The AICPA Comment Period on AT-C 325 and 330 Closes June 30 — Firms That Miss It Won't Just Miss the Debate, They'll Miss the Market

The firms submitting substantive comments to the AICPA's Auditing Standards Board before June 30 are not performing civic duty. They are writing the rules that every other firm will spend the next decade paying to comply with. AT-C Section 325 and AT-C Section 330 represent the US attestation framework's first sustainability-specific standards, and whoever shapes their final language controls the liability parameters, practitioner qualification thresholds, and service-line scope definitions for an assurance market where 84% of accounting firms expect to offer sustainability or ESG data assurance services within three years. The comment period is a market-entry instrument. Treating it as a regulatory formality is a strategic error.

What AT-C 325 and 330 Actually Propose, and Why the Assurance Level Distinction Will Define Your Liability Profile

The exposure draft published February 26, 2026 introduces two subject-matter specific standards. AT-C Section 325 covers examination engagements on sustainability information, requiring the practitioner to express a positive opinion that the information is fairly stated in all material respects. AT-C Section 330 covers review engagements, requiring only negative assurance: nothing came to our attention to suggest material misstatement.

These two standards sit on opposite ends of the professional liability spectrum. The IAASB's companion standard, ISSA 5000, effective December 15, 2026, characterizes the gap precisely: "the level of assurance obtained in a limited assurance engagement is substantially lower than the assurance that would have been obtained had a reasonable assurance engagement been performed." In practice, AT-C 325 examination engagements carry substantially higher documentation standards, evidence sufficiency requirements, and professional liability exposure than AT-C 330 reviews.

Which standard your firm decides to offer, under what scope limitations, and to which client segments is a service-line architecture decision. The current exposure draft is where those decisions get encoded into binding professional standards, with an effective date of June 15, 2029 and adoption anticipated in 2027.

The Comment Period Is Not Civic Participation: Submitting Now Means Writing the Rules Everyone Else Follows

The firms sending substantive comment letters to commentletters@aicpa-cima.com before June 30 are influencing the final definitions of "sustainability information," the practitioner competency requirements that will screen out under-resourced competitors, and the scope carve-outs that determine whether reviewing a single GHG emissions calculation constitutes a full AT-C 325 examination or something narrower with a proportionally smaller liability footprint.

This is precisely how every major attestation standard has worked. The firms that engaged seriously with the SSAE No. 18 exposure draft understood the trust services criteria and SOC report market years before competitors caught up. The parallel is direct. The comment letters that arrive before June 30 will shape the materiality guidance, practitioner qualification thresholds, and documentation requirements that appear in the 2027 adoption document. Firms submitting those letters are not just commenting. They are auditing the rulemaking process from the inside and hedging their future compliance costs in the process.

The Credential Gap: Sustainability Assurance Requires a Skill Set Your Roster Almost Certainly Doesn't Have

EY's Corporate Reporting Survey found that only 29% of finance leaders believe their teams currently have the skills to manage sustainability-related reporting, and that figure reflects the client side, before the practitioner-side competency requirements enter the picture. The skill combination sustainability assurance demands is genuinely unusual: professionals need simultaneous fluency in PCAOB-style attestation procedures (evidence sufficiency, sampling methodology, documentation chains) and substantive framework knowledge spanning GRI, ISSB standards, CSRD's European Sustainability Reporting Standards, and the US-specific California SB 253 Scope 1 and 2 requirements.

The Texas Society of CPAs documents that most early-career professionals have limited sustainability education at the academic level, and that the AICPA Fundamentals of ESG Certificate, GRI Professional Certification, and IFRS FSA designation each address different components of the required competency without covering it fully. A practitioner credentialed in attestation standards but untrained in double materiality assessment is not ready for AT-C 325 work. Neither is an ESG specialist with no SSAE background.

Mid-market firms cannot hire their way out of this gap quickly. The supply of professionals combining both skill sets is thin. ESG roles in the EU grew 28% year-over-year in 2025, with 82% requiring data or regulatory expertise. The Big 4 have been absorbing available talent for years.

The Big 4 Already Have Dedicated Sustainability Practices, and Here Is the Precise Mid-Market Window

Deloitte operates a named Sustainability and Emerging Assurance practice. EY has more than 100 sustainability specialists embedded across client-serving teams. PwC has publicly projected that sustainability audits will eventually surpass financial audits in revenue value, with ESG-related revenue already growing 20% in the last fiscal year. These firms are not preparing for this market; they are already in it with documented methodologies, trained staff, and multi-year engagement precedent.

The mid-market window is specific and time-constrained. California's SB 253 requires assured Scope 1 and Scope 2 emissions disclosures for companies with over $1 billion in California revenue, starting with 2026 data. SB 261 extends climate risk reporting requirements to companies over $500 million. The downstream pressure on supply chain partners will push assurance demand into the middle market regardless of those companies' own direct regulatory obligations. According to CPA.com's analysis, 58% of companies already depend on their accounting firms as external vendors for ESG work, and thousands of middle-market entities now face sustainability disclosure requirements at state, federal, and international levels.

Critically, only 23% of sustainability assurance work in the United States is currently being performed by CPAs, despite 70% of S&P 500 companies that reported ESG information in 2022 obtaining assurance on it. That gap between demand and CPA delivery represents the clearest available market signal for mid-market firms moving in the 2026-2027 window, before the standards finalize and before the Big 4 scale capacity to absorb remaining demand.

The Liability Frontier: Pricing and Insuring a Service When the E&O Framework Is Still Being Written

Reasonable assurance engagements under AT-C 325 require a positive opinion on information that is, by its nature, estimated, framework-dependent, and subject to active regulatory revision. GHG emissions calculations rely on emission factors the EPA revises periodically. Supply chain metrics depend on third-party data of variable quality. ISSB and CSRD methodologies remain in active development. Practitioners expressing positive opinions under AT-C 325 will be opining on a moving target using criteria that may themselves be amended before the engagement report is issued.

The professional liability insurance market has not fully priced this. Carriers covering financial statement audit exposure are currently treating sustainability assurance as a line extension, without fully accounting for estimation risk, framework ambiguity, or the absence of an established case law body defining material misstatement in the context of Scope 3 emissions data or biodiversity metrics. Firms entering AT-C 325 examination engagements before their carriers update coverage assumptions are absorbing unquantified tail risk.

This is precisely why the comment period carries liability significance. The scope limitations, materiality guidance, and practitioner competency thresholds written into the final AT-C 325 standard will determine what practitioners are and are not required to do in an examination engagement. Narrower scope definitions reduce engagement risk. Clearer materiality guidance reduces the dispute surface area. Firms submitting substantive comments on these provisions are actively managing their future E&O exposure profile, while firms that ignore the comment period will inherit whatever risk structure the participating firms engineered.

Build, Partner, or Wait: The Hidden Cost Inside Each Posture

Firms evaluating their sustainability assurance strategy are choosing among three postures, and none of them are free.

Building internal capability requires recruiting practitioners with the dual attestation-and-ESG competency profile, funding certification programs, and absorbing a service-line investment that won't generate material revenue until 2027 at the earliest given the 2029 effective date. The real cost is a two-year runway of investment in a talent market that the Big 4 have already thinned.

Partnering with a sustainability consultancy or ESG specialist addresses the credential gap more quickly, but it creates a shared-liability structure on engagements where the attestation standards require a licensed CPA to sign the report. The partner can generate the evidence. The CPA firm absorbs the professional liability.

Waiting looks free and is not. Firms that wait for final AT-C 325 and 330 adoption before building capability will be entering a market where the Big 4 hold years of engagement precedent, where mid-market firms that moved early have locked in client relationships under multi-year advisory agreements, and where the practitioner talent pool has been further depleted by competitors who read the comment period deadline as the market signal it actually is.

June 30 is not an arbitrary bureaucratic milestone. It is the clearest available signal of which firms are treating sustainability assurance as a core service line and which are planning to comply with whatever those firms decide.