Guidance

Clean Heat Market Mechanism: verifying annual fossil fuel boiler sales reports

Published 15 May 2025

This is guidance for verifying organisations on how to carry out independent assurance of annual fossil fuel boiler sales data, as required under the Clean Heat Market Mechanism (CHMM) Regulations 2025 No.81.

You should read this guidance with the CHMM Regulations. It is not intended to provide details of all the possible activities you may need to complete as a verifier as part of your assurance activities.

This guidance may also be useful to Scheme Participants who are preparing for their independent third-party verification. They need to follow the guidance on:

• who the scheme applies to and annual tasks
• how fossil fuel boiler sales, targets and credits work
• how to report online and get credits

Scheme Participants must seek their own legal advice, as appropriate, to make sure they comply with the CHMM scheme rules.

1. Context

The CHMM Regulations require suppliers of fossil fuel boilers to meet a low-carbon heating target. This requirement can be met by gaining credits through the installation of qualifying heat pumps. They also set out rules for registration and reporting fossil fuel boiler sales to the Scheme Administrator.

For groups of companies, a Responsible Undertaking within the group must assume the responsibility to report the fossil fuel boiler sales from across the group. The party responsible for providing the annual sales data is referred to as the ‘Scheme Participant’ throughout this guidance.

While the Regulations refer to verification and verifiers, the International Standard on Assurance Engagements 3000 Revised (ISAE 3000 (R)) uses the term ‘practitioner’ as the person who provides assurance. ‘Verifiers’ and ‘practitioners’ are used interchangeably within this guidance and should be understood to mean the same thing.

ISAE 3000 (R) refers to the engagement partner as the person who manages the engagement, its performance, and for the assurance report that is issued on behalf of the organisation. This may or may not be the same person as the practitioner who is the individual conducting the verification.

2. The purpose of verification and its requirements

Verification provides the Scheme Administrator with assurance of the Scheme Participants’ annual fossil fuel boiler sales.

Verification will involve evaluating the systems and processes that generate the required information. The systems and processes themselves are not the sole focus of the verification activities.

2.1 Assurance standards: ISAE 3000 (R)

Relevant annual fossil fuel boiler sales data must be verified by an independent verifier. This verification process must be in accordance with the ISAE 3000 (R) standard.

ISAE 3000 (R) is an international standard developed by the International Auditing and Assurance Standards Board (IAASB). This defines two levels of assurance:

• Limited Assurance – involves limited evidence gathering activities, the assurance opinion is expressed in the negative form
• Reasonable Assurance – involves a higher level of evidence gathering and as such the assurance opinion is expressed in a positive form

By expressing the conclusion in one of the above, the verifier is showing the level of confidence they have in the data being examined. The assurance statement highlights the nature and the extent to which the evidence is gathered by the verifier. As specified in regulation 17 of the CHMM Regulations, the verification must meet the reasonable assurance requirements prescribed in ISAE 3000 R, or an equivalent standard.

Paragraph 11 of ISAE 3000 (R) states:

In all cases when reasonable assurance or limited assurance, as appropriate, cannot be obtained and a qualified conclusion in the practitioner’s assurance report is insufficient in the circumstances for purposes of reporting to the intended users, this ISAE (UK) requires that the practitioner disclaim a conclusion or withdraw (or resign) from the engagement, where withdrawal is possible under applicable law or regulation.

The Scheme Administrator is not aware of any other equivalent standards to ISAE 3000 (R). If a Scheme Participant proposes to use an equivalent standard, they must contact the Scheme Administrator to discuss this as soon as possible, and in any event, before instructing a verifier.

2.2 What needs to be verified?

The following annual data is subject to verification under the Regulations:

• the number of qualifying sales of gas boilers and oil boilers during the sales year and
• the number of excluded sales of gas boilers or oil boilers during the sales year (i.e. the boiler is or is to be installed outside the United Kingdom or in a newbuild property)

The reporting of annual fossil fuel boiler sales data must be accurate to ensure the reliable and accurate calculation of the Scheme Participant’s low carbon heat target.

The CHMM scheme guidance provides more information on the fossil fuel boiler categories and the details that need to be reported.

Fossil fuel boilers that are outside the scope of the CHMM Regulations are not subject to verification. Reasonable assurance should be conducted on the out-of-scope boiler sales to ensure they are properly considered to be out of scope.

3. Roles and responsibilities

The CHMM Regulations define the different parties involved in the verification process. These parties must be aware of their responsibilities.

3.1 Scheme Participants

Scheme Participants are responsible for:

• preparing accurate data and supporting evidence
• submitting their annual boiler sales report, the independent assurance statement, and any supporting information to the Scheme Administrator
• preparing an engagement letter to outline how the information in the report has been interrogated by the business to minimise the risk of material misstatement
• appointing an independent verifier who is competent to undertake assurance against the required standard
• ensuring the appointed verifier has sufficient understanding of the data to be reviewed
• supporting the verifier in contacting and accessing other organisations within the supply chain as necessary
• correcting any data which the verifier finds to be misstated or insufficiently supported by evidence
• informing the Scheme Administrator if errors are discovered after their annual fossil fuel boiler sales data has been submitted
• maintaining records of the information required to be submitted to the Scheme Administrator

3.2 Verifiers

Verifiers are responsible for:

• demonstrating to the Scheme Participant that they have the necessary expertise to undertake the work
• planning and conducting evidence gathering and testing activities to form an opinion on the data
• informing Scheme Participants of any material misstatements within the data, highlighting the effect that these errors may have on the final report
• providing an assurance report to accompany the sales data
• understanding the requirements of the CHMM scheme to enable accurate, reliable assurance statements to be produced
• including a statement to indicate the consideration of internal controls which are relevant to the preparation of the data. This is to ensure a conclusion can be formed on the effectiveness of the Scheme Participant’s internal control process when preparing the data

3.3 Scheme Administrator

Scheme Administrators and responsible for:

• receiving the assurance reports and reviewing them against the requirements of the Regulations
• informing the Scheme Participant of acceptance or rejection of the assurance report
• consulting with the ICAEW (Institute of Chartered Accountants in England and Wales) or where required another professional body regarding any concerns about the performance of a practitioner

The appointment of a verifier is the responsibility of the Scheme Participant. The opinion of the verifier must be provided to the Scheme Participant and not to the Scheme Administrator. However, in its role as Scheme Administrator, the Environment Agency is a user of this data. The verifier needs to be aware of the specific requirements set out in this guidance and comply with the CHMM Regulations.

4. Independence of verifiers

ISAE 3000 (R) requires:

The practitioner shall comply with the provisions of the ethical pronouncements established by the assurance practitioner’s relevant professional body for assurance engagements and, if more demanding, the provisions of the IESBA Code related to assurance engagements, or other professional requirements, or requirements imposed by law or regulation, that are at least as demanding.

The International Code of Ethics for Professional Accountants (IESBA) provides the framework of principles that members of assurance teams, firms and network firms use to identify and safeguard against any threats to their independence.

Compliance with these requirements is mandatory. Compliance with ISAE 3000 (R) cannot be claimed unless these requirements are in place. An organisation’s internal standards or procedures alone are not considered to fulfil this requirement.

The IESBA code does not preclude a professional accountant within the supplier’s organisation (such as an internal auditor) from providing assurance. However, Regulation 17(1)(b)(i) of the CHMM Regulations requires that the assurance provider is not the Scheme Participant. As such, for the purposes of the CHMM scheme, verification by a professional accountant within the supplier’s organisation is not considered to be independent assurance.

The CHMM Regulations require that the assurance provider is not a ‘connected person’ to the Scheme Participant, as defined in section 1122 of the Corporation Tax Act 2010.

Conflicts of interest may exist where a verifier is independent of the supplier but has engaged with them in another capacity. An example of this would be situations where the verifier has collaborated with the supplier to design or implement the controls over information.

5. Professional competence and capability

ISAE 3000 (R) requires:

The practitioner shall accept or continue an assurance engagement only when…the practitioner is satisfied that those persons who are to perform the engagement collectively; have the appropriate competence and capabilities.

This includes both the work of the practitioner, and any expert they may engage to supply specialist technical input into the assurance activities.

Paragraph 16 and 31(b) and (c) of ISAE 3000 (R) states:

• “The practitioner shall have an understanding of the entire text of an ISAE, including its application and other explanatory material… “
• ”Have competence in assurance skills and techniques developed through extensive training and practical application”
• “Have sufficient competence in the underlying subject matter and its measurement or evaluation to accept responsibility for the assurance conclusion.”

The extent to which expert skills and knowledge relating to the sales of fossil fuel boilers are needed will depend on the complexity of the company or group of companies obligated by the scheme.

In the case of the verification of data from a large multi-national group, supplying hundreds of thousands of fossil fuel boilers, to both UK and overseas markets, this may require a high level of understanding of the various supply chains, IT systems and the ability to cross check and trace units.

Verifiers should be prepared to prove their competence to manufacturers as part of their appointment process.

6. Quality control

ISAE 3000 (R) states:

The engagement partner shall… be a member of a firm that applies ISQC 1, or other professional requirements, or requirements in law or regulation, that are at least as demanding as ISQC 1.

Under the International Standard on Quality Control (ISQC) 1, a firm of professional accountants has an obligation to establish a system of quality control. It must be designed to provide reasonable assurance that the firm and its personnel, comply with these professional standards, any regulatory and legal requirements.

Elements of quality control are relevant to the individual engagement and includes:

• leadership responsibilities for the quality of engagement
• ethical requirements
• acceptance and continuation of client relationships and engagements;
• assignment of the engagement teams
• performance
• monitoring

Compliance with the above quality control requirements is not optional. Compliance with ISAE 3000 (R) cannot be claimed unless these controls are in place. An organisation’s internal standards or procedures alone, are not considered to fulfil this requirement.

6.1 Accepting an assurance engagement

When accepting a new assurance engagement activity, the verification body should ask the Scheme Participant about any previous CHMM verification activities. If a previous verifier was appointed, the new verifier should send a letter of professional courtesy to enquire as to whether there is any reason they should not accept the appointment. This is due to a change of verifier being an indicator of potential risk.

7. Planning and risk assessment

7.1 Deciding the scope

Annual fossil fuel boiler sales reports will detail the number of relevant fossil fuel boilers sold within a specific scheme year. These will also detail those sales which are excluded due to the fossil fuel boiler being installed outside of the UK or in a new build property.

7.2 Understanding business and supply chains

A key aspect of fossil fuel boiler sales is for the verifier to gain an understanding of how your boiler sales are tracked through the supply chain. This includes understanding the nature and extent of the processes and controls in place to collect and report information. It should also include any known risks to the integrity of the data, such as when there are doubts over the reliability of the data.

The extent of the verification activities will depend on the types of data held by the Scheme Participant. For example, the verification process will be shorter where all fossil fuel boilers sold into the UK market have unique and traceable reference numbers. This will enable products to be linked to registration processes such as warranty registrations, which are subsequently linked to the installation address.  Where fossil fuel boilers are sourced from a range of non-UK producers and recorded on different systems, the verification process is likely to take longer.

Where businesses are using novel technologies and supply chains, there may be the need to introduce new processes and controls to collect and report data. This may require a more detailed assurance exercise, as the verifier will need to gain an understanding of the supply chain.

7.3 Understanding risks

There are several factors which may increase the risk of inaccuracies in the fossil fuel boiler sales data; these include, but are not limited to:

• the length and complexity of the supply chain
• the size and complexity of the company group
• the systems in place for product identification and traceability
• the volume of sales, the variability in destination of the product and range of products
• the IT systems that record product and financial details
• the quality control procedures and checking that are in place
• the processes and controls that the organisation has in place regarding the compilation of a return

8. Determining materiality

ISAE 3000 (R) requires an assessment of the risk of material misstatement, so an assessment of materiality is needed.

Verifiers may consult with the Scheme Participant when making their determination of materiality. However, verifiers are responsible for making an independent assessment of the material issues for their testing procedures.

Information becomes material if its presence or absence will affect the decisions, actions or performance of the reporting party or the users of the report. Under the CHMM scheme, annual fossil fuel boiler sales reports will be used to generate low-carbon heat targets. This information is therefore material as it would change the number of low-carbon heat pump credits required in the scheme year.

The materiality threshold for fossil fuel boiler sales is expected to be <1% of the relevant sales.

8.1 Determining criteria

Criteria are defined by IAASB and are used as the benchmark to evaluate or measure assurance engagement. This includes where relevant, benchmarks for presentation and disclosure.

The CHMM scheme guidance sets out the requirements for the fossil fuel boiler categories and the details that need to be reported. This is the criteria against which the data in the reports should be measured. Verifiers will need to have knowledge of the CHMM reporting requirements to ensure they can comply with Regulation 17 of the Regulations.

When assessing a report against the requirements of the Regulations, particular consideration should be given to the following:

• traceability of information throughout the supply chain
• completeness of the reported data, meaning the extent to which all the relevant information known about fossil fuel boiler sales has been reported
• consistency of methodologies used in reporting
• accuracy of the reporting party’s collation and reporting of information

9. Assurance strategy development

9.1 Mapping controls and systems

Controls over non-financial information may not be as well established as controls for financial information. Where existing controls are in place, the verifier should review these controls.

If a verifier intends to place reliance on these systems or controls, they must perform a suitable level of testing. The reliance placed on existing controls over information needs to be considered in the light of materiality and the inherent risks of misstatements. It is the verifier’s professional judgement, based upon the evidence available, whether the system or controls can be relied upon.  

There are three main categories for the controls over information that may be in place.

9.1.1 Internal systems

Internal systems are those developed and managed by either the Scheme Participant or by one of the parties involved in their fossil fuel boiler sales supply chain.  

Contractual requirements

Verifiers should consider whether the parties contributing to the data within a group or the boiler sales supply chain are contractually obliged to provide certain information.

In the attitude of professional scepticism required by ISAE 3000 (R), the verifier must not assume that a contractual requirement for a supplier to provide information to a reporting party means that the information is reliable.

Documentation to support claims

Documentation to support fossil fuel boiler sales, such as a declaration from a group subsidiary, may be a form of sales data used by Scheme Participants.

The verifier needs to understand the availability of this documentation across the supply chain. They must develop procedures to assess the reliability of such documentation. They must also decide if there is sufficient and appropriate evidence to support the fossil fuel boiler sales information provided, or if further substantive testing is needed.

Fossil-fuel boiler sales data should be information that can be traceable and, in some cases may need to be traceable back to individual boiler units. A declaration from a subsidiary relating to total boiler sales, is not likely to be sufficient evidence of accurate sales data.

Scheme Participants may have a system for preparing their data, such as a database or spreadsheet that is populated with information obtained from sales records. The verifier should be expected to evaluate the reliability of such systems by means of confirming that the database or spreadsheet has been accurately populated.

Import and export documentation may be tracked on a Scheme Participant’s financial system by means of financial transactions. These financial systems may already be subject to audit by the company’s financial auditors.

9.1.2 Internal assurance mechanisms

These include the extent to which the Scheme Participant’s internal assurance processes extend to reviewing its supply chain in addition to their own internal assurance mechanisms. Evidence of internal assurance may include audit reports that have examined the controls around information provision. To build confidence in internal assurance mechanisms, the verifier will need to ensure they understand the scope of any assurance activities and the competencies of those undertaking the assurance.

Where appropriate internal assurance mechanisms are in place, the verifier will need to develop testing procedures. These procedures will need to assess the reliance that can be placed on the outputs of the internal assurance process. Where such internal assurance mechanisms are mature and functioning effectively, the verifier may be able to place reliance on this assurance. However, where such systems are immature or are not functioning effectively, the verifier will be unable to rely on the assurance process and will need to undertake substantive testing to obtain sufficient evidence.

9.1.3 External assurance mechanisms

External assurance over supplier declarations is likely to play an important role in enabling suppliers to demonstrate the reliability of the information they can provide.

External assurance may be provided in the form of a third-party audit over aspects of the supply chain. The verifier should not seek to duplicate other forms of third-party assurance that may be in place. However, they do need to develop procedures to enable them to evaluate whether the third-party assurance can be relied upon.

9.2 Developing testing procedures

The verifier will need to develop testing procedures. These will need to be based on the outcomes of the ‘Planning and Risk Assessment’ phase of the assurance process and the mapping of risks and controls.

The verifier will specify the nature, timing and extent of evidence gathering procedures to be performed and the reasons for selecting them. The testing procedures will be designed to obtain sufficient and appropriate evidence to enable the engagement risk to be reduced to a level whereby an assurance opinion can be provided.

The type of assurance activities the verifier may seek to undertake at different levels of the supply chain, will vary according to where in the supply chain the activity is taking place.

The verifier may want to evaluate sources of information from across a company group and the assurance activities may validate this collection process or test the controls the business has in place.

The exact testing procedures developed by a verifier will vary. This will depend upon the nature of the Scheme Participant’s reporting party’s supply chains and the complexity and size of the boiler sales portfolio. However, in designing these procedures, there are common considerations that all verifiers need to consider. These are traceability, completeness, and accuracy.

9.3 Traceability

In seeking to assess traceability the verifier should consider the following question:

Is the reported information traceable back to the party or parties that generated the original source information through a suitable chain of evidence?

In developing procedures for assessing traceability, the verifier needs to be mindful of the complexity of the supply chain. The complexity of supply chains may vary significantly between different manufacturers, within a group of manufacturers and between different Scheme Participants.

Access to the supply chain will be a key factor in deciding the assurance conclusions that the verifier is able to provide and may require assistance of the Scheme Participant to secure appropriate access.

9.4 Completeness

In seeking to assess completeness, the verifier should consider:

• has all the relevant information known about the number of fossil fuel boiler sales been reported in full?
• have all parts of the corporate group reported their boiler sales numbers?

9.5 Accuracy

In seeking to assess accuracy, the verifier should consider:

• have fossil fuel boiler sales been categorised and aggregated accurately?
• have calculations been performed accurately?

Testing procedures will include an examination of the systems, processes and controls used by the Scheme Participant in collating fossil fuel boiler sales data. This will be informed by the assessment of the effectiveness of the controls and will also include detailed checking to verify the accuracy of reported data.

10. Execution

10.1 Performing testing (quality and nature of evidence)

For the CHMM scheme, the verifier may obtain evidence that either contradicts or is insufficient to verify the Scheme Participant’s boiler sales data.

ISAE 3000 (R) requires the verifier to obtain ‘sufficient appropriate evidence’ upon which to base their conclusions.

Sufficiency is the quantity of evidence needed to reach a conclusion, and appropriateness is the relevance and reliability of this evidence. The standard requires that the verifier must use their professional judgement and exercise professional scepticism in evaluating the quantity and quality of evidence, and thus its sufficiency and appropriateness, to support the assurance conclusions.

ISAE 3000 (R) defines professional scepticism as:

An attitude that includes a questioning mind, being alert to conditions which may indicate possible misstatement, and a critical assessment of evidence.

The International Framework for Assurance Engagements provides some generalities about the reliability of evidence, whilst recognising that important exceptions exist, namely:

• evidence is more reliable when it is obtained from sources outside the appropriate party (or parties)
• evidence that is generated internally is more reliable when the related controls are effective
• evidence obtained directly by the practitioner (for example, observation of the application of a control) is more reliable than evidence obtained indirectly or by inference (for example, inquiry about the application of a control)
• evidence is more reliable when it exists in documentary form, whether paper, electronic, or other media (for example, a contemporaneously written record of a meeting is more reliable than a subsequent oral representation of what was discussed)

The CHMM scheme guidance specifies the information reporting parties are required to report in terms of their fossil fuel boiler sales.

10.2 Reviewing and challenging information

If, during the verification activities, the verifier finds evidence that some of the data is incorrect, or where there is insufficient evidence to support the claim, the verifier should discuss this with the Scheme Participant. Information which is incorrect or insufficiently supported by evidence must be amended by the Scheme Participant.

In the event of the verifier being notified of a change in the evidence supporting the boiler sales information after the initial engagement, they should assess the change. The verifier should also provide a statement as to the materiality of that change and how it bears on the assurance report.

If the amendment of the boiler sales data does not result in a new assurance report, the verifier should provide a statement to the Scheme Participant that the change is not material to the original assurance.

If the new evidence is material and alters the original assurance report, then this should be notified to the Scheme Participant who will need to notify the Scheme Administrator, if the assurance report has already been submitted.

10.3 Ensuring changes are made

If the verifier has asked the Scheme Participant to amend their data, they should ensure these changes have been made correctly before issuing their assurance opinion.

If the Scheme Participant is unable or unwilling to make the changes, the verifier should consider the impact on their assurance report. ISAE 3000 (R) recommends the verifier consider if their assurance report is still valid and whether the engagement should continue in its current form.

11. Conclusion and reporting

11.1 The assurance report

The verifier needs to ensure their assurance report follows the ISAE 3000 (R) standard.

Submitted annual fossil fuel boiler sales report with a non-compliant assurance report will not be accepted. Some of the requirements relevant to the CHMM scheme are:

• title – including the words ‘independent assurance report’
• addressee – the addressee is the party or parties to whom the report is addressed This may be the management of the Scheme Participant that has commissioned the verification
• statement that the engagement was performed in accordance with ISAE 3000 (R) and not simply ‘with reference to’, and the assurance level provided
• description of the subject matter
• applicable criteria against which the Scheme Participant’s data has been assessed
• statement that the subject matter information may not be suitable for any other purpose
• statement to identify the Scheme Participant and describing their responsibilities and the practitioner’s responsibilities
• statement that the firm of which the practitioner is a member applies ISQM 1, or another professional requirements or requirement in law or regulation that are at least as demanding as ISQC 1. If the practitioner is not a professional accountant, the statement should identify the requirements applied
• declaration that the verifier has appropriate expertise and is not the supplier or a connected person to the supplier
• statement that the firm of which the practitioner is a member follows the independence and other ethical requirements, or requirement in law or regulation, which are at least as demanding as IESBA Code parts A and B.  If the practitioner is not a professional accountant, the statement should identify the requirements applied
• statement to indicate that the report is accurate to the best knowledge and belief
• details of the work performed, as the basis for the practitioner’s conclusion. This will need to include the nature, timing, and extent of evidence-gathering procedures. This needs to be sufficiently detailed for readers of the assurance report to readily understand what work the verifier has performed. It must also include a description of what activities have been undertaken at the level of the reporting party and how the evidence for information from the supply chain has been tested
• assurance conclusion and any modifications to that conclusion. The language used must be appropriate to a reasonable assurance engagement. An assurance statement with modified conclusions will be carefully assessed by the Scheme Administrator but may not be accepted as fulfilling the requirements of the scheme.
• should there be the resubmission of an annual boiler sales report which has been previously considered by the Scheme Administrator, a statement that the verifier has taken the changes into account when supplying the new assurance statement
• practitioner’s signature
• date of the assurance report

Any emphasis of matter or other matter paragraphs or additional information should be clearly separated from, and worded such that they do not detract from, the conclusion of the report.

Assurance reports that do not address the above requirements will not be accepted as providing an adequate level of assurance. Where evidence is not available for a particular requirement, a statement explaining the reasons for its absence should be provided.

The Scheme Participant is responsible for ensuring the verifier’s assurance report is provided to the Scheme Administrator together with the fossil fuel boiler sales data.

However, the content of the assurance report is the sole responsibility of the verifier.

12. For help

If you need you need any further clarification, please contact the CHMM helpdesk at chmm@environment-agency.gov.uk.