The verification body crisis nobody is talking about

As the sustainability assurance market approaches $5.4 billion by 2031, the infrastructure meant to make it credible is dangerously under-built.

There is a paradox at the heart of the current sustainability disclosure revolution. Regulators are mandating transparency. Investors are demanding assurance. Reporting frameworks are multiplying. And yet the one actor that sits between a company's claim and a stakeholder's trust, the verification or validation body, remains largely invisible in the policy conversation.

This article is about that gap. And about why it is becoming structurally dangerous.

A market expanding faster than its quality infrastructure

The global sustainability assurance market is projected to grow from USD 1.88 billion in 2025 to USD 5.43 billion by 2031, at a compound annual growth rate of 19.3%, one of the fastest-growing segments in professional services (Source: LPI Market Research, 2025).

The demand signal is clear. According to the latest study by IFAC, AICPA & CIMA, The State of Play: Sustainability Disclosure and Assurance (2025), 73% of the world's largest companies now obtain some form of external assurance on their sustainability disclosures. In 2019, that figure was just 51%. Greenhouse gas emissions remain the most commonly assured category.

And yet, despite this volume, the KPMG ESG Assurance Maturity Index 2025, based on 1,320 senior executives across global organizations, reveals that 76% of companies remain in the early or mid-stages of ESG assurance maturity. The gap between volume and quality is not closing. It is widening.

The reason? The supply side; competent, independent, accredited verification and validation bodies (VVBs), has not scaled proportionally.

What ISO 17029, ISO 14065, and ISO 14066 actually require

Let me be precise, because this matters.

ISO/IEC 17029:2019, Conformity Assessment: General Principles and Requirements for Validation and Verification Bodies, is the foundational standard for any organisation seeking to operate as a VVB. Published in 2019 and confirmed as current by ISO in 2025, it defines requirements across six dimensions: impartiality management, competence of personnel, validation/verification processes, appeals and complaints, documentation, and management systems.

ISO 17029 is deliberately generic. It does not operate alone. It works in combination with sector-specific programme standards. In the climate and sustainability space, the key layer is ISO 14065:2020, which defines requirements for bodies that validate and verify environmental information, and ISO 14066:2023, which specifies the competence requirements for the teams conducting those engagements.

At the process level, ISO 14064-3:2019 provides the engagement-level methodology: how to plan, execute, and report a GHG (Greenhouse Gases) verification or validation. It covers the selection of assurance level (limited vs. reasonable), materiality thresholds, evidence-gathering plans, treatment of nonconformities, and the structure of the verification/validation opinion.

And in 2026, this family expanded further: ISO 14064-5:2026 now provides specific guidance on remote verification and validation techniques, an essential development post-COVID that addresses the practical reality of multi-site, multi-country engagements where physical site visits carry disproportionate cost and risk.

The architecture is robust. The problem is that very few organisations have built themselves to operate within it with rigour.

The accreditation bottleneck

ISO 17029 was designed to serve as the basis for third-party accreditation by national accreditation bodies (NABs). In the EU, accreditation under Regulation (EU) 2018/2067,  the verification and accreditation regulation for the EU Emissions Trading System (EU ETS), has been operational for years. German DAkkS, French COFRAC, UK UKAS and others have established programmes.

But outside the regulated perimeter of EU ETS, CORSIA, and a handful of voluntary carbon markets, accredited VVBs remain rare.

The reasons are structural:

• Accreditation under ISO 17029 requires significant upfront investment in documented management systems, competence frameworks, impartiality committees, appeals mechanisms, and internal audit processes, before any revenue is generated.

• The multi-year accreditation cycle (typically 2–3 years from initial enquiry to full accreditation) creates a lag between market demand and accredited supply.

• The competence requirements under ISO 14066 are demanding: sector-specific technical expertise, verification methodology training, and demonstrated audit experience must be combined in a single team.

• Many organisations claim to offer "verification" services without any accreditation, a practice that creates noise in the market and erodes trust in genuine VVBs.

The result: the market is absorbing demand through a mix of Big 4 audit firms (operating under ISSA 5000 and ISAE 3000 frameworks rather than ISO 17029), unaccredited consultancies, and a limited pool of genuinely ISO 17029-accredited bodies whose capacity is already stretched.

The coming collision: ISSA 5000 vs. the ISO 17029 framework

The most consequential regulatory development for VVBs right now is the entry into force of ISSA 5000, the International Standard on Sustainability Assurance, approved by the IAASB in September 2024, published in November 2024, and effective for periods beginning on or after 15 December 2026.

ISSA 5000 is designed for accounting professionals. It is framework-neutral, applicable to CSRD (Corporate Sustainability Reporting Directive) /ESRS (European Sustainability Reporting Standards), ISSB/IFRS S1-S2, GRI, and other criteria, and it covers both limited and reasonable assurance. Under the CSRD's assurance timeline, EU companies must meet limited assurance standards from 1 October 2026, with EU-wide standards expected to align with ISSA 5000.

Note: 

The Omnibus I Directive (EU 2026/470) has delayed CSRD reporting obligations by two years for Wave 2 and 3 companies and is expected to further modify scope and assurance timelines. The framework discussed in this article reflects requirements as they apply to Wave 1 reporters and the trajectory of EU-wide assurance standards.

This creates a structural question that the market has not yet answered honestly:

Is sustainability assurance a financial auditing function, or a conformity assessment function?

Audit firms argue the former. They have the regulatory relationships, the client access, the liability frameworks, and now a purpose-built standard (ISSA 5000) to support their position. Under IFAC data, 55% of global sustainability reports in 2023 were assured by audit firms, down from 58% in 2022 as Other Service Providers (OSPs) gained ground.

ISO 17029-accredited VVBs argue the latter. They have the technical domain expertise (GHG accounting, life cycle analysis, carbon markets, EU ETS), the impartiality structures, the sector-specific competence frameworks, and a governance model , ISO 14065 + ISO 14066 + ISO 17029, specifically designed to ensure the independence and rigour of the verification process.

The CSRD and its assurance requirements do not resolve this tension. They amplify it.

What the numbers reveal about the quality gap

The IFAC data raises a question that the headline percentages obscure: 

Assurance by whom, to what standard, with what level of rigour?

Consider:

• 73% of the largest global companies now obtain some assurance but the majority is limited assurance, a lower evidentiary bar.

• In EU countries (France, Germany, Italy, Spain), audit firms dominate sustainability assurance, yet the same IFAC report notes that approximately 10% fewer reports were assured by audit firms in 2023 vs. 2022, with OSPs growing their share, often in GHG-specific engagements.

• The sustainability certification market (which includes verification services) was valued at USD 2.89 billion in 2024 and is forecast to reach USD 4.90 billion by 2033 (Straits Research, 2025), yet a large proportion of this activity takes place outside any accreditation framework.

• ESG-focused investments globally now exceed USD 35 trillion (Bloomberg, via Straits Research 2025). The credibility infrastructure serving that capital base remains fragmented and under-governed.

Three structural risks for VVBS in 2026

1. Scope creep without competence expansion

The move from GHG verification (a technically defined activity with established methodologies) to full CSRD/ESRS sustainability assurance (covering biodiversity, supply chain, social indicators, governance narratives) represents a massive expansion of scope. ISO 14066 competence requirements were designed for climate-specific work. VVBs entering ESRS territory without appropriate competence profiles, including expertise in double materiality, ESRS topical standards, and internal controls, risk producing opinions that are procedurally compliant but substantively weak.

2. The impartiality illusion

ISO 17029 places impartiality at the centre of its governance requirements. A VVB must manage threats to impartiality; self-interest, self-review, familiarity, advocacy, and intimidation, through a documented impartiality committee and proactive conflict-of-interest procedures. Many organisations operating as de facto VVBs do not have these structures in place. When the same entity that helps a client build its CSRD report also assures it, the impartiality requirement is violated, regardless of what the engagement letter calls it.

3. The accreditation clock vs. the regulatory deadline

With ISSA 5000 effective December 2026 and CSRD limited assurance requirements in force from October 2026, organisations wanting to position themselves as credible VVBs face an accreditation cycle that cannot be compressed. A body applying today, through COFRAC, DAkkS, UKAS, or another IAF-member national accreditation body, would be doing well to achieve full accreditation by late 2027. That is not a criticism of the process; it reflects the legitimate rigour of what accreditation requires: witnessed assessments, documented management systems, demonstrated competence, impartiality reviews, and corrective action cycles.

The problem is that the market demand is already here. Wave 1 CSRD reporters are in their second reporting cycle. Voluntary carbon market programmes are under intensifying scrutiny. Organisations that want to operate as credible, accredited VVBs in this environment needed to start their accreditation journey in 2024, not 2026.

The window has not closed. But it is narrowing. And every month spent building a de facto verification practice without an accreditation roadmap is a month of reputational and commercial exposure that accreditation would have prevented.

What needs to change

At the regulatory level: 

The European Commission and national accreditation bodies need to develop an accelerated accreditation pathway for VVBs seeking to serve the CSRD assurance market, with clear scope definitions distinguishing GHG-specific verification (ISO 14065 + ISO 17029) from broader sustainability assurance (which may require ISSA 5000 licensing frameworks alongside ISO accreditation).

At the institutional level: 

Accreditation bodies need to invest in sectoral technical committees that can process CSRD-scope applications without reducing the rigour of the ISO 17029 assessment. The answer is not to lower the bar, it is to resource the process appropriately.

At the organisational level: 

VVBs, whether new entrants or existing bodies expanding scope, need to treat their management system under ISO 17029 not as a compliance overhead, but as a strategic differentiator. In a market where greenwashing regulation is tightening (EU Green Claims Directive, Green Bond Standard, CSDDD), the accreditation mark will become a commercial signal as much as a technical requirement.

At the competence level: 

ISO 14066 is not optional background reading. The definition of team competence, combining technical expertise, verification methodology, and sector knowledge, must be operationalised into job profiles, training records, CPD plans, and witnessed assessments before the first engagement begins.

The core argument

ESG credibility is not built in reporting software. It is not generated by a framework checkbox or a consultant's stamp. It is produced, or not, in the quality of the verification process: the independence of the verifier, the depth of the evidence-gathering, the robustness of the materiality assessment, and the competence of the team signing the opinion.

The ISO 17029 framework, combined with ISO 14065, ISO 14066, and ISO 14064-3, provides the architecture for this quality. ISSA 5000 provides a parallel path that emphasises accounting rigour. Neither framework is sufficient alone for the full scope of what the market now demands.

The conversation the industry needs to have, urgently, is not "which standard wins." It is: how do we build enough genuinely competent, genuinely independent, genuinely accredited verification capacity to serve a market that is already here?

Because right now, the credibility infrastructure is not keeping pace with the credibility demand.

If you are building or strengthening a verification body under ISO 17029, or navigating CSRD assurance as a Wave 1 reporter, I work with both. Feel free to connect.

illuminem Voices is a democratic space presenting the thoughts of leading Sustainability & Energy writers, their opinions do not necessarily represent those of illuminem.

Track the real‑world impact behind the sustainability headlines. illuminem’s Data Hub™ offers transparent performance data and climate targets of companies driving the transition.