The 2026 assurance-escalation window in California SB 253 limited-to-reasonable assurance transition

Here's the issue: California Senate Bill 253 (Climate Corporate Data Accountability Act) requires Scope 1 and Scope 2 emissions disclosure starting in 2026, with limited assurance from 2027 and reasonable assurance from 2030. For entities with over one billion dollars in annual revenue doing business in California, this creates a clear timeline. Finance teams are budgeting for the first limited-assurance engagement in 2027. However, that budget assumes audit fees will remain stable through the transition to reasonable assurance in 2030.

However, SB 253 assurance consists of two things: the limited engagement itself and the methodology foundation that determines reasonable-assurance pricing.

The limited engagement on its own has no value for 2030 pricing. The methodology foundation—how you quantify emissions, document uncertainty, handle missing data, and maintain evidence lineage—is what the auditor is actually pricing for when reasonable assurance begins. If your 2027 limited-assurance engagement accepts supplier estimates without documentation, uses generic emissions factors without facility-level evidence, or lacks a reproducible calculation lineage, you are not building the foundation for reasonable assurance. You are building audit rework.

While limited assurance has become the 2027 starting point, reasonable assurance has become the 2030 endpoint with no mandatory methodology lock-in between them. If the methodology you use for your 2027 limited engagement cannot scale to reasonable assurance without a full inventory rebuild, the cost of reasonable assurance in 2030 might outpace the savings from a simplified 2027 approach by a factor of two to four times. For a mid-sized entity, that gap represents one hundred fifty thousand to three hundred thousand dollars in unplanned audit fees, plus the internal cost of remediating three years of methodology decisions.

How do you solve this? I think CFOs need to treat 2026 as a methodology-lock window, not a reporting exercise. The entities we work with are using the 2026 no-assurance cycle to establish SOX-grade evidence lineage, document quantification choices, and test their calculation reproducibility against the standards auditors will apply in 2030. For now, that means treating November 10, 2026 as the last opportunity to lock methodology decisions before limited assurance begins.

The shape of the argument, visualised below.

The SB 253 assurance timeline

The California Air Resources Board (CARB) finalized the Initial Regulation on February 26, 2026, and revised it again on June 24, 2026, establishing a phased assurance roadmap that scales from no assurance in 2026 to reasonable assurance in 2030^[1]. The timeline creates three distinct windows:

CARB has exercised enforcement discretion for the 2026 cycle, accepting Scope 1 and Scope 2 submissions with or without assurance, based on data entities were already collecting by December 2024^[2]. This discretion applies only to the first reporting cycle. Starting in 2027, limited assurance from an independent provider becomes mandatory.

The regulation also staggered the fiscal-year treatment for 2026 reporting: entities with fiscal years ending between January 1, 2026 and February 1, 2026 report data from that fiscal year, while entities with fiscal years ending after February 1, 2026 report data from the fiscal year ending in 2025^[3]. This ensures all entities have at least six months post-fiscal-year-end to prepare submissions.

The methodology-lock problem

The assurance escalation from limited to reasonable is not a linear increase in audit depth. It is a categorical shift in evidence standards. Limited assurance provides "negative assurance"—the auditor states they found no material misstatements. Reasonable assurance provides "positive assurance"—the auditor states the emissions are fairly presented in all material respects^[4].

This shift changes what constitutes acceptable evidence:

• Limited assurance (2027–2029): auditor reviews management's quantification process, tests a sample of calculations, and evaluates whether the methodology is consistent with the GHG Protocol. Supplier estimates without supporting documentation may be acceptable if management can demonstrate reasonable diligence.
• Reasonable assurance (2030 onward): auditor must verify population-level evidence, test internal controls over emissions data, and confirm that every material number is reproducible from source documents. Supplier estimates without facility-level evidence or utility bills become audit findings.

CARB has proposed allowing several assurance standards for limited engagements: AA1000AS v3, AICPA AT-C Section 210, ISAE 3410 (with ISAE 3000 for engagements starting before December 15, 2026), ISSA 5000 (for engagements starting on or after December 15, 2026), and ISO 14064-3:2019^[5]. However, the regulation does not specify which standards will apply for reasonable assurance, and the escalation path between them remains undefined.

For CFOs, this creates a hidden timing risk. If your 2027 limited-assurance engagement uses a methodology that cannot scale to reasonable assurance without a full rebuild, you are locking in three years of audit rework. The 2026 no-assurance window is the last opportunity to establish a methodology foundation before assurance begins.

The fiscal-year data gap

The 2026 reporting cycle introduces a second timing challenge: which fiscal year to report. For entities with fiscal years ending after February 1, 2026, the November 10, 2026 deadline requires reporting data from the fiscal year ending in 2025^[6]. For calendar-year entities, this means reporting 2025 Scope 1 and Scope 2 emissions by November 10, 2026—less than eleven months after the data year closes.

CARB's FAQ clarifies that entities with more recent data may voluntarily report it, given the extended deadline from the original August 10, 2026 date^[7]. However, voluntarily reporting 2026 fiscal-year data creates a precedent for which fiscal year future reports will cover, particularly when limited assurance begins in 2027.

The gap matters for methodology lock-in. If you use the 2026 cycle to report 2025 data with a simplified methodology—generic emissions factors, supplier estimates without documentation, or manual calculation processes—you establish a baseline that auditors will compare against in 2027. If your 2027 limited-assurance engagement uses a different methodology, the auditor must reconcile the change and evaluate whether it materially affects comparability.

For entities already collecting emissions data by December 2024, CARB expects a full Scope 1 and Scope 2 inventory for 2026, even without assurance^[8]. For entities that were not collecting data, CARB allows a "non-collection statement" for 2026, but this is a last resort. You will be expected to file a full inventory with assurance from 2027, with no methodology dry run.

"CARB will exercise enforcement discretion for the first report due in 2026, allowing reporting entities to submit Scope 1 and Scope 2 emissions for their prior fiscal year based on information they already have or were collecting when this Notice was issued, whether or not the data received limited assurance. During the November 2025 workshop, CARB emphasized that this discretionary relief is only applicable in the first year of reporting."^[8]

The assurance-cost escalation path

The financial impact of the limited-to-reasonable transition is not hypothetical. Assurance providers are already re-pricing engagements to reflect the evidence standards required for reasonable assurance. For entities without SOX-grade evidence lineage, the cost difference between limited and reasonable assurance ranges from 1.8x to 3.5x the limited-assurance fee, depending on inventory complexity and data maturity^[9].

Three factors drive this escalation:

1. Population-level evidence: reasonable assurance requires verifying every material data point, not a sample. If your inventory includes two hundred Scope 1 sources, the auditor must confirm that two hundred source documents exist and are reproducible.
2. Internal controls testing: reasonable assurance requires evaluating the design and operating effectiveness of controls over emissions data. If you lack documented controls for data collection, calculation review, or approval workflows, the auditor must test compensating controls or issue a qualified opinion.
3. Quantification uncertainty: reasonable assurance requires quantifying and disclosing measurement uncertainty for each emissions source. If you used generic emissions factors without documenting why facility-specific data was unavailable, the auditor must evaluate whether the uncertainty is material.

For mid-sized entities (one billion to five billion dollars in revenue), typical audit fee ranges are:

The delta between the third and fourth rows—one hundred ten thousand to two hundred ten thousand dollars—is the cost of methodology decisions locked in during the 2026 no-assurance window.

The 2026 methodology-lock window

CFOs have a narrow window to establish methodology foundations before limited assurance begins in 2027. The 2026 reporting cycle, while exempt from assurance, is the last opportunity to test calculation reproducibility, document quantification choices, and establish evidence lineage without audit pressure.

Five priorities for the 2026 cycle:

1. Document your quantification methodology: for every Scope 1 and Scope 2 source, document which emissions factor you used, why you selected it, and what facility-specific data was unavailable. CARB requires consistency with the GHG Protocol standards in effect at the time of reporting^[10]. If you used generic factors, document the diligence you performed to confirm facility-specific data was not reasonably available.

2. Establish evidence lineage: for every material number in your 2026 submission, confirm you can reproduce it from source documents. If your Scope 2 electricity emissions are based on utility bills, confirm the bills are retained, readable, and reconciled to your accounting system. If your Scope 1 fuel combustion is based on purchase records, confirm the records are complete and include fuel type, quantity, and date.

3. Test calculation reproducibility: have a colleague recreate your emissions calculations from source documents using your methodology documentation. If they cannot reproduce your numbers within a materiality threshold (typically one to five percent), your methodology documentation is incomplete.

4. Map your Scope 3 exposure: while Scope 3 reporting does not begin until 2027, the 2026 cycle is the time to identify your most material Scope 3 categories and begin engaging suppliers. CARB has proposed requiring the most commonly reported Scope 3 categories in 2027^[11]. For most entities, this will include Category 1 (purchased goods and services) and Category 3 (fuel- and energy-related activities not included in Scope 1 or Scope 2). If you wait until 2027 to engage suppliers, you will not have time to collect primary data before the 2027 reporting deadline.

5. Establish internal controls: reasonable assurance in 2030 will require documented controls over data collection, calculation review, and approval workflows. Use the 2026 cycle to establish roles and responsibilities, approval authorities, and data validation procedures. If you lack documented controls in 2026, you will need to establish them and demonstrate operating effectiveness for at least one fiscal year before the 2030 reasonable-assurance engagement.

The November 10, 2026 deadline is less than four months away. Entities that treat it as a compliance exercise—submitting what they have without testing reproducibility—are locking in methodology decisions that will drive 2030 audit fees. Entities that treat it as a methodology dry run are establishing foundations that reduce reasonable-assurance costs by one hundred thousand to two hundred thousand dollars per year.

The Scope 3 preview

While the 2026 cycle covers only Scope 1 and Scope 2 emissions, it previews the Scope 3 challenge that begins in 2027. CARB has indicated that Scope 3 reporting will be phased in by category, starting with the most commonly reported categories^[12]. For most entities, this will include:

• Category 1 (Purchased goods and services): upstream emissions from purchased materials, components, and services. Requires supplier-specific data or supplier engagement to collect primary data.
• Category 3 (Fuel- and energy-related activities): upstream emissions from electricity transmission and distribution, fuel extraction and refining, and purchased steam or cooling. Requires utility-specific emissions factors or facility-level data from energy suppliers.
• Category 4 (Upstream transportation and distribution): emissions from third-party transportation and warehousing. Requires carrier-specific fuel consumption data or distance-based calculations with documented transport modes.

CARB has not yet finalized which categories will be required in 2027, but the proposed rulemaking is expected in fall 2026^[13]. The critical insight: Scope 3 assurance is not required in 2027, 2028, or 2029, but CARB has reserved the right to require it in the future. If you establish Scope 3 methodology in 2027 without considering future assurance, you risk the same escalation problem that Scope 1 and Scope 2 entities face in 2030.

The 2026 cycle is the time to map your Scope 3 exposure, identify material categories, and begin supplier engagement—not to comply with 2027 reporting, but to lock in a methodology that can scale to assurance when CARB requires it.

How Emission3 fits

Emission3 is designed for the 2026 methodology-lock window. We help entities establish SOX-grade evidence lineage during the 2026 no-assurance cycle, so the methodology you use in 2026 scales directly to reasonable assurance in 2030 without a rebuild.

Our approach:

• Document-first: we start with source documents (utility bills, fuel receipts, purchase orders) and build calculation lineage from the ground up. Every number in your 2026 submission is reproducible from source documents, with documented quantification choices and missing-data protocols.
• Deterministic calculation: we use facility-specific emissions factors where available, document why generic factors were used where not, and quantify measurement uncertainty for each source. Your 2026 submission becomes the baseline for 2027 limited-assurance comparisons.
• Assurance-ready outputs: we export evidence packs that include source documents, calculation lineage, and methodology documentation in the formats auditors expect. When limited assurance begins in 2027, your auditor starts with population-level evidence, not a sample.
• Scope 3 preview: we map your Scope 3 exposure during the 2026 cycle and identify which categories will be material in 2027. For Category 1, we begin supplier engagement in 2026 so you have primary data when Scope 3 reporting begins.

We work with entities who recognize that the 2026 no-assurance window is a methodology-lock opportunity, not a compliance delay. Typical engagement: a CBAM readiness call where we map your Scope 1, Scope 2, and Scope 3 exposure, identify evidence gaps, and scope a 2026 implementation timeline. No anonymous self-serve onboarding.

See our audit-ready exports at /solutions/audit, or book a CBAM readiness call at /book-demo to map your 2026 methodology-lock roadmap.

The 2027 rulemaking preview

CARB has indicated that proposed rulemaking for 2027 and beyond will be published in fall 2026, with a 45-day comment period^[14]. This rulemaking will clarify:

• Which Scope 3 categories are required in 2027.
• Whether assurance standards beyond those proposed for 2027 will be added for reasonable assurance in 2030.
• How CARB will enforce comparability between reporting years if entities change methodologies.
• What constitutes a "good faith effort" for entities that file a non-collection statement in 2026.

The timing matters. If the fall 2026 rulemaking is published in October or November, entities will have less than one month between the November 10, 2026 Scope 1 and Scope 2 deadline and the start of the 45-day comment period. Entities that wait for the 2027 rulemaking to finalize their methodology will not have time to implement changes before the 2027 reporting deadline.

The 2026 cycle is the last window to lock methodology decisions before assurance begins. CFOs who treat November 10, 2026 as a compliance deadline—rather than a methodology-lock opportunity—are deferring one hundred fifty thousand to three hundred thousand dollars in 2030 audit fees to the 2027 cycle, when those fees cannot be avoided.

What to start this week

If you are a CFO or finance leader at an entity with over one billion dollars in annual revenue doing business in California, your 2030 reasonable-assurance audit fees are being determined by decisions you make (or defer) in the next four months. Three actions for this week:

1. Confirm your fiscal-year reporting: if your fiscal year ends after February 1, 2026, you are reporting 2025 data by November 10, 2026. Confirm you have source documents (utility bills, fuel receipts) for all material Scope 1 and Scope 2 sources for the 2025 fiscal year. If you do not, you may need to file a non-collection statement and begin full inventory collection for 2027.

2. Document your quantification methodology: for every material Scope 1 and Scope 2 source in your 2025 inventory, document which emissions factor you used and why. If you used generic factors, document what diligence you performed to confirm facility-specific data was unavailable. This documentation becomes your baseline for 2027 limited-assurance comparisons.

3. Map your Scope 3 exposure: identify your five most material Scope 3 categories by revenue impact or emissions intensity. For Category 1 (purchased goods and services), list your top twenty suppliers by spend and begin outreach to collect facility-level emissions data. CARB has indicated Scope 3 reporting begins in 2027, and supplier engagement takes three to six months.

The November 10, 2026 deadline is sixteen weeks away. Entities that use this window to establish SOX-grade evidence lineage are locking in methodology foundations that reduce 2030 audit fees by one hundred thousand to two hundred thousand dollars per year. Entities that submit what they have without testing reproducibility are deferring those costs to 2027, when they cannot be avoided.

Book a CBAM readiness call at /book-demo to map your 2026 methodology-lock roadmap, or see our audit-ready exports at /solutions/audit.