complex subject matter. These uncertainties – amplified by regulatory ambiguity, limited assurance and the evolving institutionalization of sustainability assurance – underscore the need to clarify how auditors navigate the principle of double materiality.

We ground assurance under the CSRD in legitimacy theory and show how agency dynamics and managerial capture limit auditors’ capability and accountability function. Information asymmetries and economic dependencies fuel legitimacy deficits and enable greenwashing. We respond by extending AEG to sustainability assurance through the SEGAP, capturing both the perception gap – reflecting stakeholder-regulatory intent misalignment – and the audit gap – reflecting regulatory-intent-assurance practice misalignment.

Legitimacy theory provides a foundational lens to understand how assurance practices evolve in response to societal expectations. Rooted in early institutional theory, it emphasizes that professions seek to align their practices with prevailing norms and stakeholder demands to secure societal approval (Dowling and Pfeffer, 1975; Elsbach and Sutton, 1992; Suchman, 1995) From this view, assurance functions not only as a technical exercise but as a symbolic mechanism to reinforce credibility. Auditors act as “guardians of legitimacy,” whose work is judged by procedural rigor and normative alignment (Boiral and Heras-Saizarbitoria, 2020; Deegan, 2002; Hickman and Cote, 2019; O’Dwyer et al., 2011; Power, 2003).

Empirical studies show legitimizing dynamics in practice. In South Africa, integrated reporting assurance is used to signal accountability (Richard and Odendaal, 2020). In the EU, legitimacy theory explains both the early voluntary uptake of assurance and the current tensions between formal compliance and stakeholder expectations (Boiral and Heras-Saizarbitoria, 2020; Free et al., 2024; Hickman and Cote, 2019; Quick, 2020; Quick and Inwinkl, 2020). These tensions foreground the risk that assurance becomes symbolic rather than substantive.

Different forms of legitimacy clarify how assurance is evaluated. Pragmatic and moral legitimacy rest on whether assurance provides value to immediate audiences and aligns with societal welfare (O’Dwyer et al., 2011). Dispositional and exchange legitimacy capture user perceptions of auditors as being honest, responsive and client-oriented (Maroun and Solomon, 2014). Cognitive legitimacy rests on the extent to which assurance is perceived as natural, necessary and taken-for-granted within its institutional and social context, thereby securing acceptance and trustworthiness (Suchman, 1995). Symbolic legitimacy highlights how assurance can be adopted to display compliance rather than to ensure substantive accountability (Boiral and Heras-Saizarbitoria, 2020).

Greenwashing illustrates how the dynamics of DMAs and managerial capture unfold in sustainability assurance. The European Supervisory Authorities (ESAs) – comprising European Banking Authority EBA, the European Insurance and Occupational Pensions Authority (EIOPA) and the European Securities and Markets Authority (ESMA) – define greenwashing as sustainability-related communication that misleads stakeholder decision-making (Auditupdate, 2024; EIOPA, 2024). Their coordinated stance underscores that misleading sustainability information jeopardizes market integrity, investor protection and the legitimacy of disclosures.

If auditors fail to critically assess the veracity of sustainability claims, they risk legitimizing misleading information rather than protecting public interest (Bouten and Hoozée, 2024; Daoust, 2020). This dynamic creates a dual risk exposure. Auditors face reputational and potential regulatory consequences (e.g. liability) if greenwashing is later detected (Canning et al., 2019; Cremasco and Boni, 2024; DeAngelo, 1981; Dowling and Pfeffer, 1975; Heltzer et al., 2023; Quick, 2020).

Greenwashing typically arises through overstated claims or omissions – such as selectively excluding material issues related to biodiversity, human rights or value-chain impacts. Under the ESRS, the absence of thresholds and the prevalence of qualitative, forward-looking disclosures leave auditors reliant on limited procedures. These dynamics illustrate how omissions and symbolic compliance feed into a widening expectation gap (Auditupdate, 2024; Deepal and Jayamaha, 2022; Heltzer et al., 2023; Quick, 2020).

While recent reviews highlight sustainability assurance as a potential mechanism to mitigate greenwashing risks, empirical evidence under the CSRD remains limited (Free et al., 2024; Venter and Krasodomska, 2024). Moreover, little is known about how auditors exercise professional judgment under limited assurance, while stakeholder might expect substantive accountability (Baumüller and Sopp, 2022; Bhaskar et al., 2024; Farooq et al., 2024; Yan et al., 2022).

While legitimacy theory explains how assurance practice evolve in response to societal expectations, agency theory sharpens the view on the contractual and informational dynamics that structure the audit relationship. In classical principal-agent terms, managers possess superior information relative to both investors and auditors and this asymmetry creates opportunities for opportunistic DMA decisions and reporting (Jensen and Meckling, 1998; Watts and Zimmerman, 1983). Auditing emerges as a monitoring mechanism intended to reduce agency costs by serving as an information intermediary that protects stakeholders from misstatement risks (Knechel, 2021; Leyens, 2011).

Under the CSRD, agency dynamics are intensified. As management controls the DMA, stakeholder integration and methodological boundaries, the process is inherently susceptible to managerial capture (Canning et al., 2019; Cohen and Simnett, 2015; Jones and Solomon, 2010). Although the principle of double materiality aims to address these inherent risks, research shows that DMA practices diverge substantially, undermining stakeholder accountability (Bakarich et al., 2023; Baumüller and Sopp, 2022; Fiandrino et al., 2022). Despite international guidelines, stakeholder consultation in sustainability assurance is limited, and ambiguity in materiality processes allows management to shape boundaries and selectively narrow stakeholder inclusion (Edgley et al., 2015; Manetti and Toccafondi, 2012).

Assurance can reduce asymmetries, but its contribution to accountability depends on auditors enforcing substantive rather than symbolic stakeholder inclusivity (Briem and Wald, 2018; DeAngelo, 1981; Eisenhardt, 1989). Recent studies show that the way companies conduct DMA directly shapes the information environment auditors inherit (Abhayawansa, 2022; Oll et al., 2025). In practice, stakeholder integration remains symbolic and susceptible to managerial capture (Correa-Mejía et al., 2024; Edgley et al., 2015; Manetti and Toccafondi, 2012). Under regulatory ambiguity – particularly in jurisdictions where the CSRD requirements are not yet transposed – auditors rely even more heavily on management-shaped DMA boundaries. In two-tier systems such as in Germany and Austria, supervisory boards are mandated to safeguard investor interest, yet management retains the power to define the audit scope.

This study frames the resulting misalignment through managerial capture. Although less common outside financial sectors, reasonable assurance is recognized in research as a potential lever for shifting assurance from symbolic compliance toward substantive accountability (Baumüller and Sopp, 2022; Farooq et al., 2024; Pizzi et al., 2024).

The AEG was first defined as divergence between what users of financial information expect from auditors and what auditors are required to deliver (Liggio, 1974). The concept was later refined into a structured model that distinguishes between two components. The AEG has gradually evolved into a complex and multifaceted construct. Today, it is common practice, well established in the AEG literature, to distinguish several dimensions within this framework (Porter, 1993). The AEG is not static. It evolves in response to changing societal demands, regulatory shifts and increasing complexity of the audit objects (Deepal and Jayamaha, 2022). Scholars increasingly differentiate between a knowledge gap (user misunderstanding of audit limitations), a performance gap (between expected and actual practices) and a regulatory gap (between stakeholder needs and formal standards).

While applied in financial audit research, the expectation gap persists despite regulatory interventions such as expanded auditor reports (ISA 700) and key audit matters. Users continue to misunderstand the level of assurance provided, especially in relation to fraud detection and auditors’ responsibilities (Dilla et al., 2023; Quick and Inwinkl, 2020; Schelluch and Gay, 2006). In nonfinancial reporting, these dynamics intensify, underlining the need to examine how auditors navigate DMA and what is necessary to narrow this gap (Farooq et al., 2024; Houghton et al., 2011; Turzo et al., 2022; Yan et al., 2022). Extending AEG to sustainability, stakeholders increasingly expect that auditors’ verification meets the rigor of financial audits. Yet ISAE 3000 (Revised) primarily supports limited assurance.

To address these tensions, this study uses the SEGAP as an analytical lens. SEGAP adapts the AEG framework to capture two critical misalignments, namely, between stakeholder expectations and auditor capabilities, and between regulatory intent and assurance practice (Figure 1). The perception gap arises between users and the regulatory framework. It reflects the difference between what stakeholders expect assurance to deliver and what the law actually requires. The audit gap arises between the regulatory framework and auditors. It highlights the difficulty of translating evolving standards into genuinely stakeholder-oriented practice.

The grey ellipse at the center of the SEGAP model represents the zone of regulatory ambiguity. It reflects how uncertainty stemming from divergent national CSRD transposition, the continued reliance on ISAE 3000 (Revised) until ISSA 5000 becomes effective, and the pivotal yet underexplored role of EFRAG in providing methodological guidance for DMA. This area of regulatory fragmentation fuels uncertainty and contributes to both the perception gap and the audit gap.

A further source of ambiguity arises from fragmentation and incomplete alignment between standards, leaving requirements open to interpretation. This ambiguity is amplified by greenwashing and omissions, particularly in the ESRS context. Together, these dynamics weaken the perceived reliability of sustainability information for users and expose auditors to heightened reputational, liability and legitimacy risks through their association with incomplete or misleading disclosures.

Within the SEGAP, different forms of legitimacy specify how sustainability assurance is evaluated by diverse stakeholders under the CSRD. Procedural legitimacy refers to whether assurance processes are perceived as transparent, rule-based and methodologically robust. Cognitive legitimacy reflects the extent to which sustainability assurance is institutionalized and taken for granted as credible practice. Symbolic legitimacy captures the risk that assurance functions as a signal of compliance rather as a mechanism of substantive accountability. Within the expectation gap, moral legitimacy concerns whether assurance is normatively justified and aligned with societal expectations of impact responsibility. Dispositional legitimacy reflects perceptions of auditors’ integrity, independence and professional character. Within the audit gap, pragmatic legitimacy assesses whether assurance is perceived as functionally useful for information users. Exchange legitimacy captures whether the assurance relationship is seen as delivering value relative to its costs and constraints.

Against this backdrop, and drawing on the SEGAP framework, this study asks: How do auditors navigate the principle of double materiality under regulatory ambiguity, and how does this shape the legitimacy of sustainability assurance within the SEGAP?

This study adopts a qualitative, interpretative research design grounded in a constructivist theory-building paradigm (Alvesson, 2003; Eisenhardt and Graebner, 2007). Following grounded theory traditions and abductive reasoning, this sought to capture professional judgment formation in regulatory contexts (Glaser and Strauss, 2017; Suddaby, 2006).

The sample consists of 17 semistructured interviews with partners, directors and senior consultants from Big Four and nonBig Four firms in Germany and Austria. Table 1 provides additional details on the sample. Interviewees were initially identified through publicly available limited assurance reports on 2023 sustainability statements of large listed companies (DAX 40 and ATX Prime), complemented by expert listings on websites, professional networks and snowball sampling ^[4]. These were contacted via email. Fifteen interviews were conducted via video calls, one by phone, and one in person between April and October 2024. Although Germany and Austria share codified legal traditions, similar legal languages, and closely aligned corporate governance frameworks – setting them apart from many EU peers – their CSRD transpositions remain at different process stages, creating a contrasting regulatory setting (Beck et al., 2020; Haberer, 2003).

Interviews were conducted in German to preserve linguistic nuance, lasted 40–81 min, yielded approximately 110,000 words, and were translated by two independent researchers, while acknowledging the inherent risk of subjectivity and potential loss of meaning (Lee, 2014). An excerpt of the semistructured interview guideline is provided in the  Appendix (see Table A1). Transcripts were anonymized with coded identifiers (e.g. I-2, Partner, Big Four, Austria) and analyzed using MAXQDA. Open, axial and selective coding, guided by sensitizing concepts (e.g. materiality thresholds) structured our theme development. Two researchers coded independently with peer debriefings to ensure consistency (Irvine and Gaffikin, 2006; O’Dwyer and Owen, 2005). Saturation was reached after 13 interviews, with four additional interviews used to refine insights.

Table 2. Presents the emerged themes, which are explained in sections 5.1–5.6. These themes examine auditors’ capability, professional judgment, risk orientation, stakeholder integration, assurance level and regulatory ambiguity

Interviewees generally perceived themselves as capable of navigating DMA. Sustainability assurance requires expertise that extends beyond financial accounting, particularly in environmental science, climate risk and social science. Of the 17 interviewees, 11 emphasized that specialist knowledge is essential to implement DMA. As auditors noted:

The composition of the assurance team plays a role in meeting assurance requirements. Across all firms, interdisciplinary collaboration with both internal and external experts was described as a basis for DMA. Big Four firms reported advantages in accessing international networks and established training infrastructures. All interviewees drew parallels between the ongoing transition and earlier IFRS rollout:

Non-Big Four firms often depend on external specialists, illustrating how uneven capacity and regulatory delays constrain the integration of sustainability knowledge widening the audit gap (Quick, 2020).

Regulatory uncertainty further limits the auditors’ capability. Current assurance practices remain restricted to plausibility reviews rather than substantive testing:

This structural constraint is particularly visible in the navigation of DMA. Although frequently referenced in sustainability reports, its audit practice remains limited to confirming whether processes are described:

Double materiality may overstate the scope of assurance, reinforcing structural constraints. In practice, assurance is limited to verifying that the company has described its DMA process. As a result, double materiality risks being reduced to procedural legitimacy – delivering the appearance of due process and sustaining symbolic compliance.

Current assurance practices reflect not capability deficits but structural constraints. Regulatory delays and uneven national transposition confine audits. These dynamics enlarge the audit gap and the perception gap by creating expectations that auditors cannot meet. This sustains exchange legitimacy – as clients value quick and low-cost compliance – while structural legitimacy remains fragile. Moral legitimacy is undermined when impact dimensions go untested, and dispositional legitimacy is threatened when auditors appear aligned with managerial convenience rather than societal accountability.

Interviewees emphasized that DMA requires judgment beyond traditional financial audits. As one auditor explained:

The absence of clear thresholds and legal ambiguity makes materiality decisions vulnerable to managerial influence. Big Four auditors reported greater internal support structures; non-Big Four auditors described higher dependence on management’s interpretation:

Limited assurance restricts auditors’ ability to challenge management-defined DMA boundaries. Because sustainability assurance remains voluntary until national transposition is complete, threshold-setting often becomes a matter of negotiation:

This dynamic enlarges the grey zone of the SEGAP. Procedural legitimacy suffers when decisions lack transparent thresholds. Dispositional legitimacy is threatened if auditors appear aligned with managerial rather than societal interests. The dominance of contractually agreed audit scopes reflects pragmatic legitimacy through exchanges with clients, but this comes at the expense of the broader moral legitimacy. The result is a fragile sustainability balance in which auditors’ judgments stabilize practice but simultaneously expose assurance processes to legitimacy risks.

Interviewees emphasized that sustainability audits extend traditional risk considerations to include ESG risks. Greenwashing and omissions were consistently highlighted as central risks. Yet, under limited assurance, auditors cannot apply the risk-oriented audit approach:

This finding reveals a structural misalignment between stakeholder expectations and professional mandates. While auditors acknowledge that legitimacy increasingly depends on preventing misleading impact-related disclosures, their formal responsibilities remain confined to plausibility checks. This creates a dual dynamic. Users might overestimate assurance, while auditors face reputational risk exposure for being associated with incomplete or misleading reporting. As another partner noted:

The exclusion of greenwashing and omissions obscures impact materiality and privileges financial perspectives. This misalignment reflects agency dynamics, as auditors remain structurally dependent on management-defined DMA boundaries. Within the SEGAP framework, greenwashing and omissions enlarge the zone of regulatory uncertainty. The result is a fragile equilibrium in which auditors stabilize practice through professional judgment but simultaneously reinforce structural limits of assurance.

Stakeholder integration occurs before the audit begins. Auditors receive management mediated stakeholder input, while companies frequently use internal representatives, using its own sales or procurement department to speak on behalf of external stakeholder views:

Several interviewees stressed that audit procedures were confined to management mediated stakeholder input:

Within the SEGAP framework, symbolic stakeholder inclusivity widens both the perception gap – as users assume independent verification – and the audit gap, because regulatory aims remain unfulfilled in practice. This undermines procedural, moral and dispositional legitimacy, reducing the credibility of impact materiality and leaving assurance vulnerable to charges of symbolic compliance.

Interviewees consistently emphasized that limited assurance dominates current practice. Procedures are confined to plausibility checks rather than substantive testing – and even these lack the rigor of a full review, as current engagements remain voluntary:

The focus therefore lies primarily on reviewing documentation rather than validating stakeholder inclusivity or challenging materiality thresholds. Unlike financial reviews, sustainability assurance currently does not apply the risk-oriented audit approach:

Interviewees emphasized that audit scope determines to what extent auditors can response to a company’s DMA. In contrast to limited assurance, reasonable assurance – selectively applied to mature, financial material data – enables auditors to use the risk-oriented audit approach, including control testing, evidence triangulation, and challenge of management assumptions. “Only with reasonable assurance can we challenge the client on stakeholder issues. With limited, we don’t have the mandate” (I-2, I-9, I-10, I-11, I-15, I-16).

As highlighted in section 5.4, several interviewees noted that stakeholder-related disclosures are only reviewed. Users, however, might assume deeper scrutiny: “Stakeholders believe we verify line-by-line. But we don’t. We rely on fragmented client data” (I-5). Within the SEGAP framework, this mismatch widens both the audit gap and the perception gap.

One Austrian and one German auditor noted that reasonable assurance is feasible, but constrained by immature nonfinancial internal control systems, inconsistent data quality, and limitations of value-chain evidence:

Taken together, these findings indicate that the distinction between limited assurance and reasonable assurance is not one of rarity but of functional readiness. The prevailing plausibility-based regime stabilizes early CSRD implementation by providing procedural visibility, yet it does so at the cost of substantive scrutiny.

This reinforces symbolic compliance. Plausibility checks satisfy procedural legitimacy but leave impact materiality untested, weakening moral legitimacy and undermining dispositional legitimacy when auditors appear aligned with client interests. Pragmatic legitimacy may be achieved from the client’s perspective, but only at the expense of credibility for wider stakeholders.

A recurring theme in the interviews was the uncertainty caused by regulatory ambiguity. Auditors described ISAE 3000 (Revised) as offering limited guidance. Jurisdictional variation and the draft status of ISSA 5000 further adds to uncertainty:

Vague ESRS thresholds and deregulation attempts such as the Omnibus proposal were seen to add to uncertainty:

The depth of the audit and the absence of thresholds constrains auditors. Temporary relief under the Stop-the-Clock Directive further weakens regulatory clarity:

Interviewees emphasized that the CSRD transition requires adjustment across multiple national laws – including the WPO in Germany and WTBG in Austria:

These constraints widen the audit gap. Auditors struggle to navigate double materiality, particularly when clients define the depth of audits. They cannot rely on their core capability – applying a risk-oriented audit approach – because the subject matter cannot yet be controlled and the engagement is limited assurance. Fragmented guidance and missing thresholds undermine methodological stability, leaving the emerging assurance regime formally compliant yet institutionally fragile.

Across six themes (Table 2), our findings show how auditors navigate – rather than shape – double materiality. Sections 5.1 and 5.2 show that auditors’ capability and professional judgment are constrained by contractually defined audit scopes and management-determined DMA boundaries. Sections 5.3 and 5.5 further indicate that the extension of audit risk to ESG dimensions remains underdeveloped, while limited assurance restricts the application of the risk-oriented audit approach. Sections 5.4 and 5.6 highlight additional constraints arising from symbolic stakeholder integration and regulatory volatility. These findings reveal a structural configuration in which procedural and pragmatic legitimacy can be maintained, while cognitive, moral, and dispositional legitimacy remain fragile – thereby enforcing the SEGAP.

Consistent with prior research, our findings confirm that sustainability assurance generates pragmatic rather than moral legitimacy (Aliyu, 2024). However, our findings show that these legitimacy constraints are not isolated but cumulative. Contractually defined audit scopes, management-determined DMA boundaries (5.2), a plausibility-based assurance approach (5.3 and 5.5), symbolic stakeholder integration (5.4), and regulatory ambiguity (5.6), jointly restrict auditor capability. Within SEGAP, this constellation reinforces the audit gap and prevents assurance from moving beyond symbolic toward substantive accountability. Procedural and pragmatic legitimacy are sustained through structured plausibility checks and client-oriented exchanges, whereas moral and dispositional legitimacy remain structurally destabilized by management-mediated inputs, symbolic stakeholder inclusion, and constrained audit scopes. Cognitive legitimacy remains fragile in transitional regimes.

Our findings further extend research on the inherent limitations of limited assurance (Kühle and Quick, 2025). As shown in sections 5.1 and 5.5, plausibility-based procedures confine audits to surface-level verification and increase dependence on managerial discretion. Because auditors review – but not construct – the longlist and shortlist of IROs, they are structurally prevented from systematically challenging omissions or the depth of impact assessments. This curtailment restricts the application of auditors core professional logic – risk identification, control evaluation and uncertainty reduction – and explains why procedural legitimacy can be maintained even when substantive accountability remains limited.

These findings support critiques that financial materiality logics continue to dominate practice, thereby overlooking ESG interdependencies (Abhayawansa, 2022). Building on 5.3 and 5.6, our analysis shows that, although reasonable assurance is in principle feasible, the absence of mature nonfinancial internal control systems prevents auditors from achieving substantive accountability. This constraint is reinforced by fragmented guidance, interpretative ambiguity in EFRAG’s framework, and the continued reliance on ISAE 3000 (Revised).

Our study also corroborates concerns that double materiality risks becoming symbolic in the absence of enforceable thresholds (Correa-Mejía et al., 2024). Consistent with prior research, we contend that materiality remains contested and that conceptual plurality – rather than regulatory convergence – represents the field’s most probable trajectory (Oll et al., 2025). Extending this debate, the findings show that plausibility-based assurance practices exacerbate this fragmentation in practice. Contractually defined audit scopes leave impact materiality largely untested, while greenwashing and omission risks persist alongside symbolic stakeholder integration (5.4). Evidence from Germany and Austria suggests that these dynamics reinforce symbolic compliance and stabilize managerial capture within the SEGAP.

Our findings confirm that symbolic compliance and managerial capture remain persistent challenges under the CSRD (Correa-Mejía et al., 2024; Manetti and Toccafondi, 2012). Going beyond this research, our findings show that managerial capture is structurally reinforced through management-defined DMA boundaries, plausibility-based assurance practices and contractually constrained audit scopes.

Extending legitimacy theory through the SEGAP lens, we show how structural gaps, acting jointly and cumulatively, destabilize moral and dispositional legitimacy (Aliyu, 2024). Empirical evidence from Germany and Austria show how these dynamics unfold in practice (Oll et al., 2025). A central paradox emerges: sustainability assurance under the CSRD stabilizes early implementation through procedural legitimacy while simultaneously leaving deeper legitimacy challenges unresolved. As long as assurance engagements remain confined to management-defined scopes and plausibility-based verification frameworks, auditors remain structurally constrained in their ability to substantively validate corporate impact claims.

Building on prior research linking sustainability assurance to increased SDG-related disclosure and credibility, our findings show that the legitimacy effects of assurance depend not only on its presence but also on how assurance engagements are structured (Sierra García et al., 2022). In particular, management-defined audit scopes, plausibility-oriented procedures and limited applications of risk-based auditing shape whether assurance supports more symbolic or substantive forms of organizational legitimacy.

Within this context, sustainability assurance contributes unevenly to SDG governance. It most clearly strengthens procedural legitimacy by institutionalizing verification processes and clarifying methodological limitations, thereby supporting transparency and accountability in line with SDG 16. However, because most engagements rely on plausibility-based procedures under limited assurance, auditors rarely apply a fully risk-oriented approach capable of substantively validating corporate impact claims. Consequently, disclosures related to SDG 9, 12 and 13 are typically verified procedurally, while their substantive sustainability impacts remain only partially examined. These structural limitations affect dispositional legitimacy. When engagement scopes remain contractually defined and management-mediated, auditors’ perceived independence and challenge capacity may be weakened. While pragmatic legitimacy can be maintained through client-oriented exchanges and the formal validation of reporting frameworks, the absence of systematic risk-based verification risks reinforcing symbolic legitimacy, whereby assurance signals compliance without fully substantiating sustainability performance.

Within the SEGAP framework, this uneven distribution of legitimacy illustrates how sustainability assurance stabilizes early CSRD implementation while simultaneously limiting its capacity to verify substantive SDG contributions. In this sense, the SEGAP reflects not merely a communication gap but a structural governance condition. Contractual arrangements, fragmented standards, regulatory volatility and limited methodological tools jointly shape what sustainability assurance can realistically achieve during this transitional phase.

This study introduces the SEGAP to explain how auditors interpret the principle of double materiality to reveal the emerging legal understanding in audit practice. Drawing on 17 expert interviews with auditors in Germany and Austria, our findings show that double materiality is navigated within an assurance environment dominated by financial-materiality logics.

Extending legitimacy theory through the SEGAP lens, the study contributes to sustainability accounting research by revealing to what extent sustainability assurance affects structural audit and perception gaps (Aliyu, 2024). Sustainability assurance therefore stabilizes procedural and pragmatic legitimacy but only partially delivers substantive accountability. Moral and dispositional legitimacy remain structurally constrained by management-defined DMA boundaries. Our findings reveal as well agency dynamics, as regulatory ambiguity and incomplete transposition encourage managerial capture. Under these conditions, professional judgment is enacted within procedural boundaries rather than through substantive challenge.

Our findings reveal systemic weaknesses. Sustainability assurance generates the appearance of procedural rigor without systematically validating impact-related disclosures (Boiral and Heras-Saizarbitoria, 2020; Correa-Mejía et al., 2024; Kühle and Quick, 2025). Greenwashing, omission risks and broader ESG risks remain outside the auditable scope. The resulting gap between regulatory ambition and professional deliverability becomes structurally embedded, reinforcing the SEGAP as a structural feature of transitional sustainability governance.

Only reasonable assurance would create the structural conditions for deeper, risk-oriented verification. Absent such an approach, assurance risks reinforcing symbolic rather than substantive legitimacy and thereby sustaining the SEGAP.

The implications are threefold. First, symbolic stakeholder integration and a plausibility-based audit approach indicate the transformative limitations of the CSRD. Limited assurance structurally constrains risk-oriented audit application, sustaining procedural legitimacy while leaving moral and dispositional dimensions fragile.

Second, the distinction between limited and reasonable assurance is central to differentiating symbolic from substantive accountability. Only reasonable assurance consistently enables auditors to apply the risk-oriented audit approach, creating conditions necessary for robust professional judgment in an judgment-intensive field characterized by complex, forward-looking and impact-oriented disclosures.

Third, regulatory clarity is indispensable. Although ISSA 5000 May mitigate limitations of ISAE 3000 (Revised), its effectiveness will depend on clearer guidance on impact materiality, enforceable thresholds for greenwashing and omissions and methodological consistency across jurisdictions.

Theoretically, this study extends legitimacy research by showing how structural constraints jointly affect moral and dispositional legitimacy, even when pragmatic legitimacy is maintained. Realigning practice with the CSRD’s intent requires strengthening ESG literacy, embedding systematic stakeholder integration and elevating ethical reasoning in audit training through national standards such as WTBG and WPO. Auditors must become proficient in this new subject matter. Otherwise, assurance risks devolving into a formalistic exercise – technically sound, yet normatively hollow. Metaphorically extending this theoretical view through Boltzmann’s (1877) concept of entropy, assurance can be seen as an adaptive system. It reduces uncertainty through structured procedures, yet remains dynamic through principled coherence, stakeholder inclusivity and iterative calibration. Reconceptualized in this way, double materiality becomes a question of systemic significance rather than client-driven classification exercise. This reframing embeds epistemic values and nonepistemic values at the core of practice. In doing so, assurance supports legitimacy and helps to close the SEGAP.

This research has limitations. The analysis focuses on auditor perspectives. Stakeholder perspectives were not examined. Future research should therefore investigate how different user groups interpret sustainability assurance and whether limited assurance is perceived as sufficient for SDG-relevant disclosures or whether stronger assurance levels are required for such information to become decision-useful.

From the perspective of the SDGs, the findings indicate that, in the current transitional phase of the CSRD, sustainability assurance primarily strengthens institutional transparency and accountability structures associated with SDG 16. However, the capability of auditors to substantively support environmentally oriented goals such as SDGs 9, 12 and 13, as well as social objectives associated with SDG 5, remains limited due to the predominance of plausibility-based audit approaches, highlighting the need for further research on whether more risk-oriented assurance methodologies are desired by report users and for which types of sustainability disclosures.

The study is context-specific to Germany and Austria during a period of regulatory transition. Although these jurisdictions provide valuable insights into emerging assurance practices, comparative research across EU member states and beyond would help identify broader institutionalization trajectories and persistent implementation challenges.

The study focuses primarily on the audit gap within the SEGAP framework. While interviews indicate that contractual scope definitions and regulatory ambiguity shape professional judgment, the articulation of liability boundaries and scope limitations in published assurance reports was not examined. Future research should therefore analyze assurance reports as communicative artifacts of sustainability governance, investigating how auditors frame scope limitations, uncertainty and liability exposure, and how these disclosures shape stakeholder interpretations of sustainability assurance and the persistence – or potential narrowing – of the SEGAP.

Overall, this study shows that sustainability assurance under the CSRD can contribute to strengthening transparency and institutional accountability. However, its capacity to substantively support sustainable development depends on the further evolution of assurance methodologies, regulatory clarity and alignment between stakeholder expectations and the structural capabilities of auditors.

By conceptualizing and empirically grounding the SEGAP, this study advances both the theory and practice of sustainability assurance. The findings indicate that delays in legal transposition and management-defined engagement boundaries currently constrain the effective navigation of double materiality. As a result, the CSRD’s intended dual reporting–assurance framework remains only partially realized. While limited assurance stabilizes procedural accountability, our findings suggest that more comprehensive assurance approaches – potentially including reasonable assurance – may offer greater potential for auditors to substantively verify impacts and support the achievement of substantive SDG-related sustainability outcomes.

The author thanks the interview partner for their valuable insights. The author also acknowledges funding for proofreading from the Förderfonds JKU/L and OÖ.