Double Materiality Assessment Audit: Checklist (2026)

The double materiality assessment (DMA) decides what goes into your sustainability statement, so it is also the first thing your assurance provider will want to understand. Whether you are a sustainability manager preparing for limited assurance, a CFO signing off the report or an internal auditor asked to evaluate whether the process is robust enough, the question is the same: what will the auditor look at, and can we show it?

In short: Under the CSRD, the assurance engagement covers the process used to identify the reported information, which is the DMA. After Omnibus I, this remains limited assurance: the auditor mainly obtains an understanding of your process and checks whether it is consistent with your ESRS 2 IRO-1 description and the revised ESRS. Be ready to show who owns and approved the DMA, why you concluded top-down (§27) or bottom-up (§28), where you did not look and why (§32), how stakeholder input fed in (§42), how you scored gross vs. net (§43) and positive impacts (§44), how thresholds were set, and a complete audit trail including the date of the last update (§34). The checklist below covers 30 points.

This article explains what limited assurance means for your DMA and gives you a practical checklist you can copy into your own audit file. It reflects the revised ESRS adopted in 2026; all DMA changes are explained in our article on the double materiality assessment under the revised ESRS.

What limited assurance means for the DMA

Limited assurance is the only level that applies. The Omnibus I Directive (EU) 2026/470 dropped the planned move to reasonable assurance; companies in scope (now more than 1,000 employees and more than €450 million net turnover) receive limited assurance on their sustainability statement. Our article on VSME vs ESRS after Omnibus summarises the new scope.

The process itself is in scope. Under the CSRD, the assurance provider expresses a conclusion not only on whether the sustainability statement complies with the ESRS, but also on the process the company carried out to identify the information reported. In practice, this means your DMA.

The procedures are lighter than in a financial audit, but not superficial. A limited assurance conclusion is phrased negatively ("nothing has come to our attention that causes us to believe…"). According to the CEAOB guidelines, assurance providers should place particular emphasis on the DMA process: obtain an understanding of it, assess whether the description in the sustainability statement is consistent with the process actually implemented, and determine whether the process meets the ESRS requirements. Typical techniques are inquiry, inspection, observation, recalculation, reperformance and analytical procedures; detailed tests of details or controls are not required. Expect considerably more time on the process in the first year than in later years.

Which standard? The CSRD provides for an EU limited assurance standard to be adopted by the European Commission. Until it applies, assurance providers use the non-binding CEAOB guidelines on limited assurance (September 2024) together with international or national standards, most commonly ISAE 3000 (Revised). Ask your provider early which framework they apply and which documents they expect.

What the auditor compares your DMA against

Three reference points matter:

1. The revised ESRS 1 requirements for the assessment: top-down and bottom-up approaches (§27, §28), undue cost or effort and no exhaustive IRO search (§32), value chain (§33), updates (§34), stakeholder engagement (§42), gross vs. net (§43), positive impacts (§44), severity and likelihood (§40), financial materiality (§50).
2. Your own description in ESRS 2 IRO-1. If you describe a process, the auditor will check that it is consistent with what you actually did. A concise, specific description is safer than an ambitious, generic one.
3. Your disclosures. Material IROs listed in ESRS 2 IRO-2 and described in SBM-3 must match the DMA result, and immaterial information should not appear in the statement (§24).

The DMA audit checklist

Use the tables below as a pre-assurance review. Each line names the check, the evidence an auditor may ask for and the relevant ESRS reference. Paragraph numbers refer to the revised ESRS 1 unless stated otherwise.

A. Governance and ownership

#	Check	Evidence	Reference
1	A named owner is responsible for the DMA, with clear roles for sustainability, finance, risk, HR and procurement	Project charter, responsibility matrix	ESRS 2 governance disclosures (GOV)
2	The methodology (scales, criteria, thresholds) was approved before scoring started	Dated approval by CFO or steering committee	ESRS 2 IRO-1
3	The results were approved by the management body and presented to the supervisory body or audit committee	Board minutes, presentation	ESRS 2 governance disclosures (GOV)
4	The DMA is connected to enterprise risk management and due diligence	Mapping of financial risks to the risk register	ESRS 2 IRO-1
5	For FY2026, the chosen option (2023 ESRS, revised ESRS, or 2023 ESRS with reliefs) is decided and stated	Board decision, statement wording	Delegated Regulation (EU) 2026/1563

B. Scope, process and methodology

#	Check	Evidence	Reference
6	The value chain is mapped (upstream, own operations, downstream) and data sources are documented	Value chain map, list of sources incl. sector or regional data	§33
7	For each topic, the approach (top-down or bottom-up) is documented with a rationale	Topic-level conclusion with reasoning	§27, §28
8	Where the outcome was not evident, a specific IRO-level assessment was carried out	IRO list and scores for these topics	§28
9	The rationale for where you looked, and where you did not, is documented	Note on scope of the IRO search, information used	§32
10	The ESRS topic list was used as an input, and topics not assessed in detail are explained	Topic list with conclusions	Appendix A (non-binding)
11	Time horizons are applied consistently (short term = reporting period, medium up to 5 years, long more than 5 years)	Time horizon per IRO	ESRS 1

C. Stakeholder input

#	Check	Evidence	Reference
12	Affected stakeholders and users of the sustainability statement are identified	Stakeholder map with prioritisation	ESRS 1, ESRS 2 IRO-1
13	Engagement is documented; due diligence engagement and credible proxies (e.g. NGOs, trade unions) are acceptable	Engagement log, interview notes, survey results	§42
14	It is traceable how stakeholder input influenced individual IROs or scores	Link from input to IRO, comments	ESRS 2 IRO-1

D. Scoring and thresholds

#	Check	Evidence	Reference
15	Negative impacts are scored on severity (scale, scope, irremediable character) and, if potential, likelihood	Scoring scales with definitions	ESRS 1
16	For potential human rights impacts, severity takes precedence over likelihood	Scoring rule and its application	§40
17	Actual impacts are assessed as they manifested; potential impacts are reduced only by implemented and effective measures, not planned ones	Note on gross/net logic, list of measures considered	§43
18	Positive impacts are assessed on their own, without netting; compliance and remediation of own impacts are not counted as positive	Separate positive impact scores	§44
19	Risks and opportunities are scored on likelihood and potential magnitude of financial effects, with scales calibrated to the company	Financial scales, link to ERM scales	§50
20	Thresholds are justified, and borderline results are discussed and documented	Threshold rationale, calibration minutes	ESRS 2 IRO-1
21	The aggregation from IRO to topic is explained	Aggregation rule	ESRS 2 IRO-1

E. Results and disclosure

#	Check	Evidence	Reference
22	IRO-1 gives a concise, company-specific process description, significant changes to it and the date of the last update	Draft disclosure	ESRS 2 IRO-1, §34
23	Material IROs are listed and their interaction with strategy and business model is described	Draft disclosures	ESRS 2 IRO-2, SBM-3
24	Material topics map completely to the disclosures reported, and immaterial information is not disclosed (supplementary information is clearly labelled)	Datapoint mapping, review of draft statement	§24, §§107–108
25	If climate change is concluded not material, the basis for that conclusion is disclosed	Rationale	ESRS 2 IRO-2 §37(b)
26	ESRS 2 judgements are consistent with the revised logic that ESRS 2 disclosures are likely to be material for all undertakings	Note on ESRS 2	Revised ESRS

F. Documentation and evidence

#	Check	Evidence	Reference
27	Every change to an IRO, score or threshold is logged with who, when and why	Audit trail, change log	ESRS 2 IRO-1
28	The version used for the report is frozen at the reporting date and later changes are traceable	Version history, export with date	ESRS 2 IRO-1
29	Evidence (documents, data, interview notes) is attached to the IROs it supports	Linked documents	ESRS 2 IRO-1
30	At each reporting date, the check for significant changes is documented, including the conclusion if nothing changed	Annual review note, date of last update	§34

For the inputs behind items 6 to 13, our DMA document checklist lists which internal and external documents to collect. If you want to see what a complete, documented assessment looks like, read our worked double materiality assessment example.

Common weaknesses in DMA documentation

From the assessments we see, the same gaps come up again and again. All of them are fixable before the auditor arrives:

• Thresholds set after scoring. If the approval date of the methodology is later than the first scores, expect questions. Approve scales and thresholds first.
• Net scoring with planned measures. Potential impacts reduced by measures that start next year contradict §43.
• Top-down conclusions without reasoning. "Not material" is a conclusion, not a rationale. Two or three sentences on business model, sites and value chain are usually enough.
• No record of where you did not look. §32 relieves you from an exhaustive search, but you still need to show that the areas where material IROs are likely to arise were covered.
• Stakeholder input that leads nowhere. Survey results in an appendix that are not linked to any IRO or score.
• A matrix without a file behind it. A materiality matrix is a communication tool. What the auditor tests is the process, the criteria and the evidence.
• Spreadsheets without version history. When scores change between workshops and nobody can say who changed what, traceability is lost.
• Inconsistency between DMA and report. Topics material in the DMA but missing in the statement, or immaterial information reported anyway.
• Boilerplate IRO-1 text. The revised ESRS ask you to avoid generic descriptions. Describe what you actually did.

The internal audit and CFO perspective

Internal audit is often asked to evaluate whether the DMA process is robust before external assurance starts. The checklist above works as a work programme. Useful procedures are a walkthrough with the DMA owner, re-performing the scoring for a sample of IROs, tracing stakeholder input to results, comparing material topics with the draft statement, and inspecting the change log for late or undocumented changes.

For CFOs, three points deserve attention. First, financial materiality scales should be calibrated to the company's existing risk management, so that a sustainability risk rated "high" means the same as any other high risk. Second, the risks identified in the DMA should be consistent with the risks reported elsewhere in the management report. Third, the DMA sets the scope of the reporting effort: every topic concluded as material triggers disclosures and data collection, so the robustness of the assessment directly affects cost.

If your company also reports under ISSB standards, the assurance focus is on financial materiality only, but the same documentation discipline applies. See our comparison of ISSB vs ESRS materiality assessments.

How Materiality Master supports assurance readiness

Materiality Master is built so that the evidence exists as a by-product of the work, not as a separate documentation exercise afterwards:

• The audit trail logs every change to IROs, scores and fields with user, timestamp, previous and new value.
• Thresholds are configured and documented in the tool.
• Documents and comments can be attached to the IROs they support.
• Stakeholders are rated on interest, influence and knowledge (stakeholder matrix) and linked to individual IROs with an explanation of their involvement; key stakeholders can be invited as users with restricted rights to rate specific IROs.
• Results export to Excel and PDF for the audit file, and the ESRS Datapoints Mapping Tool translates material topics into the revised ESRS datapoints, which supports check 24.

Key takeaways

• The DMA process is in scope of CSRD assurance, and after Omnibus I assurance remains limited.
• The auditor compares your DMA with the revised ESRS 1, your IRO-1 description and your disclosures.
• The most important evidence is approved methodology before scoring, reasoning for top-down conclusions and for areas not assessed, gross/net logic, traceable stakeholder input and a complete change log.
• Under §34, document your annual check for significant changes and the date of the last update.
• Run the 30-point checklist as a pre-assurance review, ideally with internal audit, before the external provider starts.

New to the DMA or still deciding how to run it? Start with our step-by-step guide to the CSRD double materiality assessment, or compare the options in double materiality assessment software vs. consultants. Plans and prices are on our pricing page.