What Is an ESG Audit? A UK SME Preparation Guide

"ESG audit" is one of those phrases that gets used loosely. It can mean a formal third-party assurance engagement, a customer's verification of your questionnaire answers, an internal review before you submit data, or an energy audit you are legally required to complete. For a UK SME, the version you are most likely to meet is a customer or assessor checking whether the sustainability claims you made stand up to evidence.

This guide explains what an ESG audit actually involves, the different forms it takes, and — most usefully — how to prepare so that whatever scrutiny arrives, your answers hold.

What an ESG audit checks

At its core, an ESG audit tests one thing: can you substantiate what you claimed? If you told a customer your Scope 1 and 2 emissions were 42 tonnes CO2e, an audit asks to see the energy bills, the conversion factors, and the calculation behind the number. If you said you have a modern slavery policy, it asks to see the policy and evidence it is implemented.

The audit is not primarily about whether your performance is good or bad. It is about whether your reporting is accurate and supported. A modest, honest, well-evidenced answer survives an audit; an impressive but unsupported claim does not.

The forms an ESG audit takes for an SME

1. Formal third-party assurance

Large companies reporting under the EU's Corporate Sustainability Reporting Directive must obtain independent assurance over their sustainability reports. The CSRD introduced an EU-wide requirement for limited assurance, applying from 2025 over financial-year 2024 reporting. A move to the more demanding "reasonable assurance" standard had originally been planned, but the 2026 EU Omnibus simplification package removed it — limited assurance is now the standing, permanent requirement, with no future step-up to reasonable assurance. In practice this assurance is currently carried out under the international standard ISAE 3000 (Revised), the standard for assurance engagements other than audits of historical financial information.

As a UK SME you are very unlikely to commission this yourself. But it matters to you because your data feeds your customer's assured report — so the figures you supply may be examined by their assurance provider. Data that cannot be traced to a source is a problem for them, and therefore a problem for you.

2. Customer or buyer verification

The most common "audit" an SME faces is a customer checking the answers on a returned questionnaire. They may ask for backing evidence, request a follow-up call, or run your responses past their own sustainability team. Platforms like EcoVadis score documented evidence rather than self-declarations — an unsupported "yes" earns nothing.

3. Statutory energy audits

If your organisation is large enough to fall within the Energy Savings Opportunity Scheme, you must complete a mandatory energy audit. See our guide on ESOS Phase 3 for who is in scope and the audit cadence. Most small SMEs fall below the threshold, but it is worth checking each year.

4. Internal pre-submission review

The audit you control. Before sending data to a customer, review it yourself: is every figure traceable, every policy current, every claim defensible? An internal review costs little and catches the errors an external one would penalise.

How to prepare for an ESG audit

Preparation is mostly about evidence discipline. The companies that sail through scrutiny are the ones that can produce the source behind every claim quickly.

Build an evidence trail for every number

Every quantitative claim should trace back to a source document: energy bills behind emissions figures, the DEFRA conversion factors used, the reporting period covered. A number with no working behind it is the first thing an auditor flags. Our guide on organising your ESG evidence covers how to structure this.

Keep policies current and dated

Auditors check whether policies are real and applied, not just whether they exist. A modern slavery statement, environmental policy, or anti-bribery policy should be current, dated, and ideally show evidence of implementation. See our guide on modern slavery statement requirements for what a credible statement contains.

Write down your methodology

For any calculated figure, a short methodology note — what you measured, which factors you used, the reporting period, what is included and excluded — pre-empts most audit questions. It signals competence and saves the back-and-forth.

Keep answers consistent across submissions

A frequent audit finding is the same data point reported differently to different customers. If your EcoVadis submission says one thing and a bank questionnaire says another, the inconsistency undermines both. Maintaining one source of truth for each fact is the simplest defence.

Be honest about gaps

If you have not measured something, say so. "Not yet measured" is a defensible position; a fabricated or padded number is not. Auditors respect a clear, honest gap far more than an unsupported claim.

An ESG audit readiness checklist

Energy and emissions figures trace to source bills and stated conversion factors
A methodology note accompanies every calculated figure
Key policies (environmental, modern slavery, anti-bribery, H&S, data protection) are current and dated
Each fact is reported consistently across all customer submissions
Gaps and exclusions are stated explicitly, not hidden
Reporting period is clearly labelled on every figure
Evidence documents are stored where you can retrieve them quickly

Frequently asked questions

What is an ESG audit? An independent or internal check that the sustainability claims in your reporting are accurate and supported by evidence. It tests the reliability of your reporting, not just your performance.

Do small businesses need an ESG audit? Most UK SMEs are not legally required to obtain formal third-party assurance. But they routinely face customer verification of questionnaire answers, and some are in scope for statutory energy audits under ESOS. Preparing as though an audit could happen is the practical stance.

What is the difference between limited and reasonable assurance? Limited assurance gives a moderate level of confidence (the assurer concludes nothing has come to their attention suggesting the information is wrong). Reasonable assurance is higher — closer to a financial audit's level of testing. CSRD requires limited assurance; a previously-planned move to reasonable assurance was removed by the 2026 EU Omnibus simplification package, so limited assurance is now the standing requirement.

How do I prepare for an ESG audit? Build an evidence trail behind every number, keep policies current and dated, document your methodology, report each fact consistently, and be explicit about any gaps.

How AnswerVault will help

AnswerVault is built around exactly the discipline an audit rewards: every fact stored with its supporting evidence, a methodology note, and a record of which version was sent to which customer. When scrutiny arrives, the evidence trail is already there — and consistent across every submission.

Try AnswerVault free to get started.

Sources

ISAE 3000 (Revised) — International Auditing and Assurance Standards Board (IAASB), Assurance Engagements Other Than Audits or Reviews of Historical Financial Information. The standard currently used for sustainability assurance under CSRD.
CSRD Directive — Directive (EU) 2022/2464 of the European Parliament and of the Council, 14 December 2022. Official Journal of the European Union, L 322. Introduces the EU-wide assurance requirement (limited assurance from financial year 2024). The 2026 Omnibus simplification directive (Directive (EU) 2026/470) subsequently removed the planned move to reasonable assurance, retaining limited assurance only.
UK Government GHG Conversion Factors — published by the Department for Energy Security and Net Zero (DESNZ; formerly BEIS/DEFRA), Government conversion factors for company reporting. The evidence base behind UK emissions figures.

This article provides general guidance for UK SMEs preparing for ESG audits and assurance. It is not audit, assurance, or legal advice. Assurance requirements, applicable standards, and their timelines change — if you are within scope of CSRD assurance or statutory energy audits, confirm the current position with your assurance provider or auditor. The IAASB and EU published standards are the definitive references.